There's another way that's somebody's come up with doing this.
Have you seen Jscrambler?
No.
Okay, so Jscrambler, I met the guy who wrote Jscrambler a few weeks ago.
And it does this really clever thing.
I don't understand it, but it dates your JavaScript, and it munges it up.
When you get the webpage delivered to you,
if you looked at view source or you looked at dev tools,
you just see gobbledygook.
It looks like complete nonsense.
That's obfuscation.
That's the word, yeah, it's obfuscation.
But I think it's more than that, because if you do an injection in it,
the page stops working.
So he's doing some really clever stuff.
So maybe it's like obfuscation with Mac.
Yeah.
HMAC.
Yeah, with HMAC, but also with break-pointing in there.
So I think they rewrite the JavaScript or something,
and they put break points in and then they check things.
Okay.
And that looks like a really interesting way of protecting against it.
But I think its maintenance is hard.
Yeah, so I mean, obviously I don't know the details,
this is literally the first I've heard of it,
but what we're saying there is that your web server,
your web server may get owned, or your CMS may get owned,
or something like that, but if there are modifications to the page,
this is a way of identifying that the page has
deviated from the known good state.
If it's been tampered with, this is going to fire.
I do wonder about the maintenance side of that as well.
I mean,
I know that people sort of raise all sorts of concerns as
soon as they've got to not just change code,
but then do something else to --- Yeah, absolutely.
-- sort of reflect the change.
Yeah, because it means it's another step in that code release process.
But in fairness,
and I know we kind of keep going back to this in a
very kind of natural organic way,
we're sort of saying if you want to stop having your payment card forms owned,
you might need to do a bit more work.
Yeah.
Which actually seems kind of reasonable, right?
It seems really reasonable, and that's because the criminals are doing more work.
You see, every time we do something new in stopping the,
the criminals do something, we work out what they've done,
we find a way of defending it, the criminal doesn't think,
ah, wow, that's really terrible.
I know!
I'm going to write Pluralsight courses for a living
now and not be a criminal anymore!
Yeah, right.
Right?
They'll say, okay,
I'm going to adapt my technique and find a different
way of stealing the cardholder data.
So we have to keep changing what we do,
because the criminal changes what they do.
Yep, fair enough.
And that's why the identify stage of the NIST framework,
of being aware of what's out there, is really important.
Because as the criminals change, you need to change what you do.
Sure.
You can't just rest on your laurels.
I think, I heard you say, you know, this is a great thing,
I think I heard you say it about, you know,
security is not an end state.
Right.
It's an ongoing,
I think maybe that the analogy that I often use here
is sometimes people sort of go, well, every time we get better at something,
the hackers come along and smash it, like,
why are we bothering?
And it's kind of a little bit like, well, why do you keep cutting your nails?
They keep growing back the whole time.
This is just maintenance.
Whether it's a personal nature of your own body,
or whether it's your web server, it's an ongoing effort.