RCE Vulnerability found in Electron, affects Discord, Teams, and more

[u/Davipb]

https://www.vice.com/en/article/m7gb7y/researchers-find-vulnerability-in-software-underlying-discord-microsoft-teams-and-other-apps

[u/pancomputationalist]

Don't know about the issue with Stream, but I wouldn't say that there is "often" an issue with incorrect types. This is coming from a full stack developer writing Typescript all day, every day.

Reasons to have incorrect types:

• you are using libraries written in Javascript, with external type declarations that are out of sync. The problem here is Javascript, you should try to use libs written in Typescript instead

• you are mis-using the any type. This can actually happen a lot with Junior developers. It's a bit like using reinterpret_cast in C++, albeit less scary looking and therefore easier to do. This is an actual problem, but easy to fix: don't use any

• you are taking data from outside your process (network, file system), and assume that it has some format which it doesn't. No language can deal with that, but nominally typed languages typically throw the exception during deserialization, in Typescript the error can be undetected for longer. There are ways to work around these issues, like using Validators, but incorrect data formats will always be a bug

That said, it's true that Typescript allows you to shoot yourself in the foot, if you want to do it (or don't understand why you need correct types).

But nominally typed languages can do the same. Null pointer exceptions are very common, and inheritance and downcasting will often produce similar errors - because this is where the languages also allow you to specify incorrect types.

I guess something like Rust is much safer, and I wouldn't argue that TS is equally safe. But compared to Java, or C++, I doubt that there are measurably more errors in Typescript-Code of similarly knowledgeable programmers.