I often see people talking about the fact that they like a certain open-source application, but āitās a shame itās on Electronā; what does this mean? Is it a privacy thing or a resource thing?
You must log in or register to comment.
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- Itās FOSS
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
- !libre_culture@lemmy.ml
- !libre_software@lemmy.ml
- !libre_hardware@lemmy.ml
- !linux@lemmy.ml
- !technology@lemmy.ml
Community icon from opensource.org, but we are not affiliated with them.
- 0 users online
- 5 users / day
- 16 users / week
- 68 users / month
- 286 users / 6 months
- 17 subscribers
- 1.59K Posts
- 5.54K Comments
- Modlog
Electron is a framework for desktop development based on Chromium.
It has a big part of Chromium as part of its code but with a wrapper layer to act as a framework.
With it, you can make desktop apps with PWA (Progressive Web Apps).
They like some of it because you can get the beauty of CSS and JS effects in a desktop app, but for every of these apps you end running an independent instance of Chromium.
It doesnāt use system browser engine or one from the installed browsers. Every app you install using it is exactly the same as installing Chrome or Chromium in different folders at your PC and running them at the same time.
This is why they blame it too.
Privacy wise: It uses Chromium, which has been shown to have plenty of phone homes back to Google. Even though itās open source, even projects specifically intended to āde-Googleā it, like the Ungoogled Chromium project, are adamant that theyāre never sure that theyāve gotten all of it because itās so pervasive ā and Electron uses the vanilla Chromium code straight from Google.
Other than that, the other, bigger reason is that Electron is extremely inefficient. @dessalines@lemmy.ml mentioned an Electron chat app using 4GB of RAM, and thatās not an exaggeration. You can easily get multi-GB RAM usage on even simple Electron apps. It uses a lot of CPU power too, like when Visual Studio Code used 13% of a CPU just to make the cursor blink.
Basically, almost anything is a better app platform than Electron. A fully native app in a low-level language is obviously the standard for performance, but even if you donāt want to go through the trouble, languages like Java and Kotlin are still way better than Electron. Hell, even other interpreted languages like Python run circles around Electron, see Blender.
Electron apps is essentially running web apps wrapped as a desktop version. Most of them run like garbage and are always inferior to one made specifically for desktops. The only one Iāve used that runs sensibly is Discord.
As for why people use it, itās convenient for developers as most of them are familiar with web development and can essentially copy-paste their web application without having to change much.
worse even: it includes different copies of chromium in each app
Yeah, and since the devs obviously are either too inept to change this or donāt care, they probably never will ā this āidea about a runtime modeā issue is open since 2014.
2014 was the same year Microsoft ended support for Windows XP.
So, I assume thereās not an Electron alternative that is able to port internet desktop applications without any privacy or resource issues?
There isnāt an alternative, Electron actually does its job well for what it is. Itās basically a slimmed down browser thatās customizable and runs on all systems, itās just that it takes a ton of effort to optimize it, and for some reason most people using it arenāt very experienced.
There is Tauri which is very similar but claims to have a lower resource usage and be more secure.
Here are some flaws with Electron:
Ahhh, I see; so, essentially, a combination of both resources and privacy.
An Electron app has full access to your filesystem and to other system resources, the same as any other desktop app
Is there a specific reason or example for why we say it has terrible security here?
Chromium has an incredibly advanced and optimised graphics pipeline and the code that is running in the āwebā part of an Electron app benefits from Chromiumās sandbox
From what Iāve heard, itās trivial to accidentally execute an external webapp with the same privileges as the app itself, so youāre one bug away from potentially giving a random website access to your system APIs. For example, an improperly implemented HTML previewer would probably be the easiest way to get pwned in this way, especially since Electron supports the entire Node.js environment and not just browser based JS.
You mean how like nobody ever ever pipes the output of
curlinto abashwith root privileges? :PMaybe we should ban cURL when we ban Electron?
No, this is worse. With the cURL thing, you know what youāre doing because you literally entered the command, and then you have to enter a password, and you can make your own assessment as to whether itās a good idea. Also, assuming youāre on an HTTPS connection and trust the source (i.e. reputable software author versus shady pirate site), itās not actually unsafe.
Whereas with sandbox breaks in Electron, someone canāt reasonably know that a feature is vulrnable (hell it can take the people who wrote the damn thing years to realize thereās a bug). If you need to open an HTML file in VSCode, are you going to manually audit the previewer implementation? Itās much easier to check your terminal commands for insecure pipes than to check an electron app for sandbox violations.
I guess a better parallel is using C/C++ to write software, where it is trivially easy to mismanaged memory in ways that cause 70% of CVEs
If we were being consistent, weād be trying to eliminate all software written in any language or framework where it is trivially easy to introduce security issues
I wonder how many anti-Electron folks are also logically anti-C/C++ ?
Iām definitely an advocate for low level memory safe languages like Rust, over C/C++
Thanks.
People complain about Electron, but without it there would probably be even fewer cross-platform apps today
Some aspects of it might be less than perfect, but letās not allow perfect to be the enemy of good
Electron doesnāt automatically mean that an app is bad, just like Unity doesnāt automatically mean that a game is good
Completely agree, thanks to Electron we now have many mainstream apps working on Linux and that just wouldnāt have happened otherwise. Whatever technological problems Electron has can be addressed down the road, and are outweighed by the value of lowering the barrier of creating cross-platform applications.
Iād be less hateful of Electron if it simply allowed me to use Mozilla Gecko instead of Chromium as the rendering engine.
You mean something similar to XULRunner?
Pluggable engines would be nice, but I feel like itās less of a concern for stuff like Electron where youāre making apps with it. Iād be more interested in addressing memory usage and cutting out stuff thatās not really needed for apps thatās part of the browser engine. Ideally, it should be modular so that you can include just the stuff your app uses to keep it lean. Perhaps using an approach similar to GraalVM could be taken as well to reduce resource usage.
Or you could just use the offline functionality built into browsers nowadays instead of Electron.
If you have to use more than one Electron app, Ferdi is pretty great https://getferdi.com/
Thank you for pointing this out. Atm I only use Discord (bc my friends ālIkE tHiR UIā and refuse to use mumbleā¦) bit if I had to go through the pain of using more electron crap I think that that app would be a cool solution
I havenāt tried it yet, but Fosscord seems like it could be handy for Discord rehab treatment (especially if the incredible-sounding āconnect to discord.com serversā works)
I didnāt know it was already usable. Thanks
Thereās a nice article explaining why Electron is terrible.
Well, electron just sucks. Is just trash. Inmense resource consumption bc chromium.
I always like to think of the fact that space agencies went to the moon on like 2KB of ram, but in 2022 we need 4 GB of ram to run a chat window.
āBut nowdays is cheaperā itās a lazy excuse to not do any proper optimization.
That article that @IngrownMink4@lemmy.ml linked is so good. At the bottom of it, they state: āAll you web devs should learn C or Rust. Your program runs on a computer. Learn how to code for one.ā
I always liked the saying ājust because I have the RAM doesnāt mean itās for you!ā
removed by mod