5 ms·
I hate Electron apps, too, but I've not heard people complain about security before. What's the security problem with Electron apps? I understand that you're b
by ragnese 3y ago
I hate Electron apps, too, but I've not heard people complain about security before. What's the security problem with Electron apps?
I understand that you're basically running a Node.js instance for each app, but why is that more insecure than running, say, a GTK app? Since GTK and Node.js are written in C and C++, respectively, my gut instinct would be to assume they're equally likely to have security bugs.
- wiseowise 3y agoQuick search https://www.cvedetails.com/vulnerability-list.php?vendor_id=17824&product_id=44696&version_id=0&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=1&trc=15&sha=d8dc7cad32c3a3f97ca3be583aef8b6ab5a03858 https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
- cjbprime 3y agoThe difference is that no-one would load remote-user-supplied C++ code at runtime and expect it not to result in vulnerability, but people remotely source JS, or allow remote-user-supplied HTML to interact with their JS, and the stakes are higher than they would be in a web browser, because Node (and therefore Electron) has APIs to e.g. read and write to your filesystem and browsers have sandboxes to block that. (Electron offers sandboxing too, but you're likely to actually want to use the OS features so it's not as simple as always disallowing the access.)