4 ms·
> Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Even if you disable the usual way to pop the dev tools op
by akersten 6y ago
> Why does discord even let users access dev tools? This is trivially easy to disable in prod builds.
Even if you disable the usual way to pop the dev tools open in desktop electron mode, this is a dangerous attitude. A malicious client can always edit the DOM, send arbitrary data to your server, read whatever you send back, etc. "Disabling the dev tools" is never the correct solution to any security problem.
- lukevp 6y agoI didn’t say that they should do this for security of the execution environment of the code, I’m not sure how you got to that interpretation. The GP said that there is output to tell users not to compromise themselves by blindly pasting unsafe code, which is easily prevented by disabling dev tools altogether, and there is no reason for an end user to have access to dev tools in an electron app. The other replies are probably what the GP meant and were related to the web version of discord.
- j-james 6y ago> there is output to tell users not to compromise themselves by blindly pasting unsafe code For reference: https://user-images.githubusercontent.com/47160230/51995729-275e2680-24ab-11e9-8b1b-470c62883ec0.png https://user-images.githubusercontent.com/47160230/51995729-... This is also present in the Electron version of Discord. > there is no reason for an end user to have access to dev tools in an electron app. Certainly there is - there are various user-made applications that take advantage of Discord being built on Electron to allow you to write your own custom styles and scripts.