Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tauri vs. Electron – Real world application

levminer.com

Post reply on HN
Print view View original

91–100 of 107 posts

Re: Tauri vs. Electron – Real world application

#91

Post by catlifeonmars »

KronisLV wrote: post #85

> Shipping an app without auto update in 2022 is a no go. If your user has to manually download every update I don't think they are going to be happy. Honestly, in certain crowds the opposite is true. Having to install updates for software that is for all purposes feature complete is incredibly annoying, if you don't need an actual bug fix for something that impacts your workflow. Sure, there can be security concerns…

When it comes to security concerns, it’s not just about what you can do within an exploited binary. There’s also a lateral movement component: specifically the binary could be used to achieve privilege escalation or manipulated to write to the filesystem by controlling the input, etc.

Re: Tauri vs. Electron – Real world application

#92

Post by catlifeonmars »

jupp0r wrote: post #55

"With Electron you have full access to Node APIs, so a hacker could easily exploit the very powerful Node APIs." This is not true, `nodeIntegration` has been disabled by default years ago in Electron 5.0 [1]. The default in Electron 20 will be a sandboxed renderer process that can't even read files from disk [2]. Security in Electron is great if you follow their security guidelines [3]. [1] https://www.electronjs.org…

I can’t tell you how many electron projects I’ve seen where “nodeIntegration” is explicitly turned on.

Re: Tauri vs. Electron – Real world application

#93

Post by KronisLV »

catlifeonmars wrote: post #91
KronisLV wrote: post #85

> Shipping an app without auto update in 2022 is a no go. If your user has to manually download every update I don't think they are going to be happy. Honestly, in certain crowds the opposite is true. Having to install updates for software that is for all purposes feature complete is incredibly annoying, if you don't need an actual bug fix for something that impacts your workflow. Sure, there can be security concerns…

When it comes to security concerns, it’s not just about what you can do within an exploited binary. There’s also a lateral movement component: specifically the binary could be used to achieve privilege escalation or manipulated to write to the filesystem by controlling the input, etc.

Certainly, you're right there. Though do we need auto updates for addressing that, with all of the risks and annoyances that come with that mechanism?

For example, something like GitLab doesn't have automatic updates (in self-hosted versions) and seems to get by just fine with sufficiently scary update notices for serious CVEs, for example: https://about.gitlab.com/releases/2022/08/22/critical-securi...

Of course, those who just don't care won't even bother with those updates and the consequences are obvious. Automatic updates would prevent that, but then again, the backlash in the Ubuntu community for having snap packages on servers (and to a lesser degree on desktop) would suggest that that's just not enough to get people to buy into it.

One could also claim that server software and desktop software are entirely different beasts, but personally I'd prefer to update software on my desktop PC through apt or another standard mechanism (when I want, from sources I trust), as opposed to every piece of software deciding on their own bespoke update mechanism.

Personally, I don't really have a good answer. Both approaches are somewhat flawed, just in different ways to different folks in different circumstances.

Re: Tauri vs. Electron – Real world application

#94

Post by pornel »

RussianCow wrote: post #65
pornel wrote: post #62

Earlier quoted context omitted.

CSS evolves and there’s always some new funky selector or effect coming, but the whole point is that you don’t need to follow this year’s latest hotness. If you slap rounded corners and box-shadow (very old by now) you have 90% of what Apple calls design lately. For Windows “metro” you don’t even need rounded corners :)

> but the whole point is that you don’t need to follow this year’s latest hotness You might not have a choice. Sometimes even seemingly trivial APIs/features like SVG, flexbox, or audio/video behave slightly differently in different browsers, and it's easy to sink a lot of time into debugging these differences. I'm not saying the effort isn't ever worth it, and it's certainly better now than it ever was in the past,…

I’ve been writing web apps professionally for lovely browsers like IE6, Android 3.0, and Blackberry. I know when CSS can be hard to get working. 2022 WebViews are a walk in the park.

Re: Tauri vs. Electron – Real world application

#95

Post by jupp0r »

catlifeonmars wrote: post #92
jupp0r wrote: post #55

"With Electron you have full access to Node APIs, so a hacker could easily exploit the very powerful Node APIs." This is not true, `nodeIntegration` has been disabled by default years ago in Electron 5.0 [1]. The default in Electron 20 will be a sandboxed renderer process that can't even read files from disk [2]. Security in Electron is great if you follow their security guidelines [3]. [1] https://www.electronjs.org…

I can’t tell you how many electron projects I’ve seen where “nodeIntegration” is explicitly turned on.

