Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

From Markdown to remote code execution in Atom

statuscode.ch

Post reply on HN
Print view View original

51–60 of 152 posts

Re: From Markdown to remote code execution in Atom

#51

Post by pjmlp »

Klathmon wrote: post #41
pjmlp wrote: post #36

Earlier quoted context omitted.

No, you create a proper abstraction layer that maps to native plaform elements. For example, IFileDialog maps to a Cocoa dialog on macOS, file picker on UWP, open dialog on Win32, document selector on Android and so on. Yes, it takes some initial effort, but it only needs to be done once.

That's easy to say for a file picker on desktop OSs, but what happens when you need to layout a page on all 3 desktop plus Android and iOS? Do you need to design 5 designs that include 5 different buttons, 5 ways of navigating through the app, 5 different sets of icons, 5 different styles of animation, etc... Hell even with a file picker, what happens when you use it on a platform that doesn't really have the concept…

How do you think we used to create portable software across 8 bit and 16 bit platforms?

Most of it actually written in Assembly.

Re: From Markdown to remote code execution in Atom

#52

Post by pjc50 »

pjmlp wrote: post #36
pjc50 wrote: post #26

Earlier quoted context omitted.

So you're saying software OEMs need to pick one of Windows or MacOS and not support any other platforms?

No, you create a proper abstraction layer that maps to native plaform elements. For example, IFileDialog maps to a Cocoa dialog on macOS, file picker on UWP, open dialog on Win32, document selector on Android and so on. Yes, it takes some initial effort, but it only needs to be done once.

I'm really going to have to ask for an example of this. Other than SWT I've not seen it done well.

Re: From Markdown to remote code execution in Atom

#53

Post by pjmlp »

pjc50 wrote: post #52
pjmlp wrote: post #36

Earlier quoted context omitted.

No, you create a proper abstraction layer that maps to native plaform elements. For example, IFileDialog maps to a Cocoa dialog on macOS, file picker on UWP, open dialog on Win32, document selector on Android and so on. Yes, it takes some initial effort, but it only needs to be done once.

I'm really going to have to ask for an example of this. Other than SWT I've not seen it done well.

Office, Photoshop.

Re: From Markdown to remote code execution in Atom

#54

Post by pjmlp »

pfooti wrote: post #47
Klathmon wrote: post #41

Earlier quoted context omitted.

That's easy to say for a file picker on desktop OSs, but what happens when you need to layout a page on all 3 desktop plus Android and iOS? Do you need to design 5 designs that include 5 different buttons, 5 ways of navigating through the app, 5 different sets of icons, 5 different styles of animation, etc... Hell even with a file picker, what happens when you use it on a platform that doesn't really have the concept…

I agree; if you build a system that completely covers specifying layouts for all widget needs and a DSL that handles wiring views into models, for all operating systems and device formfactors, you will have invented HTML, CSS, and JavaScript, with the DOM api and a browser as the default interface.

Not at all, because HTML, CSS and JavaScript are a poor man's UI with the lowest common denominator of OS features.

Re: From Markdown to remote code execution in Atom

#55

Post by scotty79 »

barkingcat wrote: post #9
scotty79 wrote: post #6

Why does anyone think that blacklisting things they know about makes html more secure? I guess whitelisting only the things they are absolutely sure are harmless is way more work.

Even whitelisting is dangerous for web/html. Given any tag, there's probably a large number of things you can do with them that boggles the mind as in "whoa I didn't know you could do that..." including things that are not in the w3c specs but are coded into the interpreters. Basically the experience of a web developer every day, no matter how experienced you are.

I you whitelist tags and then whitelist attributes and then whitelist attribute values and for attributes that have values with its own structure, like style whitelist allowed things in that structure, you should be fine.

But it's hard to restrain yourself from doing: allow any (possibly except some) at any stage of whitelisting.

Even to a point of not allowing string of any characters as attribute value.

