2 ms·

Electron is amazing for dev velocity. I love it there. However, most importantly for my day job, it's not good for security. Adopting Electron requires me to a

Electron is amazing for dev velocity. I love it there. However, most importantly for my day job, it's not good for security. Adopting Electron requires me to accept the same structural weaknesses that led to all of the NPM malicious commit issues that have cropped up lately, and with Electron it runs as me, the user, not inside a browser sandbox. As a dev in a security team, not inadvertently creating attack vectors is literally part of my job, so that combination of factors is scary. In hindsight... I'm putting Discord in a sandbox. Other native languages/SDKs/frameworks don't have this issue if only because so much of them come from first party entities and it's very viable to cut implicit trust to the repositories. That makes Electron not a viable option for anything related to my day job unless it's guaranteed to be running in a VM, closed off from everything else. When some of the Node.js permissions related stuff gets put in, I'm going to like Electron much, much more than I do now.

fabiospampinato 8y ago
> and with Electron it runs as me, the user, not inside a browser sandbox You could actually not use any external modules in your main process and have the renderer process sandboxed [1], node integration [2] can be disabled too. [1] https://electronjs.org/docs/api/sandbox-option https://electronjs.org/docs/api/sandbox-option [2] https://electronjs.org/docs/faq#i-can-not-use-jqueryrequirejsmeteorangularjs-in-electron https://electronjs.org/docs/faq#i-can-not-use-jqueryrequirej...
- munchbunny 8y ago
  Thanks for bringing this up, I wasn't aware of the option. This changes how I look at the trade-offs of using Electron. Unfortunately, that only covers the rendering code, and it still backtracks a lot of the reason putting JS into a native environment is convenient in the first place. But it's a lot better than the "nothing at all" I thought it was before.

fabiospampinato 8y ago

> and with Electron it runs as me, the user, not inside a browser sandbox You could actually not use any external modules in your main process and have the renderer process sandboxed [1], node integration [2] can be disabled too. [1] https://electronjs.org/docs/api/sandbox-option https://electronjs.org/docs/api/sandbox-option [2] https://electronjs.org/docs/faq#i-can-not-use-jqueryrequirejsmeteorangularjs-in-electron https://electronjs.org/docs/faq#i-can-not-use-jqueryrequirej...

munchbunny 8y ago
Thanks for bringing this up, I wasn't aware of the option. This changes how I look at the trade-offs of using Electron. Unfortunately, that only covers the rendering code, and it still backtracks a lot of the reason putting JS into a native environment is convenient in the first place. But it's a lot better than the "nothing at all" I thought it was before.