Having worked on an electron app for several years I can tell you that that's really just laziness by respective dev teams. It's not pretty to use contextBridge and IPC, it just requires some extra work. Electron itself did a great job making this easier and easier over the years.

Re: Tauri vs. Electron – Real world application

#96

Post by datagram »

hasperdi wrote: post #41
parker-codes wrote: post #28

Regarding point #4, I think the clear winner is Tauri. I'll clarify -- While writing in Node is great if you don't know Rust, your users are being shipped an entire Node runtime, which has size, memory, and security issues. So in this case Electron has a "better" DX completely at the cost of the user. Tauri has JS/TS APIs, but if you need to do extensive backend work then it requires some learning at the benefit of y…

You're implying that application written in Rust would not have no size, memory and security issues. That is of course not true.

As far as size goes:

a) Compiled JS apps generally have to include a whole Javascript engine, which makes them significantly larger b) Rust is designed for shipping small static binaries, whereas Node is not; node.exe by itself is tens of megabytes, and you can only make it smaller by compiling it yourself from source. Deno has compiling static binaries as an explicit feature so it may fare better in the long run, but it's still limited by a)

As an example: I just tested on MacOS and a hello world program compiled with `rustc` is 378KB, whereas one built with `deno compile` is 74MB.

Re: Tauri vs. Electron – Real world application

#97

Post by ticviking »

jupp0r wrote: post #95
catlifeonmars wrote: post #92

Earlier quoted context omitted.

I can’t tell you how many electron projects I’ve seen where “nodeIntegration” is explicitly turned on.

Having worked on an electron app for several years I can tell you that that's really just laziness by respective dev teams. It's not pretty to use contextBridge and IPC, it just requires some extra work. Electron itself did a great job making this easier and easier over the years.

Having worked as a developer for several years I can tell you that you should never underestimate both the time pressure our professional peers are under and their laziness. If I can hit the deadline by sitting that bool true, vs spend a week learning a new tech while I have 4 other "Critical" tickets in queue. I'll probably set the bool to true and so penance for it later.

Re: Tauri vs. Electron – Real world application

#98

Post by catlifeonmars »

KronisLV wrote: post #93
catlifeonmars wrote: post #91

Earlier quoted context omitted.

When it comes to security concerns, it’s not just about what you can do within an exploited binary. There’s also a lateral movement component: specifically the binary could be used to achieve privilege escalation or manipulated to write to the filesystem by controlling the input, etc.

Certainly, you're right there. Though do we need auto updates for addressing that, with all of the risks and annoyances that come with that mechanism? For example, something like GitLab doesn't have automatic updates (in self-hosted versions) and seems to get by just fine with sufficiently scary update notices for serious CVEs, for example: https://about.gitlab.com/releases/2022/08/22/critical-securi... Of course, th…

> the backlash in the Ubuntu community for having snap packages on servers (and to a lesser degree on desktop) would suggest that that's just not enough to get people to buy into it.

> Personally, I don't really have a good answer. Both approaches are somewhat flawed, just in different ways to different folks in different circumstances.

You hit the nail on the head. It depends on the target market for your application. If your users do not expect to manually update, it’s probably a good idea to build an auto update mechanism that is opt-out or opt-in. It might not be worth it for other target markets though.

However, my point was that just because an application isn’t doing something critical, doesn’t make security vulnerabilities in that application harmless.

Re: Tauri vs. Electron – Real world application

#99

Post by jupp0r »

ticviking wrote: post #97
jupp0r wrote: post #95

Earlier quoted context omitted.

Having worked on an electron app for several years I can tell you that that's really just laziness by respective dev teams. It's not pretty to use contextBridge and IPC, it just requires some extra work. Electron itself did a great job making this easier and easier over the years.

Having worked as a developer for several years I can tell you that you should never underestimate both the time pressure our professional peers are under and their laziness. If I can hit the deadline by sitting that bool true, vs spend a week learning a new tech while I have 4 other "Critical" tickets in queue. I'll probably set the bool to true and so penance for it later.

Yeah, it's a sad reality. Thankfully the market is good enough that we have the chance to choose a job where we can make these decisions ourselves and live up to a higher standard.
Post reply on HN