4 ms·

Seems to be a proprietary application so app privacy went out the window already.

ynniv 8y ago
Privacy is a spectrum. You can choose to be at one end of it, but not everyone shares your opinion. As a local app your data has a different legal status, and you actually have a lot of control over the execution compared to a web service. For instance, with outgoing firewall rules you could ensure that this is only talking to your email server.
Mononokay 8y ago
You can audit the code of every Electron app, so why are you acting like it's full of spyware that you'll never be able to have privacy with?
- hjek 8y ago
  Ever heard of minimized JavaScript[0]? [0]: https://github.com/google/closure-compiler https://github.com/google/closure-compiler
  - lhorie 8y ago
    Minified js isn't particularly hard to reverse engineer compared to tools that are geared towards actual obfuscation, and regardless, you don't even need to look at the code if all you care about is privacy. A look at the dev console's network tab should tell you all you need to know.
    - lucb1e 8y ago
      I've done obfuscated Javascript on a CTF. Only a few hundred lines and I can tell you, it's way easier to just write it new from scratch, especially if you have a product that you like and can just copy.
      - kuschku 8y ago
        I’ve reversed and broken real-life products written in JS, Java, WebAssembly and native code. Minified JS and obfuscated Java (DexGuard or ProGuard) are almost identical in complexity, you can restore the actual datatypes still, and you can even restore the rough outlines of where control structures were. Obfuscated WebAssembly, NaCl or native code is much worse to work with, and often data structures and control structures are gone entirely.
        fermuch 8y ago
        I'd be very interested about your findings decompiling wasm. Do you have a blog, by chance?
        kuschku 8y ago
        I don’t maintain a blog currently, sorry. And if I had one I doubt I’d be able to write interesting articles about this topic. Generally I share such info on IRC, and then it gets just forgotten over time.
        Jedd 8y ago
        From parent's HN profile: Janne Koschinski, CompSci student. https://github.com/justJanne https://github.com/justJanne Current maintainer of QuasselDroid https://quasseldroid.info/ https://quasseldroid.info/ https://github.com/sandsmark/QuasselDroid https://github.com/sandsmark/QuasselDroid
jstanley 8y ago
It's still better than it would be if it was a normal web app hosted on his server. Or, at least, it has the potential to be better.

Privacy is a spectrum. You can choose to be at one end of it, but not everyone shares your opinion. As a local app your data has a different legal status, and you actually have a lot of control over the execution compared to a web service. For instance, with outgoing firewall rules you could ensure that this is only talking to your email server.

Mononokay 8y ago

You can audit the code of every Electron app, so why are you acting like it's full of spyware that you'll never be able to have privacy with?

hjek 8y ago
Ever heard of minimized JavaScript[0]? [0]: https://github.com/google/closure-compiler https://github.com/google/closure-compiler
- lhorie 8y ago
  Minified js isn't particularly hard to reverse engineer compared to tools that are geared towards actual obfuscation, and regardless, you don't even need to look at the code if all you care about is privacy. A look at the dev console's network tab should tell you all you need to know.
  - lucb1e 8y ago
    I've done obfuscated Javascript on a CTF. Only a few hundred lines and I can tell you, it's way easier to just write it new from scratch, especially if you have a product that you like and can just copy.
    - kuschku 8y ago
      I’ve reversed and broken real-life products written in JS, Java, WebAssembly and native code. Minified JS and obfuscated Java (DexGuard or ProGuard) are almost identical in complexity, you can restore the actual datatypes still, and you can even restore the rough outlines of where control structures were. Obfuscated WebAssembly, NaCl or native code is much worse to work with, and often data structures and control structures are gone entirely.
      - fermuch 8y ago
        I'd be very interested about your findings decompiling wasm. Do you have a blog, by chance?
        kuschku 8y ago
        I don’t maintain a blog currently, sorry. And if I had one I doubt I’d be able to write interesting articles about this topic. Generally I share such info on IRC, and then it gets just forgotten over time.
        Jedd 8y ago
        From parent's HN profile: Janne Koschinski, CompSci student. https://github.com/justJanne https://github.com/justJanne Current maintainer of QuasselDroid https://quasseldroid.info/ https://quasseldroid.info/ https://github.com/sandsmark/QuasselDroid https://github.com/sandsmark/QuasselDroid

jstanley 8y ago

It's still better than it would be if it was a normal web app hosted on his server. Or, at least, it has the potential to be better.