Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

From Markdown to remote code execution in Atom

statuscode.ch

Post reply on HN
Print view View original

31–40 of 152 posts

Re: From Markdown to remote code execution in Atom

#31

Post by jrimbault »

Aaargh20318 wrote: post #24
pjc50 wrote: post #21

Earlier quoted context omitted.

Cross-platform GUI development has always been fraught, though. I don't blame people for picking an existing, working (mostly) technology that guarantees (mostly) identical results across lots of platforms.

Cross-platform GUI development in general is a dumb idea. The user chose a specific platform and expect applications to follow that platforms UX guidelines. Building a cross-platform app is basically saying you don't give a fuck about your customers. It's an insult to your users.

I'll venture a guess, most devs, most applications, do not exist to give their users delightfully crafted UI and UX with handmade animations.

Most applications are really crude in their design, and do not target large international hip demographics.

Re: From Markdown to remote code execution in Atom

#32

Post by ryanplant-au »

gcb0 wrote: post #13
zx2c4 wrote: post #10

This is why I don't run any Electron apps on my computers at all, ever. That means I'm stuck with the web browser version of Slack, Skype, Signal (going away), and so forth, which is a shame. But it's better than the security nightmare that is Electron. I wish developers wanting to make cross platform GUI applications would look instead at Qt. It's extremely easy to use, really fast, and generates great GUIs. It's be…

welcome to the history loop! it is a very known fact for all unix grey beards (insert more inclusive analogy if you can think any) that containers and fat binaries lead to way more code rot than anything else. and consequently more bugs and security bugs. I blame this fad coming back on apple. linux and even Microsoft were happy with shared libraries, until osx adopted the bait and switch tactics of Microsoft and got…

> a very known fact for all unix grey beards

The co-inventor of Unix, Ken Thompson, and the Unix team engineer and author of The Unix Programming Environment, Rob Pike, are both big advocates of static linking. They designed Go and made a big point of emphasising static linking. Pike: "Shared libraries are obviously a good idea until you've actually used them. Whether it's obvious or not that they're a bad idea is mostly a matter of how close you are to trying to get them to work." He wrote the first windowing system for Unix, which surely qualifies him as a greybeard.

Re: From Markdown to remote code execution in Atom

#34

Post by pjmlp »

scrollaway wrote: post #19
zx2c4 wrote: post #10

This is why I don't run any Electron apps on my computers at all, ever. That means I'm stuck with the web browser version of Slack, Skype, Signal (going away), and so forth, which is a shame. But it's better than the security nightmare that is Electron. I wish developers wanting to make cross platform GUI applications would look instead at Qt. It's extremely easy to use, really fast, and generates great GUIs. It's be…

Look, I love Qt; I worked with it a ton, I contributed back to it, I even still work on LXQt sometimes. But the rise of web apps, and Electron along with it, have turned the Linux desktop from a "you need to dual boot or use wine" machine into one where all my tools and apps are Linux compatible and have feature parity with Windows and macOS. I also wish Qt would see more use, I also wish more people would write desk…

The thing is, with the desktop Web in the end what we get is ChromeOS, a browser window manager that makes the actual kernel completely irrelevant.

The adoration of Electron apps among Linux users will be the final nail on the year of desktop Linux.

Re: From Markdown to remote code execution in Atom

#35

Post by catnaroek »

scotty79 wrote: post #6

Why does anyone think that blacklisting things they know about makes html more secure? I guess whitelisting only the things they are absolutely sure are harmless is way more work.

How about “not using a bazooka to kill a mosquito”? There's no reason why a text editor needs a frigging browser engine as a core component.

Re: From Markdown to remote code execution in Atom

#36

Post by pjmlp »

pjc50 wrote: post #26
Aaargh20318 wrote: post #24

Earlier quoted context omitted.

Cross-platform GUI development in general is a dumb idea. The user chose a specific platform and expect applications to follow that platforms UX guidelines. Building a cross-platform app is basically saying you don't give a fuck about your customers. It's an insult to your users.

So you're saying software OEMs need to pick one of Windows or MacOS and not support any other platforms?

No, you create a proper abstraction layer that maps to native plaform elements.

For example, IFileDialog maps to a Cocoa dialog on macOS, file picker on UWP, open dialog on Win32, document selector on Android and so on.

Yes, it takes some initial effort, but it only needs to be done once.

Re: From Markdown to remote code execution in Atom

#37

Post by pjmlp »

cyberpunk0 wrote: post #23
cabalamat wrote: post #8

I've an idea. Let's write GUI apps using GUI libraries, like everyone used to, instead of writing them for a web browser. Not only will this be more secure, it'll also be 10s or 100s of times more performant.

Why? Qt/swing/gtk apps tend to look like shit and are horrible to try and code

Time to pick up some UI/UX skills.

Re: From Markdown to remote code execution in Atom

#38

Post by neoeldex »

ryanplant-au wrote: post #32
gcb0 wrote: post #13

Earlier quoted context omitted.

welcome to the history loop! it is a very known fact for all unix grey beards (insert more inclusive analogy if you can think any) that containers and fat binaries lead to way more code rot than anything else. and consequently more bugs and security bugs. I blame this fad coming back on apple. linux and even Microsoft were happy with shared libraries, until osx adopted the bait and switch tactics of Microsoft and got…

> a very known fact for all unix grey beards The co-inventor of Unix, Ken Thompson, and the Unix team engineer and author of The Unix Programming Environment, Rob Pike, are both big advocates of static linking. They designed Go and made a big point of emphasising static linking. Pike: "Shared libraries are obviously a good idea until you've actually used them. Whether it's obvious or not that they're a bad idea is mo…

It's a shame they didn't roll a proper package manager with the language toolkit. Having your executable depend on having some lib installed is quite a pain. But how do you share libraries properly then? Especially without a proper way of bundling deps in your code...

Using cargo always makes me feel at ease when writing Rust. Haven't dabbled with linkers though.

Re: From Markdown to remote code execution in Atom

#40

Post by DandyDev »

qudat wrote: post #16
zx2c4 wrote: post #10

This is why I don't run any Electron apps on my computers at all, ever. That means I'm stuck with the web browser version of Slack, Skype, Signal (going away), and so forth, which is a shame. But it's better than the security nightmare that is Electron. I wish developers wanting to make cross platform GUI applications would look instead at Qt. It's extremely easy to use, really fast, and generates great GUIs. It's be…

All your positives about Qt can be applied to electron but even better. From a business point of view electron is a winner. For example at our company we have built a desktop app, web app, salesforce plugin, chrome extension, outlook plugin, cli app, and are working on mobile apps all using one JavaScript codebase. It’s a business and developers dream. There really is no competition and any claim to the contrary woul…

It's not a developers dream if that developer loathes Javascript, like I do. Even Typescript just feels like lipstick on a pig.
Post reply on HN