3 ms·

Does this affect electron as well? If so, what versions?

• frankjr 3y ago
  It does, see [0]. Fun fact: Signal desktop, which uses Electron under the hood, is running without sandbox on Linux [1][2]. [0] https://github.com/electron/electron/pull/39824 https://github.com/electron/electron/pull/39824 [1] https://github.com/signalapp/Signal-Desktop/issues/5195 https://github.com/signalapp/Signal-Desktop/issues/5195 [2] https://github.com/signalapp/Signal-Desktop/pull/4381 https://github.com/signalapp/Signal-Desktop/pull/4381
  • Y-bar 3y ago
    I just love the unnecessary jousting with the stupid stale bot in 5195
  • est31 3y ago
    To be fair, if signal didn't use electron, they would probably have used libwebp still, and then they would either have to implement sandboxing themselves, or they would be subject to the same vulnerability. Still, that they didn't prioritize this is sad.
    • Waterluvian 3y ago
      If they didn’t use electron they’d probably not even have a Linux client, so there would be no problem! But the lack of sandboxing when it’s available, for something like Signal, is kind of weird. I wonder what the reasoning was.