Re: From Markdown to remote code execution in Atom

#56

Post by chrisweekly »

scrollaway wrote: post #19
zx2c4 wrote: post #10

This is why I don't run any Electron apps on my computers at all, ever. That means I'm stuck with the web browser version of Slack, Skype, Signal (going away), and so forth, which is a shame. But it's better than the security nightmare that is Electron. I wish developers wanting to make cross platform GUI applications would look instead at Qt. It's extremely easy to use, really fast, and generates great GUIs. It's be…

Look, I love Qt; I worked with it a ton, I contributed back to it, I even still work on LXQt sometimes. But the rise of web apps, and Electron along with it, have turned the Linux desktop from a "you need to dual boot or use wine" machine into one where all my tools and apps are Linux compatible and have feature parity with Windows and macOS. I also wish Qt would see more use, I also wish more people would write desk…

> “really wish people would start writing tiny CLI apps in nodejs and include 70 dependencies”

did you mean /s/start/stop/ above?

Re: From Markdown to remote code execution in Atom

#57

Post by Klathmon »

pjmlp wrote: post #51
Klathmon wrote: post #41

Earlier quoted context omitted.

That's easy to say for a file picker on desktop OSs, but what happens when you need to layout a page on all 3 desktop plus Android and iOS? Do you need to design 5 designs that include 5 different buttons, 5 ways of navigating through the app, 5 different sets of icons, 5 different styles of animation, etc... Hell even with a file picker, what happens when you use it on a platform that doesn't really have the concept…

How do you think we used to create portable software across 8 bit and 16 bit platforms? Most of it actually written in Assembly.

Code is a different beast than UI.

Magnitudes easier to shim and support multiple architectures.

Re: From Markdown to remote code execution in Atom

#58

Post by aussie1233 »

scrollaway wrote: post #19
zx2c4 wrote: post #10

This is why I don't run any Electron apps on my computers at all, ever. That means I'm stuck with the web browser version of Slack, Skype, Signal (going away), and so forth, which is a shame. But it's better than the security nightmare that is Electron. I wish developers wanting to make cross platform GUI applications would look instead at Qt. It's extremely easy to use, really fast, and generates great GUIs. It's be…

Look, I love Qt; I worked with it a ton, I contributed back to it, I even still work on LXQt sometimes. But the rise of web apps, and Electron along with it, have turned the Linux desktop from a "you need to dual boot or use wine" machine into one where all my tools and apps are Linux compatible and have feature parity with Windows and macOS. I also wish Qt would see more use, I also wish more people would write desk…

"Web on desktop" Reminds me of Win98 and how Microsoft tried to push that back then. It's just a bad security model. Technologies were different, but the security implications that lead to exploits stayed the same.

Re: From Markdown to remote code execution in Atom

#59

Post by scotty79 »

catnaroek wrote: post #35
scotty79 wrote: post #6

Why does anyone think that blacklisting things they know about makes html more secure? I guess whitelisting only the things they are absolutely sure are harmless is way more work.

How about “not using a bazooka to kill a mosquito”? There's no reason why a text editor needs a frigging browser engine as a core component.

Apparently there's a reason because VS Code (and Atom) is way more useful than any other editor built over last few decades.

Re: From Markdown to remote code execution in Atom

#60

Post by scrollaway »

chrisweekly wrote: post #56
scrollaway wrote: post #19

Earlier quoted context omitted.

Look, I love Qt; I worked with it a ton, I contributed back to it, I even still work on LXQt sometimes. But the rise of web apps, and Electron along with it, have turned the Linux desktop from a "you need to dual boot or use wine" machine into one where all my tools and apps are Linux compatible and have feature parity with Windows and macOS. I also wish Qt would see more use, I also wish more people would write desk…

> “really wish people would start writing tiny CLI apps in nodejs and include 70 dependencies” did you mean /s/start/stop/ above?

Uh, yeah. People have definitely started.
Post reply on HN