4 ms·

Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Seems odd. Is there a valid use case?

by lukevp 6y ago

ddulaney 6y ago
I assume the parent is referring to the web version, where a big warning is output on the console of the browser’s built-in dev tools. I don’t know of any way for a website to disable the browser’s dev tools.
- lukevp 6y ago
  Makes sense, forgot there was a web client. Thanks!
throwaways885 6y ago
Many products show this warning e.g. Google Photos, Facebook.
akersten 6y ago
> Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Even if you disable the usual way to pop the dev tools open in desktop electron mode, this is a dangerous attitude. A malicious client can always edit the DOM, send arbitrary data to your server, read whatever you send back, etc. "Disabling the dev tools" is never the correct solution to any security problem.
- lukevp 6y ago
  I didn’t say that they should do this for security of the execution environment of the code, I’m not sure how you got to that interpretation. The GP said that there is output to tell users not to compromise themselves by blindly pasting unsafe code, which is easily prevented by disabling dev tools altogether, and there is no reason for an end user to have access to dev tools in an electron app. The other replies are probably what the GP meant and were related to the web version of discord.
  - j-james 6y ago
    > there is output to tell users not to compromise themselves by blindly pasting unsafe code For reference: https://user-images.githubusercontent.com/47160230/51995729-275e2680-24ab-11e9-8b1b-470c62883ec0.png https://user-images.githubusercontent.com/47160230/51995729-... This is also present in the Electron version of Discord. > there is no reason for an end user to have access to dev tools in an electron app. Certainly there is - there are various user-made applications that take advantage of Discord being built on Electron to allow you to write your own custom styles and scripts.

Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Seems odd. Is there a valid use case?

by lukevp 6y ago

Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Seems odd. Is there a valid use case?

ddulaney 6y ago

I assume the parent is referring to the web version, where a big warning is output on the console of the browser’s built-in dev tools. I don’t know of any way for a website to disable the browser’s dev tools.

lukevp 6y ago
Makes sense, forgot there was a web client. Thanks!

throwaways885 6y ago

Many products show this warning e.g. Google Photos, Facebook.

akersten 6y ago

> Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Even if you disable the usual way to pop the dev tools open in desktop electron mode, this is a dangerous attitude. A malicious client can always edit the DOM, send arbitrary data to your server, read whatever you send back, etc. "Disabling the dev tools" is never the correct solution to any security problem.

lukevp 6y ago
I didn’t say that they should do this for security of the execution environment of the code, I’m not sure how you got to that interpretation. The GP said that there is output to tell users not to compromise themselves by blindly pasting unsafe code, which is easily prevented by disabling dev tools altogether, and there is no reason for an end user to have access to dev tools in an electron app. The other replies are probably what the GP meant and were related to the web version of discord.
- j-james 6y ago
  > there is output to tell users not to compromise themselves by blindly pasting unsafe code For reference: https://user-images.githubusercontent.com/47160230/51995729-275e2680-24ab-11e9-8b1b-470c62883ec0.png https://user-images.githubusercontent.com/47160230/51995729-... This is also present in the Electron version of Discord. > there is no reason for an end user to have access to dev tools in an electron app. Certainly there is - there are various user-made applications that take advantage of Discord being built on Electron to allow you to write your own custom styles and scripts.