3 ms·
If only it was $2 of RAM... > in exchange for security Electron is not famous for its security. See for example https://www.trustwave.com/en-us/resources/blog
by dependenttypes 7y ago
If only it was $2 of RAM...
> in exchange for security
Electron is not famous for its security. See for example https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2018-1000136-electron-nodeintegration-bypass/ https://www.trustwave.com/en-us/resources/blogs/spiderlabs-b... and https://securityboulevard.com/2018/06/june-vulnerability-of-the-month-electron-vulnerability-out-hyped-by-efail/ https://securityboulevard.com/2018/06/june-vulnerability-of-...
- AgentME 7y agoThose issues are only relevant to applications that display arbitrary HTML and already have XSS issues. Avoiding XSS is doable; with most web frameworks you're protected from XSS by default and have to specifically turn off the safeties to get XSS.
- dependenttypes 7y ago> Those issues are only relevant to applications that display arbitrary HTML and already have XSS issues Such as signal! https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injection/advisory/ https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injec...