Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Standalone Signal Desktop

signal.org

Post reply on HN
Print view View original

301–310 of 320 posts

Re: Standalone Signal Desktop

#301

Post by orange8 »

baby wrote: post #256
polpo wrote: post #120

Earlier quoted context omitted.

They could use NW.js instead, which stays up-to-date with the latest Chromium version, including security updates. They usually release on the same day as Chromium. https://nwjs.io/blog/

This is interesting, I feel like NW.js has lost the war against Electron, but I haven't closely been following the topic. Can anyone summarize the latest common opinion on the subject?

I suspect most electron devs haven't even heard of NW.js even though it came first, so there wouldn't even be any comparison to begin with.

Re: Standalone Signal Desktop

#302

Post by orange8 »

superkuh wrote: post #145
orange8 wrote: post #112

Earlier quoted context omitted.

what do you suggest they should they use instead

They could try not writing it in javascript and actually make a native application instead hiding behind semantics.

Still not anwering the question though, are you?

Re: Standalone Signal Desktop

#303

Post by orange8 »

StreamBright wrote: post #220
orange8 wrote: post #112

Earlier quoted context omitted.

what do you suggest they should they use instead

Write native code without Electron, Chrome, other random attack vectors?

In what, specifically? Name just one platform without these "random attack vectors".

Re: Standalone Signal Desktop

#304

Post by orange8 »

qznc wrote: post #166
orange8 wrote: post #112

Earlier quoted context omitted.

what do you suggest they should they use instead

Wire is a competitive messenger. One employee there writes a native app with Rust and Gtk. Seems to be something like a voluntary 20% protect though. https://github.com/wireapp/coax

So you are suggesting they drop a battle-tested, production ready solution currently powering hundreds of apps (https://electron.atom.io/apps/) for one in beta that the developers warn in large capital letters "use at your own risk, still under development"?!

Re: Standalone Signal Desktop

#305

Post by [deleted] »

amedvednikov wrote: post #283
hiimnate wrote: post #250

Earlier quoted context omitted.

Why in the world would they do that? Can't they just launch a normal browser window or something? Downloading 500MB of chrome bloat just to display a login window seems ludicrous.

eul requires cookies for authentication. Initially it was decrypting Chrome cookies, but this was rightfully detected and flagged by antivirus software. I'll switch to Servo in the future, it's only ~20MB.

[deleted]

Re: Standalone Signal Desktop

#306

Post by [deleted] »

eeZah7Ux wrote: post #39
noja wrote: post #30

> Linux distributions supporting APT, like Ubuntu or Debian Oh come on guys. Don't forget Fedora. Fedora means SELinux. SELinux means you are getting the people who value security.

> SELinux means you are getting the people who value security Proper, very strict sandboxes implemented with seccomp & friends are much more secure. You simply block the large majority of system calls. Surprisingly, they are often easier to set up.

[deleted]

Re: Standalone Signal Desktop

#307

Post by eeZah7Ux »

noja wrote: post #43
eeZah7Ux wrote: post #39

Earlier quoted context omitted.

> SELinux means you are getting the people who value security Proper, very strict sandboxes implemented with seccomp & friends are much more secure. You simply block the large majority of system calls. Surprisingly, they are often easier to set up.

Can you recommend any distros that use it extensively, or is it too early?

Ideally upstreams, rather than distributions, should sandbox their own projects.

However, Debian is shipping a number of hardened systemd unit files.

To see some examples on how the sandboxing is being set up you can grep for SystemCallFilter, CapabilityBoundingSet, ProtectSystem, ProtectHome in /lib/systemd/system/*.service

Re: Standalone Signal Desktop

#310

Post by mikewhy »

eptcyka wrote: post #299
andrepd wrote: post #266

Earlier quoted context omitted.

I get what you're saying and I totally agree with the sentiment, but in this case I can let it slide. It's the only practical way to make a cross platform app for Linux, Windows and Mac. They simply don't have the resources to write and maintain (at least) three desktop apps. I can totally understand that a small company has to make compromises like writing their desktop apps in Electron. That large companies also do…

Telegram has found a way to deliver the same client on both Linux, Windows and MacOS using Qt. One does not need to consume hundred of megabytes of memory to achieve a cross-platform solution.

The telegram app for macOS is taking ~140MB of ram to display the welcome screen here.
Post reply on HN