Our international teams kept enabling sourcemaps and I just had devops lock the directory to vpn access only π€·
I know sourcemaps aren't the end of the world as it's all client side code that lives on the clients computer but it just feels dirty
this post was submitted on 04 Nov 2025
395 points (99.0% liked)
Programmer Humor
27193 readers
1017 users here now
Welcome to Programmer Humor!
This is a place where you can post jokes, memes, humor, etc. related to programming!
For sharing awful code theres also Programming Horror.
Rules
- Keep content in english
- No advertisements
- Posts must be related to programming or programmer topics
founded 2 years ago
MODERATORS
Security through obscurity is not security. I see no reason why source maps should be unavailable.
Because source maps show how shitty your organization's code and overall engineering practices are.
Ding ding ding
Open source code is usually quite nice and well done because money pressure is way less of an issue and everyone knows people will be looking at your code
And now the source code is part of copilot
SVELTE π₯Ή (im very happy to see svelte)
Also I'm scared that this person may be risking their github account by posting this, I dunno if it's legal to "distribute" apples website code yourself. If not, best hope they dont ban your whole account.
Or even sue them
we love svelte
Youβre supposed to disable source maps in prod?
Asking for a friend
if you think your source code is that precious and unique and special, go ahead and worry about it haha
Just to save on wasted bandwidth for the client (and your server) is why I would disable them.
they're different files generally, the only client that will automatically request them is a debugger.
you turn them off because you don't want to expose your full source code. if you would be ok making your webpage git repo public then making sourcemaps available is fine.
Copyrighted content
archived them
on GitHub
Idk man π§
Run the countdown to when it's taken down
There's lots of content sitting just below the surface on github. Any time you make a PR on a repo, even if it gets closed or "deleted" by the repo owner, the actual link to the file itself stays there forever if you save it. Github's own dmca repo even has warez links on it, sitting there for years.
Oh that's cool, I had no idea! Though does that apply to content removed for DMCAs?
You could argue that since it's publicly available and this repo only archives it that... I don't know man Copyright law is confusing.
I think you can get some kind of exemption for archival purposes. I know that the Internet Archive has one. But I also know that ultimately Microsoft is responsible for the data hosted on Github, and Microsoft's interest is to not even risk getting sued.
Depending on the exact level of stupidity clinging to the judge on that day, some jurisdictions might consider this βhacking.β
One case from the states that was luckily dismissed: https://uk.pcmag.com/security/136282/missouri-gov-goes-after-reporter-who-found-shockingly-bad-flaw-in-state-website https://www.vice.com/en/article/this-is-the-hacking-investigation-into-journalist-who-clicked-view-source-on-government-website/
Isnβt that just effectively un-minified? Itβs just the client side code in the first place?
Comments and full-length names make the source way more accessible.
Nah itβs more complete with comments and all. Hereβs a link to a random svelte file:
https://github.com/rxliuli/apps.apple.com/blob/main/src/components/pages/SearchResultsPage.svelte
Is this interesting for some reason?
Itβs how the web worked before minifiers, so kinda but not really.
You just have comments and original variable/function names.
Iβm sure someone will argue this helps scrapers or hackers, but really itβs not that big of a deal.
It help users that make websites styles!
Eg. I have a discord style for fixing their bullshit
iirc Apple music's web ui also has sourcemaps, but I'm not subbed to apple music anymore to check. Its neat, but not really a huge blunder, nor takedown worthy.
Yo gimme a repo link, you canβt blueball us like that
Iβm gonna download this to my iPhone, just in case.
Try and stop me, Tim Apple!