6 ms·
I wish there was a dead-simple, you-cannot-get-it-wrong, step-by-step, nothing-left-out, no-knowledge-assumed, all-in-one-document, not-spread-out-over-various-
by hoodoof 9y ago
I wish there was a dead-simple, you-cannot-get-it-wrong, step-by-step, nothing-left-out, no-knowledge-assumed, all-in-one-document, not-spread-out-over-various-pages, tutorial/checklist on how to ensure your Electron app is as secure as possible.
It shits me that it is a research task with all the attendant uncertainty about whether or not I did in fact make it secure.
I do appreciate that security is complex and even such a document would not guarantee security, or that you had not somehow created your own security hole, but I just want to do the very best possible effort at security and currently that is too hard with Electron.
UPDATE: this post has led me to attempt to redesign my application to not use Electron. I just can't afford some misconfiguration or coding error leading to user machines being cracked.
- zghst 9y agoSecurity is never easy. It is always a battle. Maybe AI is the answer
- beisner 9y agoAI is decidedly not the answer. Formal verification is the answer, and tooling around it.
- tdb7893 9y agoMy impression is that making everything formally verified is a lot of work and it would be very hard to make formally verified code as easy to write as non-verified code.
- sewer_bird 9y agoThe central dilemma is that there are myriad ways to do it wrong for every one way to do it correctly.