all 8 comments

sorted by: hot top controversial new old
[–] [S] 8 points 1 year ago (2 children)
  • [–] 5 points 1 year ago (4 children)

    Can a front-end person explain what a sourcemap is, and what this source code is for?

  • source
  • hideshow 4 child comments
  • [–] 3 points 1 year ago*

    A source map is a file that maps minified code (such as ES5 or any Javascript) to the original source code (e.g. ES Modules, Typescript, etc). This makes it easier for developers to debug problems. Source maps aren’t unique to Frontend web development, but the scenario in the article is.

    Imagine if I asked you to fix an English subtitle typo in a film that was subtitled in a language you’re unfamiliar with (maybe Mandarin). At first you wouldn’t understand anything in the film, other than the pretty pictures, and struggle to find the correct segment to fix. But later I provide you with an English subtitle file and timestamp for the movie, so you could go find the actual place to fix the issue. This is kind of what source maps are like, they allow us to map from compiled code to the original, making it easier for us to debug and context switch less, saving a lot of time. They also allow us to better understand the original intent, since it’s the actual source.

    The source code is the original source at the time it was recorded for the Apple App Store on the web. But will quickly become out of date as changes are made frequently by Apple.

  • source
  • parent
  • 62 comments in c/programmer_humor@programming.dev view that post
    [–] 141 points 1 year ago* (1 child)
  • [–] 97 points 1 year ago (8 children)

    Isn’t that just effectively un-minified? It’s just the client side code in the first place?

  • source
  • hideshow 8 child comments
  • [–] 43 points 1 year ago (3 children)
  • [–] 83 points 1 year ago (7 children)

    Copyrighted content

    archived them

    on GitHub

    Idk man 🧐
    Run the countdown to when it's taken down

  • source
  • hideshow 7 child comments
  • [–] 23 points 1 year ago* (2 children)

    There's lots of content sitting just below the surface on github. Any time you make a PR on a repo, even if it gets closed or "deleted" by the repo owner, the actual link to the file itself stays there forever if you save it. Github's own dmca repo even has warez links on it, sitting there for years.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago* (1 child)

    You could argue that since it's publicly available and this repo only archives it that... I don't know man Copyright law is confusing.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 1 year ago

    I think you can get some kind of exemption for archival purposes. I know that the Internet Archive has one. But I also know that ultimately Microsoft is responsible for the data hosted on Github, and Microsoft's interest is to not even risk getting sued.

  • source
  • parent
  • [–] 61 points 1 year ago (3 children)

    SVELTE 🥹 (im very happy to see svelte)

    Also I'm scared that this person may be risking their github account by posting this, I dunno if it's legal to "distribute" apples website code yourself. If not, best hope they dont ban your whole account.

  • source
  • hideshow 3 child comments
  • [–] 91 points 1 year ago (15 children)

    Security through obscurity is not security. I see no reason why source maps should be unavailable.

  • source
  • hideshow 15 child comments
  • [–] 72 points 1 year ago (5 children)

    Because source maps show how shitty your organization's code and overall engineering practices are.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 45 points 1 year ago (4 children)

    Ding ding ding

    Open source code is usually quite nice and well done because money pressure is way less of an issue and everyone knows people will be looking at your code

  • source
  • parent
  • hideshow 4 child comments
  • [–] 9 points 1 year ago (2 children)

    That's probably also why development is usually really slow and most maintainers can't keep up/give up.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 16 points 1 year ago (1 child)

    Nope, it is simply because they are overwhelmed. Either it's too much work to do after your day job or just too much work for one person.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    Also what I've heard from open-source project maintainers, once a project gets popular, the flood of feature requests is neverending. (Something I'm sure I contributed to over the years 🫣) And especially in cases of feature requests with niche usefulness or mismatching vision, they can sap developer morale.

  • source
  • parent
  • [–] 11 points 1 year ago (5 children)

    depends.

    if we're talking about a personal website nobody will care. if you are a multibillion company and there's the risk that literally anyone can create a 1:1 clone of your services... yeah that's a bit of a trouble

  • source
  • parent
  • hideshow 5 child comments
  • [–] 8 points 1 year ago (4 children)

    Omitting source maps doesn't prevent that.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 1 year ago (1 child)

    no it doesn't, and I am very aware that if anything runs on someone's computer then it can get replicated. but it gets slightly harder, also to reverse-engineer it or find potential fallacies. as well as source maps on prod are just a waste of bandwidth

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago*

    Dunno, this "harder" argument while valid sounds just like false security. That's why I don't see much weight in it.

