The graphql schema / string language is not required. For example, Juniper defines the graphql schema and queries using rust structs and impls: https://graphql-rust.github.io/juniper/types/objects/index.h... and the actual on-the-wire encoding and decoding format can be anything.
As the person who made this call originally at Facebook for the apps--it's not worth it. Any sufficiently advanced or motivated person/group/government would break through eventually...such is the nature of shipping client binaries. You can spend a ton of time and money trying to prevent it (for example Pinterest once was trying to ship their own custom language + vm, which I advised against) OR...just accept that your client code is compromised by default, put logic on the server, and move on with your life.
Cert pinning is basically free and is sort of a "you must be this tall to ride the ride" thing--not secure, but keeps the riff raff out.
I was running software updates at Apple and I remember the concern and effort when the "full" update first went over a gig. We were able to get it back under a gig for a release or two but it was hopeless without major new engineering work which would take time. Leadership kept yelling that there must be a way, and they didn't abate until we pointed out that Windows full updates had been over a gig for months.
Of course, Apple used binary patching and compression and all that jazz... this was for the "full" version that delivered entire files.
reply