Protecting HTML5 game JavaScript without hurting frame rate

·1 views

Developers shipping web games with engines like Phaser or Cocos can expect players to read their scripts in browser DevTools, exposing economy formulas and unlock logic. The article argues that any client-side code can eventually be reverse-engineered, so server-side validation is still needed where competitive integrity matters. It contrasts standard obfuscation, which leaves output as ordinary JavaScript, with JSVMP, which compiles selected code into custom bytecode run by an interpreter, making recovery harder. Because VM-protected code runs slower, the author recommends protecting only small, high-value modules such as drop tables and entitlement checks, while leaving per-frame loops and engine code alone. The piece also outlines a selective build pipeline and suggests measuring FPS and load times on mid-tier devices before release.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Working checkout doesn't prove a product is priced right, critic argues

A GitHub discussion exposed a gap in a five-question diagnostic tool for product failures, which classifies problems as traffic, activation, billing, or positioning. Reviewer chenhz01 argued that symptom-based classifiers can confuse adjacent failure modes, though the maintainer countered that the tool's direct yes/no gates prevent billing failures from being mistaken for activation failures. The reviewer's real point, the maintainer conceded, is that a product can pass the billing gate yet still be mispriced for its buyer, so the fix is a price change rather than new copy. The article notes that owners often reach for cheap messaging fixes instead of repricing, and that testing only with one's own purchases verifies the payment system but not willingness to pay. As a result, the diagnostic now explicitly flags mispricing rather than assigning it to positioning.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

WooCommerce Cart Cookies Can Silently Disable Page Caching for Shoppers

An experienced WooCommerce auditor reports that sites often benchmark quickly yet feel slow to real shoppers. The cause is cart session handling, which sets cookies once an item is added and leads caching layers to skip the cache for those visitors. Because the cart icon appears in the header, this bypass can extend to nearly every page the shopper views. Cart fragment AJAX requests add further uncached load, even for empty carts. Standard performance tools test anonymous visitors with empty carts, so they miss this slowdown entirely.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Pre-Trade Risk Gate in Python: Hysteresis, EWMA Spikes and Taker-Sweep Detection

The author presents a pre-trade risk gate that checks market microstructure before each order and returns an allow or block decision with reasons. The gate closes on four triggers: recent large taker sweeps, a VPIN reading in its top decile, an unusually lopsided order book relative to the pair's own history, and a sudden shift in the book's imbalance against its moving average. It uses hysteresis, reopening only after a cooldown and a lower VPIN re-arm level, and fails closed whenever a fresh snapshot cannot be obtained. Measurements show that reusing an HTTPS session cut median check latency from about 160 ms to 59 ms, and a one-second cache avoids redundant requests. The article also notes that REST-based gating cannot react fast enough to beat the first fill after a sweep, which would require a streaming feed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Styx lets coding agents reach SSH servers without ever receiving your private key

Styx is a free, open-source desktop app that runs coding agents and requires them to ask permission before accessing production systems. Its SSH targets store host, user, port, optional jump host and environment, and agents run standard ssh, scp, sftp or rsync commands with those settings applied. Key files and passwords are kept in the OS keychain, and agents receive only a forwarded SSH agent socket or a signed-in connection rather than the secret itself. Every grant is scoped, time-limited and recorded in an append-only audit log, with extra prompts for production targets. The author notes that Styx is a guardrail rather than a sandbox, since an agent calling the ssh binary by its full path can bypass the check.

0 comments Read more at DEV Community