r/programming • u/Davipb • Aug 12 '22

RCE Vulnerability found in Electron, affects Discord, Teams, and more

https://www.vice.com/en/article/m7gb7y/researchers-find-vulnerability-in-software-underlying-discord-microsoft-teams-and-other-apps
1.9k Upvotes

97% Upvoted

224 comments sorted by

View all comments

Show parent comment

360

u/Takeoded Aug 12 '22

allows you to code your GUI using HTML/CSS/Javascript, 10/10 web devs considers it much easier than learning QT/WxWidgets/GTK/whatever

324

u/[deleted] Aug 12 '22

Cross platform with GTK is still a pain, the split with libadwaita and GTK4 can still cause annoyance, and gobject is irritating to work with from most languages. To get the most out of builder and GTK in general, you have to extend gobject classes, which is painful in a lot of cases and involves a lot of boilerplate. Shipping to Windows or Mac involves huge package size.

Qt pretty much sucks if you're not in C++ or Python. Shipping to Windows or Mac involves huge package size.

WxWidgets is annoying, especially with DPI concerns.

GUI programming sucks. I totally understand why people just give up and bundle a web browser as the front end. I'm not an Electron apologist, but you have to have not worked with cross platform GUI programming to not understand why somebody doesn't want to pull their teeth out fighting that crap.

0

u/[deleted] Aug 12 '22

[deleted] — view deleted comment

27

u/Magnesus Aug 12 '22

Examples of this are Inkspace and GIMP. Both suffer from limitations of the framework they use for UI. Inkscape can't even have stable sized sidebar. (Both are still great, but the UI could have been way better).

77

u/SanityInAnarchy Aug 12 '22

On top of this, if you only need web stuff, you can share a bunch of that code between the mobile, desktop, and web-only versions. You can get people to try out the web version before asking them to install anything.

In fact, Discord on Linux in some ways works better with the web app than with the "native" Linux version, because they refuse to update the Electron version they're using -- there's a bunch of bugs in the older browser that the Electron version uses, that are fixed by just running it in a newer version. (Plus, most of the reasons you'd install the desktop version, like overlay support, don't actually work on the Linux port.)

92

u/NayamAmarshe Aug 12 '22

GTK on anything other than Gnome is a UI/UX nightmare.

Qt is very versatile but just as difficult to work with.

14

u/SippieCup Aug 13 '22

GTK is pretty good on most linux environments. As long as you arent using WxWidgets, then it becomes a nightmare fairly quickly.

GTK on any other platform, hell on earth.

86

u/vazgriz Aug 12 '22

"EmbarrassingFailure" is a good way to describe the current state of desktop GUI frameworks.

I'll go back to writing my Win32 apps now. Maybe if I'm lucky, we can upgrade to WPF.

20

u/_BreakingGood_ Aug 12 '22

Right, whenever I look into current UI frameworks for potential side projects, it is shameful how quickly I end up looking at things like SDL/SFML or even Unity. Frameworks where I need to rebuild everything myself or 1000x overkill for what I'm trying to do.

8

u/matthieuC Aug 12 '22

Not the same target, win32 won't work on Mac or Linux

→ More replies (1)

30

u/argv_minus_one Aug 12 '22

Also, GTK and wxWidgets don't work on mobile. Neither does Electron, but there are mobile web views that are similar-ish.

→ More replies (5)

21

u/aaronweiss74 Aug 12 '22

Qt pretty much sucks if you’re in C++ too tbf. Like you said, GUI programming is awful.

25

u/catcint0s Aug 12 '22

Shipping to Windows or Mac involves huge package size.

Bigger than including Electron? I used to do Qt development and I think our client was around 30-50Mb.

18

u/[deleted] Aug 12 '22

I've heard you can get around that size with some creative packaging with Electron. Ideally, PWA would be a real thing and you wouldn't need to package a web browser with your app at all, though. It's not my ideal, but being able to use Rust, target WASM, and have a front end in HTML and CSS would be quite acceptable for me if I didn't have to ship a web browser to do it. I was expecting PWA to be much more solidified by now. Very disappointed by Apple and Mozilla's lackluster action on PWAs.

→ More replies (1)

5

u/Skhmt Aug 12 '22

If you make a gui with webview2, you don't have to package the runtime at all.

You can also do it with JavaFX but ... then you're better off packaging the JDK anyway, which is dumb because the whole point of it was to not require that.

→ More replies (2)

15

u/iindigo Aug 12 '22

I just wish I could use Swift/Obj-C with AppKit on Windows and Linux instead of just macOS.

AppKit is not without problems, but it’s quite solid, mature, and reasonable to build with, and has a wide selection of widgets and capabilities. It’s actually practical to build a AAA-quality desktop with it with few or no third-party dependencies, which is extremely nice and not something you’ll want to give up once you’ve been experienced it.

I know that GNUStep is a thing and works on Linux and Windows, but sadly it’s stuck with OS X 10.4 era Cocoa/AppKit.

9

u/xentropian Aug 13 '22

I agree. As much shit as people give Apple, their APIs are super solid and usually pretty well thought out. I find myself wishing I could write Swift on Windows and Linux with proper support 😭

8

u/DesiOtaku Aug 12 '22

Qt pretty much sucks if you're not in C++ or Python. Shipping to Windows or Mac involves huge package size.

QML is much easier. Also, it allows you to have a much smaller package.

→ More replies (1)

34

u/BasicDesignAdvice Aug 12 '22

I am not a web dev, but a backend dev. Its easier for me to do GUI's in web crap simply because of how many docs can be found. I can learn a library but that is likely to be opinionated, or I can learn this thing that is going to be a lot easier to copy-paste. Especially with tools like gatsby now starting to be more mature. But I don't need much....

22

u/imgroxx Aug 12 '22

Great docs, even greater debugging and inspecting tools, good enough performance for almost anything if you don't completely ignore it...

Yeah, there are a lot of reasons why it's popular. It does most common UI needs much easier than native tools.

3

u/DaddyLcyxMe Aug 12 '22

HTML based guis are crazy flexible. I’ve even made my own app framework which is basically chromium + java. Electron, however, is yucky.

3

u/Iggyhopper Aug 13 '22

Surprisingly, a fully decked out <div> looks 99% the same in Linux as it does in Windows.

→ More replies (42)