Viewing profile — jsnar

Electron is unsafe because it's based on outdated versions of Chromium: https://github.com/signalapp/Signal-Desktop/issues/1635

Signal desktop app is based on the insecure Electron runtime. See my report here: https://github.com/signalapp/Signal-Desktop/issues/1635

See here for the security issues published in Chrome stable releases in those versions: https://chromereleases.googleblog.com/2017/07/stable-channel... https://chromereleases.googl…

Electron makes things worse: it is not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the se…

This doesn't make it safe -- consider a lower level library inside Chromium can be exploited when processing input data. Your chat app can be exploited by receiving a crafted image…

submitted issue for this: https://github.com/WhisperSystems/Signal-Desktop/issues/1635

It's not as simple as you thought. Consider a bug in the image decoding library Chromium used that can be exploited by simply sending a crafted image in the chat.

See here for the security issues published in Chrome stable releases in those versions: https://chromereleases.googleblog.com/2017/07/stable-channel... https://chromereleases.googl…

Using Electron is a bad idea: it's not secure. Electron has many security vulnerabilities. The latest version is still based on old Chromium (58 & 59) so it inherits many of the se…

Electron could still be faulty: its multi process architecture makes application developer easier to write memory leaking code.

NW.js can run any Chrome Apps directly: http://nwjs.io