6 ms·

I'm building an app whose GUI runs in the browser talking to a local http server. The app (if and when it is ready) would be distributed as a standalone execut

I'm building an app whose GUI runs in the browser talking to a local http server. The app (if and when it is ready) would be distributed as a standalone executable. A bit like Atom/Electron I guess. What I haven't figured out yet is how the browser-GUI could talk to its local backend-server over https. Can an exe contain its own root-certificate-authority somehow in a way that the app-exe can work without having to update that certificate part ever?

alexvitkov 3y ago
Why? What's the potential attack you're preventing by encrypting communication of two local processes? You'd have to install a shady custom CA system-wide on your users, for a green lock that's 100% placebo. Just run firefox/chrome in app mode and hide the URL bar.
- galaxyLogic 3y ago
  That's a good point. Maybe it is not needed. I'm thinking maybe in the future there could be a use-case to allow also others to connect to the app running on my PC. Basically it is a content-creation app. You use it to develop content you want to later publish and which you can develop and QA on your PC. But when used in an team-setting there might be a use-case for the QA-group to easily see the latest version of the content, even though they would not be allowed to edit it. I'm also thinking maybe some organizations might have a rule that only https: can be used.
withinboredom 3y ago
Dear god why? People using ports (even on ::1) is super annoying when it collides with development. Hunting down the offender is not always straightforward and introduces a new failure mode for you (when I’m already using that port for something else). Also, it opens the door for literally any other software (or xss attacks) to connect and issue api calls you may not expect. Just create a native app. Use something like C# MAUI or whatever language you’re familiar with. Your users will thank you for a smooth experience.
- jimmyspice 3y ago
  what's wrong with using a dynamically allocated port?
  - withinboredom 3y ago
    How do you have a dynamic port assignment and know how to connect to it without publishing it somewhere? As far as I know, that is impossible.
    - galaxyLogic 3y ago
      The app will open the browser on the URL it responds to, including the port it found to be available.
- galaxyLogic 3y ago
  There's a set of ports allocated for http by the standards. The app will choose to use the first one available, starting with 80. If all such ports are in use then tell the user sorry all ports are already in use. Please stop some apps already running on your PC which may be using these ports.
  - withinboredom 3y ago
    So you have to run your app as root on Linux and windows firewall is going to have a field day? I don’t know what happens on a Mac, but I assume it will also require root to use low ports. Why not use port numbers dedicated to this kind of thing (1024 – 65535) or better yet, just use pipes and avoid opening a network server at all.

alexvitkov 3y ago

Why? What's the potential attack you're preventing by encrypting communication of two local processes? You'd have to install a shady custom CA system-wide on your users, for a green lock that's 100% placebo. Just run firefox/chrome in app mode and hide the URL bar.

galaxyLogic 3y ago
That's a good point. Maybe it is not needed. I'm thinking maybe in the future there could be a use-case to allow also others to connect to the app running on my PC. Basically it is a content-creation app. You use it to develop content you want to later publish and which you can develop and QA on your PC. But when used in an team-setting there might be a use-case for the QA-group to easily see the latest version of the content, even though they would not be allowed to edit it. I'm also thinking maybe some organizations might have a rule that only https: can be used.

withinboredom 3y ago

Dear god why? People using ports (even on ::1) is super annoying when it collides with development. Hunting down the offender is not always straightforward and introduces a new failure mode for you (when I’m already using that port for something else). Also, it opens the door for literally any other software (or xss attacks) to connect and issue api calls you may not expect. Just create a native app. Use something like C# MAUI or whatever language you’re familiar with. Your users will thank you for a smooth experience.

jimmyspice 3y ago
what's wrong with using a dynamically allocated port?
- withinboredom 3y ago
  How do you have a dynamic port assignment and know how to connect to it without publishing it somewhere? As far as I know, that is impossible.
  - galaxyLogic 3y ago
    The app will open the browser on the URL it responds to, including the port it found to be available.
galaxyLogic 3y ago
There's a set of ports allocated for http by the standards. The app will choose to use the first one available, starting with 80. If all such ports are in use then tell the user sorry all ports are already in use. Please stop some apps already running on your PC which may be using these ports.
- withinboredom 3y ago
  So you have to run your app as root on Linux and windows firewall is going to have a field day? I don’t know what happens on a Mac, but I assume it will also require root to use low ports. Why not use port numbers dedicated to this kind of thing (1024 – 65535) or better yet, just use pipes and avoid opening a network server at all.