    As for bandwidth, source maps are not automatically pulled from server, so it also seems like a false issue to me.

  • source
  • parent
  • [–] 1 point 1 year ago (1 child)

    No, but it's a sensible security measure. Anything to make it harder.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 4 points 1 year ago

    That's the thing, it's not actually a security measure. Security through obscurity is not security. It can provide false security impression that is more harmful in my opinion.

    Having source maps can encourage proper security practices. Which, in my books, very much outweighs any security benefits of hiding them.

  • source
  • parent
  • [–] 1 point 1 year ago (2 children)
  • [–] 44 points 1 year ago (5 children)

    You’re supposed to disable source maps in prod?

    Asking for a friend

  • source
  • hideshow 5 child comments
  • [–] 20 points 1 year ago (3 children)

    Just to save on wasted bandwidth for the client (and your server) is why I would disable them.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 37 points 1 year ago

    they're different files generally, the only client that will automatically request them is a debugger.

    you turn them off because you don't want to expose your full source code. if you would be ok making your webpage git repo public then making sourcemaps available is fine.

  • source
  • parent
  • AFAIK, the source maps are only actually requested/downloaded when the user opens the dev tools. There’s no reason to have them automatically download for every visitor. The enable/disable simply toggles whether or not the request is accepted when the user opens the dev tools.

    So if my understanding is correct, keeping it enabled wouldn’t really impact server load, unless lots of users are constantly using the dev tools.

  • source
  • parent
  • [–] 30 points 1 year ago (2 children)

    Yo gimme a repo link, you can’t blueball us like that

  • source
  • hideshow 2 child comments
  • [–] 26 points 1 year ago

    Our international teams kept enabling sourcemaps and I just had devops lock the directory to vpn access only 🤷

    I know sourcemaps aren't the end of the world as it's all client side code that lives on the clients computer but it just feels dirty

  • source
  • [–] 50 points 1 year ago

    And now the source code is part of copilot

  • source
  • [–] 15 points 1 year ago

    I’m gonna download this to my iPhone, just in case.

    Try and stop me, Tim Apple!

  • source
  • [–] 28 points 1 year ago (4 children)

    Is this interesting for some reason?

  • source
  • hideshow 4 child comments
  • [–] 49 points 1 year ago (2 children)

    It’s how the web worked before minifiers, so kinda but not really.

    You just have comments and original variable/function names.

    I’m sure someone will argue this helps scrapers or hackers, but really it’s not that big of a deal.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago

    It's sensational news.

    It gets the bottom 50% thinking Apple fucked up, and they can now ask ChatGPT to just copy the App Store because that's all that is holding them back from being a temporarily embarrassed millionaire: Source Maps...

  • source
  • parent
  • [–] 12 points 1 year ago

    iirc Apple music's web ui also has sourcemaps, but I'm not subbed to apple music anymore to check. Its neat, but not really a huge blunder, nor takedown worthy.

  • source
  • [–] 8 points 1 year ago

    // these are unicode characters in four hex…

    If your dev team needs a comment explaining this I have some serious concerns about their qualifications.

  • source
  • [–] 4 points 1 year ago

    Incompetent-source!

  • source
  • [+] -28 points 1 year ago (2 children)

    Who cares. Comments could be interesting but AI can do this pretty well on most JS these days.

  • source
  • hideshow 2 child comments
  • [–] 13 points 1 year ago

    AI is still shit when it comes to obfuscated code. This is before it's all been obfuscated and become unreadable.

    I've tried using AI to handle obfuscated scripts and it makes way too many assumptions as to what the code is trying to achieve.

  • source
  • parent
  • [–] -2 points 1 year ago

    My thoughts, exactly: Why is this a big deal? Imagine the positive press it would be if Apple came out and said, "We did that on purpose. More companies should be this open!"

    The security impact of this: Zero (clients are already given the code)

    The reputational impact: Could be great! Or could be bad if they play this the wrong way.

  • source
  • parent