jsnar

7 ms·

1.
by jsnar 8y ago
Electron is unsafe because it's based on outdated versions of Chromium: https://github.com/signalapp/Signal-Desktop/issues/1635
2.
by jsnar 8y ago
Signal desktop app is based on the insecure Electron runtime. See my report here: https://github.com/signalapp/Signal-Desktop/issues/1635
3.
by jsnar 9y ago
See here for the security issues published in Chrome stable releases in those versions: https://chromereleases.googleblog.com/2017/07/stable-channel... https://chromereleases.googleblog.com/2017&#x
4.
by jsnar 9y ago
Electron makes things worse: it is not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61 and
5.
by jsnar 9y ago
This doesn't make it safe -- consider a lower level library inside Chromium can be exploited when processing input data. Your chat app can be exploited by receiving a crafted image. This actually happened in image processing library an
6.
by jsnar 9y ago
submitted issue for this: https://github.com/WhisperSystems/Signal-Desktop/issues/1635
7.
by jsnar 9y ago
It's not as simple as you thought. Consider a bug in the image decoding library Chromium used that can be exploited by simply sending a crafted image in the chat.
8.
by jsnar 9y ago
See here for the security issues published in Chrome stable releases in those versions: https://chromereleases.googleblog.com/2017/07/stable-channel... https://chromereleases.googleblog.com/2017&#x
9.
by jsnar 9y ago
Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the security vulnerabilities published in Chromium 60, 61
10.
by jsnar 9y ago
Electron could still be faulty: its multi process architecture makes application developer easier to write memory leaking code.
11.
by jsnar 10y ago
NW.js can run any Chrome Apps directly: http://nwjs.io