9 ms·

> If you're going to use Electron, you HAVE to make sure it is updated with each update of Chromium. I never really thought about this, but in retrospect, this

> If you're going to use Electron, you HAVE to make sure it is updated with each update of Chromium. I never really thought about this, but in retrospect, this is so blindingly obvious, and is almost certainly a potential exploit vector to a wide range of electron-based apps.

lima 7y ago
It sure is. This is why Chrome apps and progressive web apps are great - they share the Chrome runtime and inherit its hardening, security properties and updates. Many Electron apps should just be a PWA instead, and many actually are. Why would I want to install a desktop app for WhatsApp? It runs just fine in Chrome, and using More Tools -> Create shortcut..., you can even create a launcher entry that will launch the page in its own window.
- randall 7y ago
  This needs to be distributable by the website... also with caching guarantees, desktop capture support (which I think is there now, but wasn't till just recently) etc.
- vbezhenar 7y ago
  How do I build installer for Chrome PWA? Like if user does not have Chrome, it should install it. Also i don't want to bother user with that implicitly installed chrome, so it should not add shortcuts, etc and just live as an app launcher.
  - shawnz 7y ago
    Don't bundle Chrome, just let the user use whatever browser they prefer. AFAIK Edge also supports PWAs, but not Firefox Desktop yet.
  - onei 7y ago
    Turns out a PWA works in Firefox too [1] so I'm not sure it's entirely necessary to force a user to install a browser just for your app. Edge is/will be chromium, so I guess Safari is the only major browser to worry about? [1] https://blog.mozilla.org/firefox/progressive-web-apps-whats-big-deal/ https://blog.mozilla.org/firefox/progressive-web-apps-whats-...
  - m-p-3 7y ago
    IMO you shouldn't have to make an installer, it should be the browser's job to expose the feature and integrate itself to the OS as natively as possible.
- bitL 7y ago
  Because of inability of PWA to write local files at desired locations (you can at best download a file), PWA's usefulness is limited as a desktop app replacement technology. The moment you allow rw local file access you are off to a security-fun-land.
  - lima 7y ago
    Right, but this is a small minority of applications.
    - tonyarkles 7y ago
      I strongly strongly disagree! The vast majority of the work I do can be done off-line with files stored on disk, minus stuff that obviously needs connectivity (e.g. Slack). Writing text, writing code, reading/editing documents and spreadsheets, doing CAD (mechanical and electronics), etc. During the week I live in the city, but on weekends and occasionally for longer stretches of time I like to head out to our rural house for peace and quiet (and focused work). Over time, the number of applications that ought to work off-line has been slowly shrinking, whether it's because they insist on using cloud storage instead of local storage, or licensing checks, or whatever. It's really really disappointing, and I would personally be delighted if I could get work done without an Internet connection.
      - shawnz 7y ago
        You can design a PWA that works offline with local files on disk already, by using the browser's file select dialogs. It's not necessary to give the app arbitrary access to the whole filesystem to get that functionality, which is what the parent is asking for.
        tonyarkles 7y ago
        I'm genuinely not all that familiar with what PWAs can and can't do... Would a, for example, Word-like PWA be able to both load and save files to disk?
- Mirioron 7y ago
  Because my Chrome already takes 6GB of memory and thus needs to be restarted once in a while. If those forces me to close apps I want to continue using then that will annoy me.
tptacek 7y ago
The big problem with Electron isn't that it forces you to keep up with Chrome, although that's important too, but rather that it links Node.js with content-controlled Javascript, so that DOM corruption vulnerabilities can be leveraged for RCE, even in the absence of a Chrome vulnerability. Most Electron RCEs that you've read about had nothing to do with Chromium. There's a whole process for evaluating and auditing Electron applications, which is harder to do than auditing (for instance) a native mobile application or, probably, even a native desktop application.
- Invictus0 7y ago
  Can you imagine reading this comment 100 years ago?
  - ASalazarMX 7y ago
    They would be amazed, as this sounds like incredibly advanced technology, and maybe disappointed when they find it was all about imaginary objects in an interactive projector. John Titor would be proud.
    - mc3 7y ago
      His predictions are correct, or at least they were until he made them.
  - mc3 7y ago
    How about reading it the day Node.js was first released.
- stingraycharles 7y ago
  Why would they need a node process? Are there things an Electron app needs to do that isn’t possible from the Chrome runtime? And more importantly, why would they need to directly link with the DOM? Sorry I am not very familiar with Electron.
  - tptacek 7y ago
bhaavan 7y ago
I think it is a good idea to containerize all electron apps, and run them only in containers. It is because reducing the surface area of your code to the system will reduce vulnerabilities of your code.
emilfihlman 7y ago
With rich preview, you have three choices: Preview is generated on sender side, preview is generated on client side or preview is generated on some server. On a "secure" system as Whatsapp is advertised as, you'll notice only the second choice is "secure" and possible, since otherwise you'll disclose both your IP and lots of other things, like location (from IP).
apecat 7y ago
Wonder if this exploit worked with the Mac App Store version of WhatsApp and the extra sandboxing layer(?) that whole ecosystem provides. Out of sheer hope and ignorant superstition about the wonders of sandboxing, I tend to install the App Store versions of crap like WhatsApp and Slack whenever possible.
- kitsunesoba 7y ago
  It would likely work for whatever directories you had granted it access to — otherwise, the situation is similar to that of iOS where the most an app has access to is its own container. Good reason to not give apps full disk access unless they really, really need it even if it’s more convenient to do so.
davej 7y ago
It's easy to under appreciate the amount of infrastructure work involved in deploying a production electron app to customers. Auto-updates, code signing, installers etc... I'm working on a startup to help solve some of this: https://www.todesktop.com https://www.todesktop.com Feedback appreciated :)
Sephr 7y ago
This is what Carlo[1] was made to solve. 1. https://github.com/GoogleChromeLabs/carlo https://github.com/GoogleChromeLabs/carlo

lima 7y ago

It sure is. This is why Chrome apps and progressive web apps are great - they share the Chrome runtime and inherit its hardening, security properties and updates. Many Electron apps should just be a PWA instead, and many actually are. Why would I want to install a desktop app for WhatsApp? It runs just fine in Chrome, and using More Tools -> Create shortcut..., you can even create a launcher entry that will launch the page in its own window.

