I often see people talking about the fact that they like a certain open-source application, but ‘it’s a shame it’s on Electron’; what does this mean? Is it a privacy thing or a resource thing?
An Electron app has full access to your filesystem and to other system resources, the same as any other desktop app
Is there a specific reason or example for why we say it has terrible security here?
Chromium has an incredibly advanced and optimised graphics pipeline and the code that is running in the “web” part of an Electron app benefits from Chromium’s sandbox
I guess a better parallel is using C/C++ to write software, where it is trivially easy to mismanaged memory in ways that cause 70% of CVEs
If we were being consistent, we’d be trying to eliminate all software written in any language or framework where it is trivially easy to introduce security issues
I wonder how many anti-Electron folks are also logically anti-C/C++ ?
Here are some flaws with Electron:
An Electron app has full access to your filesystem and to other system resources, the same as any other desktop app
Is there a specific reason or example for why we say it has terrible security here?
Chromium has an incredibly advanced and optimised graphics pipeline and the code that is running in the “web” part of an Electron app benefits from Chromium’s sandbox
removed by mod
You mean how like nobody ever ever pipes the output of
curlinto abashwith root privileges? :PMaybe we should ban cURL when we ban Electron?
removed by mod
I guess a better parallel is using C/C++ to write software, where it is trivially easy to mismanaged memory in ways that cause 70% of CVEs
If we were being consistent, we’d be trying to eliminate all software written in any language or framework where it is trivially easy to introduce security issues
I wonder how many anti-Electron folks are also logically anti-C/C++ ?
removed by mod
Thanks.
Ahhh, I see; so, essentially, a combination of both resources and privacy.