The Hazards of Exposing Business Logic on the Client, Part II

Dietrich Kappe, Wednesday, September 6, 2006 @ 8:00 am

A double dose of "I told you so" today: as it turns out, stealing an idea is hard work, while stealing an implementation is dead easy. By that I mean that if you want to steal a server-based web application, you either have to hack in to steal the code or do the hard work of reverse engineering and coding a clone. But if you're developing client-side code in JavaScript, you are vulnerable to theft. It's the recurring theme of Ajax and Leaky Business Logic, and I'm going to keep talking about it until it doesn't happen anymore.

You remember the incident where the image editing webapp Snipshot was ripped off by Cellsea? Well it looks like it's happened again, this time with one of Emil Eklund's WebFX tools -- LiteSpellChecker -- being ripped off by SpellingCow. Emil reviews the code and appearance of his original program with the derivative one and finds several suspicious similarities. His program was a demo, but copying code whether demo or not without attribution is a big no no.

If you are going to write business logic on the client side rather than just sticking to display logic, you need to at least obfuscate your code to make maintenance and reverse engineering a headache. Better yet, stick to writing Ajax applications in server-side frameworks like Echo2 and ZK.

Update: Thanks to Doug Clinton for pointing out the update from Emil. I guess all I can add is the only thing that makes this not a ripoff is Emil's laid back attitude.

Technorati : ajax, code theft, javascript, obfuscation

Related posts:

1. The Hazards of Exposing Business Logic on the Client
2. Ajax and Leaky Business Logic
3. Cognitive Load, Portability and the Superiority of Client-Side Frameworks
4. Leaky Business Data and Logic with GWT
5. edge case city: requirements and testing dates for HR business logic

Comments (1)

Software Development

Comments: 1 so far

• Leave a comment
• Comment feed for this post
• TrackBack URL

1. 

   Note that Emil has posted this update http://me.eae.net/archive/2006/09/05/spellingcow-followup/ after receiving a response from the author of SpellingCow.

   Doug

   Comment by Doug Clinton, Wednesday, September 6, 2006 @ 5:56 am

Leave a comment