randall 7y ago
This needs to be distributable by the website... also with caching guarantees, desktop capture support (which I think is there now, but wasn't till just recently) etc.
vbezhenar 7y ago
How do I build installer for Chrome PWA? Like if user does not have Chrome, it should install it. Also i don't want to bother user with that implicitly installed chrome, so it should not add shortcuts, etc and just live as an app launcher.
- shawnz 7y ago
  Don't bundle Chrome, just let the user use whatever browser they prefer. AFAIK Edge also supports PWAs, but not Firefox Desktop yet.
- onei 7y ago
  Turns out a PWA works in Firefox too [1] so I'm not sure it's entirely necessary to force a user to install a browser just for your app. Edge is/will be chromium, so I guess Safari is the only major browser to worry about? [1] https://blog.mozilla.org/firefox/progressive-web-apps-whats-big-deal/ https://blog.mozilla.org/firefox/progressive-web-apps-whats-...
- m-p-3 7y ago
  IMO you shouldn't have to make an installer, it should be the browser's job to expose the feature and integrate itself to the OS as natively as possible.
bitL 7y ago
Because of inability of PWA to write local files at desired locations (you can at best download a file), PWA's usefulness is limited as a desktop app replacement technology. The moment you allow rw local file access you are off to a security-fun-land.
- lima 7y ago
  Right, but this is a small minority of applications.
  - tonyarkles 7y ago
    I strongly strongly disagree! The vast majority of the work I do can be done off-line with files stored on disk, minus stuff that obviously needs connectivity (e.g. Slack). Writing text, writing code, reading/editing documents and spreadsheets, doing CAD (mechanical and electronics), etc. During the week I live in the city, but on weekends and occasionally for longer stretches of time I like to head out to our rural house for peace and quiet (and focused work). Over time, the number of applications that ought to work off-line has been slowly shrinking, whether it's because they insist on using cloud storage instead of local storage, or licensing checks, or whatever. It's really really disappointing, and I would personally be delighted if I could get work done without an Internet connection.
    - shawnz 7y ago
      You can design a PWA that works offline with local files on disk already, by using the browser's file select dialogs. It's not necessary to give the app arbitrary access to the whole filesystem to get that functionality, which is what the parent is asking for.
      - tonyarkles 7y ago
        I'm genuinely not all that familiar with what PWAs can and can't do... Would a, for example, Word-like PWA be able to both load and save files to disk?
Mirioron 7y ago
Because my Chrome already takes 6GB of memory and thus needs to be restarted once in a while. If those forces me to close apps I want to continue using then that will annoy me.

tptacek 7y ago

The big problem with Electron isn't that it forces you to keep up with Chrome, although that's important too, but rather that it links Node.js with content-controlled Javascript, so that DOM corruption vulnerabilities can be leveraged for RCE, even in the absence of a Chrome vulnerability. Most Electron RCEs that you've read about had nothing to do with Chromium. There's a whole process for evaluating and auditing Electron applications, which is harder to do than auditing (for instance) a native mobile application or, probably, even a native desktop application.

Invictus0 7y ago
Can you imagine reading this comment 100 years ago?
- ASalazarMX 7y ago
  They would be amazed, as this sounds like incredibly advanced technology, and maybe disappointed when they find it was all about imaginary objects in an interactive projector. John Titor would be proud.
  - mc3 7y ago
    His predictions are correct, or at least they were until he made them.
- mc3 7y ago
  How about reading it the day Node.js was first released.
stingraycharles 7y ago
Why would they need a node process? Are there things an Electron app needs to do that isn’t possible from the Chrome runtime? And more importantly, why would they need to directly link with the DOM? Sorry I am not very familiar with Electron.
- tptacek 7y ago

bhaavan 7y ago

I think it is a good idea to containerize all electron apps, and run them only in containers. It is because reducing the surface area of your code to the system will reduce vulnerabilities of your code.

emilfihlman 7y ago

With rich preview, you have three choices: Preview is generated on sender side, preview is generated on client side or preview is generated on some server. On a "secure" system as Whatsapp is advertised as, you'll notice only the second choice is "secure" and possible, since otherwise you'll disclose both your IP and lots of other things, like location (from IP).

apecat 7y ago

Wonder if this exploit worked with the Mac App Store version of WhatsApp and the extra sandboxing layer(?) that whole ecosystem provides. Out of sheer hope and ignorant superstition about the wonders of sandboxing, I tend to install the App Store versions of crap like WhatsApp and Slack whenever possible.

kitsunesoba 7y ago
It would likely work for whatever directories you had granted it access to — otherwise, the situation is similar to that of iOS where the most an app has access to is its own container. Good reason to not give apps full disk access unless they really, really need it even if it’s more convenient to do so.

davej 7y ago

It's easy to under appreciate the amount of infrastructure work involved in deploying a production electron app to customers. Auto-updates, code signing, installers etc... I'm working on a startup to help solve some of this: https://www.todesktop.com https://www.todesktop.com Feedback appreciated :)

Sephr 7y ago

This is what Carlo[1] was made to solve. 1. https://github.com/GoogleChromeLabs/carlo https://github.com/GoogleChromeLabs/carlo