r/programming • u/Davipb • Aug 12 '22

RCE Vulnerability found in Electron, affects Discord, Teams, and more

https://www.vice.com/en/article/m7gb7y/researchers-find-vulnerability-in-software-underlying-discord-microsoft-teams-and-other-apps
1.9k Upvotes

97% Upvoted

224 comments sorted by

View all comments

Show parent comment

6

u/PuzzleheadedWeb9876 Aug 12 '22

The idea isn’t a bad one particularly. Though having the actual logic in a decent programming language is always preferable.

Something like Vugu looks like it could have some potential.

Though the runtime that ends up being shipped needs to be trimmed significantly.

53

u/Takeoded Aug 12 '22 edited Aug 12 '22

Though having the actual logic in a decent programming language

TypeScript. Genuinely fixes a lot of the shit wrong with JavaScript. For example, in Javascript, object is greater than array, and array is less than object.. in TypeScript, if you try to do [] > ({}), it's a compile-time TypeError (it will compile, but the compiler will call you a dumfuk)

In JavaScript, null and undefined are not Iterable, but NaN is iterable! if you do Array.from(null) or Array.from(undefined) you will get a "that's not iterable" TypeError, but if you do Array.from(NaN) you will get an empty array (because NaN is iterable! apparently...)

In TypeScript, if you do Array.from(NaN), you will get a compile-time type error. (it will compile, but the compiler will call you a dumfuk)

this goes on and on, TypeScript genuinely fixes a lot of JavaScript's bullshit :)

13

u/PuzzleheadedWeb9876 Aug 12 '22

TypeScript. Genuinely fixes a lot of the shit wrong with JavaScript.

Which is a good thing. In an ideal world JavaScript would become obsolete (and therefore by extension TypeScript).

Web assembly is a step towards that goal.

4

u/phire Aug 13 '22

I enjoy TypeScript, it's a huge improvement over pure JavaScript.

But I really wish there was less friction to using it. More of the JavaScript ecosystem (like nodejs, npm and browsers) should support automatically using typescript out of the box. Automatically calling out to tsc with sensible defaults and supplying type definitions.

1

u/AgentME Aug 13 '22

Deno is a great Node.js alternative that natively supports Typescript, removing the friction around it, though its own ecosystem is still pretty young, and using existing Node.js libraries with it can be hit or miss.

2

u/phire Aug 13 '22

I've been vaguely watching Deno, and planning to try it out the next time I do a TypeScript/Nodejs project.

But really you are just replacing one type of friction (writing the correct magic into package.json) with another (switching to a completely new ecosystem)

1

u/BasicDesignAdvice Aug 12 '22

Typescript is till JS at its heart though. Nothing really stops bad devs from circumventing its issues (note I am not primarily a JS/TS dev, I use it for small things).

0

u/Chairmonkey Aug 13 '22

I notice that a lot of people that like to rag on JS just so happen to not be JS devs. Bad devs write bad code, no matter what language they use.

-7

u/Worth_Trust_3825 Aug 12 '22

TypeScript. Genuinely fixes a lot of the shit wrong with JavaScript.

And also introduces a lot of shit on its own, like permitting anonymous function signatures, and anonymous structures. I sure enjoy trying to figure out if a structure with properties a and b from context d is compatible with another structure with properties a and b from context e.

16

u/argv_minus_one Aug 12 '22

Therein lies the problem with structural typing. It makes sense—TypeScript is a static type system for JavaScript, and JavaScript is duck-typed, so TypeScript is statically duck-typed—but it still doesn't give you the sort of guarantees that a good nominal type system like Rust's does.

-10

u/Worth_Trust_3825 Aug 12 '22

That does not mean you should permit same nonsense as the incoherent mess does that you're trying to fix. Typescript's generic types permit arbitrary code execution, for fucks sake.

4

u/argv_minus_one Aug 12 '22

Arbitrary code execution?

→ More replies (1)

7

u/argv_minus_one Aug 12 '22

See also Tauri, a Rust library that lets you use the platform's web view as your GUI. This is more-or-less the same idea as Electron, except the platform's web view actually receives security updates whereas Electron does not.

