I often see people talking about the fact that they like a certain open-source application, but ‘it’s a shame it’s on Electron’; what does this mean? Is it a privacy thing or a resource thing?

  • jokeyrhyme@lemmy.ml
    link
    fedilink
    arrow-up
    6
    ·
    edit-2
    3 years ago

    An Electron app has full access to your filesystem and to other system resources, the same as any other desktop app

    Is there a specific reason or example for why we say it has terrible security here?

    Chromium has an incredibly advanced and optimised graphics pipeline and the code that is running in the “web” part of an Electron app benefits from Chromium’s sandbox

    • AgreeableLandscape☭@lemmygrad.ml
      link
      fedilink
      arrow-up
      4
      ·
      edit-2
      3 years ago

      Is there a specific reason or example for why we say it has terrible security here?

      From what I’ve heard, it’s trivial to accidentally execute an external webapp with the same privileges as the app itself, so you’re one bug away from potentially giving a random website access to your system APIs. For example, an improperly implemented HTML previewer would probably be the easiest way to get pwned in this way, especially since Electron supports the entire Node.js environment and not just browser based JS.

      • jokeyrhyme@lemmy.ml
        link
        fedilink
        arrow-up
        2
        arrow-down
        1
        ·
        3 years ago

        You mean how like nobody ever ever pipes the output of curl into a bash with root privileges? :P

        Maybe we should ban cURL when we ban Electron?

        • AgreeableLandscape☭@lemmygrad.ml
          link
          fedilink
          arrow-up
          6
          ·
          edit-2
          3 years ago

          No, this is worse. With the cURL thing, you know what you’re doing because you literally entered the command, and then you have to enter a password, and you can make your own assessment as to whether it’s a good idea. Also, assuming you’re on an HTTPS connection and trust the source (i.e. reputable software author versus shady pirate site), it’s not actually unsafe.

          Whereas with sandbox breaks in Electron, someone can’t reasonably know that a feature is vulrnable (hell it can take the people who wrote the damn thing years to realize there’s a bug). If you need to open an HTML file in VSCode, are you going to manually audit the previewer implementation? It’s much easier to check your terminal commands for insecure pipes than to check an electron app for sandbox violations.

          • jokeyrhyme@lemmy.ml
            link
            fedilink
            arrow-up
            2
            ·
            3 years ago

            I guess a better parallel is using C/C++ to write software, where it is trivially easy to mismanaged memory in ways that cause 70% of CVEs

            If we were being consistent, we’d be trying to eliminate all software written in any language or framework where it is trivially easy to introduce security issues

            I wonder how many anti-Electron folks are also logically anti-C/C++ ?