Re: Security concerns with minified javascript code
Neil Williams, le Fri 28 Aug 2015 10:32:52 +0100, a écrit :
> On Fri, 28 Aug 2015 10:45:16 +0200
> Samuel Thibault <sthibault@debian.org> wrote:
>
> > Vincent Bernat, le Fri 28 Aug 2015 10:06:17 +0200, a écrit :
> > > Maybe it can be trimmed a bit more, but that's still 239 unique
> > > dependencies.
> >
> > Note that you don't have to make that 239 debian packages, you could
> > as well just ship them all in one package, as long as the whole code
> > passes NEW, i.e. all their copyrights are fine.
>
> Depends how many upstreams are involved and therefore how many release
> schedules.
As long as we have a set that works, we are fine. Upstream has to have
one anyway, we can just take that one.
> I still find it hard to believe that *so* much code is required to
> minify JS. The excuse that JS is "moving fast" is nonsense.
I would rather say "worrying" actually.
> Why isn't there a KISS tool to do this? Is it all just special
> snowflake optimisations for what has to be / should be a simple process
> of removing whitespace and collapsing the formatting?
No, it also modifies the code, e.g. turning !foo && !bar into
!(foo || bar), which is one character less.
I wonder why mere gzip compression is not used. Don't all browsers
support Accept-Compress: gzip?
Samuel
Reply to: