How WinRT Metro style HTML5/JavaScript applications are packaged and protected

Question

I’m just wondering how the HTML5/JavaScript Metro applications will be packaged and protected against reversal.

For packaging I’ll expect some sort of signed zip/jar (no mention about .appx on MSDN) but for protection, outside of heavy obfuscation for JavaScript I can’t envision any other way (maybe a new precompiled/binary format ?)

If the protection is not good, writing HTML5/JavaScript apps will not flourish too much IMHO.

Answer 1

Instead of just crypto-obfuscation, another option is to implement the proprietary algorithms/logic inside of a 3rd party WinRT component. This way, you can have assurance that your proprietary algorithm is protected by virtue of being compiled. Granted if you choose to implement in .NET there is some ability by someone to reverse engineer it.

The idea is to write your client in JS/HTML5, presumably this would be somewhat straightforward in which you don't have a huge amount of proprietary info. Then you go write your WinRT component in C#/C++ which contains your proprietary "Sausage Manufacturing Process." You call into this WinRT component to create some "Sausage" with some data input. This approach means your secret recipe for Sausage is safe while still affording you the simplicity of the platform.

Is that a palatable solution?