3 ms·

> With all that work why not just link to gtk and build on that? If you're asking "why not link to gtk webkit?": because I don't want to statically compile or

> With all that work why not just link to gtk and build on that? If you're asking "why not link to gtk webkit?": because I don't want to statically compile or ship with the entire browser (not to mention Windows compat). If you're asking "why not build your app on gtk instead of web tech?": there are a million reasons and this question happens frequently, so not really sure it's worth rehashing here. > Why should a desktop app even care about host headers? It's one way to prevent DNS rebinding attacks. You can employ other methods to ensure the client is "authenticated" to use the server. OP's app listens on port 5000. I can have a page on example.com:5000 and set the DNS zone to a really low TTL change its A record to think it's 127.0.0.1 after first load thereby letting the browser think I'm same origin w/ just an IP change, then I can ajax call to example.com:5000 to access the local daemon. That's how DNS rebinding attacks work and host header checking is one way to for the local web server to prevent other pages from accessing it. Project Zero is finding lots of local HTTP servers that are reachable from web pages.

tomc1985 9y ago
well I wouldn't recommend webkit-gtk either, but there's a whole lot of other controls and stuff in gtk that were designed for desktop apps. Just seems silly to have to go through all those lengths just to preserve a JS/HTML/CSS workflow when you can get the same thing, with less work (edit: and fewer potential vulns) with gtk and rcstyles.
- chc 9y ago
  Besides stack familiarity, a big problem people have with GTK is that it feels even less native than Electron.
  - tomc1985 9y ago
    ........ huh? GTK uses native controls on Windows and Linux (and I think Mac?) The fact that you have to care about DNS rebinding attacks on a desktop app, where presumably that app does not do anything special with the network or DNS, is all kinds of smelly to me. I wish I could show off some of my work in this area but we took an old JS/HTML/CSS 1.0 stack and did our 2.0 in GTK (with all the fancy graphics and everything), and we are much happier now -- a ten-year-old single-core Celeron system with little RAM runs our stuff great (whereas before we had issues)
tomc1985 9y ago
> there are a million reasons and this question happens frequently, so not really sure it's worth rehashing here. then > Project Zero is finding lots of local HTTP servers that are reachable from web pages. Amazing. All signs point to not building apps manifesting as local web servers and people continue to do so anyway. A millions reasons, huh? A million reasons against, more like it.

tomc1985 9y ago

well I wouldn't recommend webkit-gtk either, but there's a whole lot of other controls and stuff in gtk that were designed for desktop apps. Just seems silly to have to go through all those lengths just to preserve a JS/HTML/CSS workflow when you can get the same thing, with less work (edit: and fewer potential vulns) with gtk and rcstyles.

chc 9y ago
Besides stack familiarity, a big problem people have with GTK is that it feels even less native than Electron.
- tomc1985 9y ago
  ........ huh? GTK uses native controls on Windows and Linux (and I think Mac?) The fact that you have to care about DNS rebinding attacks on a desktop app, where presumably that app does not do anything special with the network or DNS, is all kinds of smelly to me. I wish I could show off some of my work in this area but we took an old JS/HTML/CSS 1.0 stack and did our 2.0 in GTK (with all the fancy graphics and everything), and we are much happier now -- a ten-year-old single-core Celeron system with little RAM runs our stuff great (whereas before we had issues)

tomc1985 9y ago

> there are a million reasons and this question happens frequently, so not really sure it's worth rehashing here. then > Project Zero is finding lots of local HTTP servers that are reachable from web pages. Amazing. All signs point to not building apps manifesting as local web servers and people continue to do so anyway. A millions reasons, huh? A million reasons against, more like it.