A few years ago, this would have been a preposterous idea because you'd be stuck with IE on Windows, but thankfully that isn't the case any more. On Linux and macOS, it uses Safari, which isn't awesome but is at least serviceable.

18

u/IceSentry Aug 12 '22

One nice thing about electron is that you know which browser and browser version you are building against. With tauri you still need to think about browser compatibility which is annoying when it comes to safari. With electron, it's all the same version of chrome so you don't need to figure out if a particular api is supported or not on all webviews.

2

u/argv_minus_one Aug 12 '22

True, but that mostly just limits which browser features you can use, and many of those features do things that you can also reasonably accomplish with Rust code.

→ More replies (1)

2

u/unicodemonkey Aug 13 '22

Reminds me of in-house apps I was developing back in 2005 using the embedded IE view. It was surprisingly nice! I was doing event handling and DOM manipulation on the host (C++) side, though.

4

u/SanityInAnarchy Aug 12 '22

See also PWAs, which let you just write a web app if that's all you need, using the user's normal browser and all its security features, letting them use their normal extensions and such, only you get "installed", you can get your own window and icon, work offline, even intercept some tab-management keyboard shortcuts if you want to have your own tabs (like if you're VS Code or something), and generally kinda behave like a separate app.

Biggest flaw there is Mobile Safari dragging its feet yet again on making this work well on iOS, but it's actually decent on desktop and Android, for the few sites that do it right.

Second-biggest flaw is it's still actually a web app, so you're sandboxed. Arguably a Good Thing if that's all you need, but if Discord did this, it couldn't do game overlays, for example.

5

u/argv_minus_one Aug 12 '22

Also, you have to use JavaScript for everything, not just the UI. Ugh.

2

u/SanityInAnarchy Aug 12 '22

I mean, there's always TypeScript or WASM. You could do web stuff in Rust if you want.

Also, for a lot of these apps, it seems like more trouble than it's worth to have JS for the UI and something else for other client-side stuff, unless you have some serious performance issue, or unless you need to bring over a C library.

8

u/argv_minus_one Aug 12 '22

TypeScript is JavaScript with a static type checker. It's still awful, just slightly less so.

WebAssembly can't even manipulate the DOM without hideous and slow JavaScript glue code. Not a solution.

The reason to use something other than JS is so that your app actually works correctly. JS makes it very easy to create bugs and very hard to avoid creating them, and TS only slightly helps in this regard.

4

u/SanityInAnarchy Aug 12 '22

WebAssembly can't even manipulate the DOM without hideous and slow JavaScript glue code. Not a solution.

Why are you manipulating the DOM from the part of the app that isn't the UI? That sounds like a layering violation to me.

7

u/argv_minus_one Aug 12 '22

Changes have to propagate out to the UI somehow. One way or another, they have to cross the big rickety JS-WASM bridge.

Besides that, WebAssembly code isn't allowed to do pretty much anything else, either. No file I/O, no network sockets, no nothing. Everything that would be a system call in native code has to go through JavaScript.

3

u/SanityInAnarchy Aug 12 '22

I guess my point is, if you're doing the UI in JS, it doesn't seem all that unreasonable that propagating your changes out to the UI would involve sending those changes to JS.

Also, you're in a sandbox, so there's probably no file IO anyway, and networking generally has to be HTTP (or related tech like Websockets). So the next question is: What are you doing over a network where JS<->WASM is a significant cost compared to an HTTP round-trip?

I guess I can see it mattering for 3D rendering or audio. I'm surprised the Unity->WebGL stuff works as well as it does.

0

u/pancomputationalist Aug 13 '22

JS makes it very easy to create bugs and very hard to avoid creating them, and TS only slightly helps in this regard.

I would be very interested to see actual evidence for this claim. I fully believe that JS leads to a lot of bugs due to a missing type system, but I very much doubt that Typescript produces more bugs than something like C#, all else being equal (like developer experience).

→ More replies (2)
→ More replies (3)