Hacker News Reader

Comment by ynniv | Hacker News Reader

I don't think this puts enough emphasis on the fact that it is a local client and not a web service. I see some people here griping about Electron, but the privacy implications of being a local app are way more important than the performance of the framework used.

View on HN

Seems to be a proprietary application so app privacy went out the window already.

Privacy is a spectrum. You can choose to be at one end of it, but not everyone shares your opinion. As a local app your data has a different legal status, and you actually have a lot of control over the execution compared to a web service. For instance, with outgoing firewall rules you could ensure that this is only talking to your email server.

You can audit the code of every Electron app, so why are you acting like it's full of spyware that you'll never be able to have privacy with?

Ever heard of minimized JavaScript[0]?

[0]: https://github.com/google/closure-compiler

Minified js isn't particularly hard to reverse engineer compared to tools that are geared towards actual obfuscation, and regardless, you don't even need to look at the code if all you care about is privacy. A look at the dev console's network tab should tell you all you need to know.

I've done obfuscated Javascript on a CTF. Only a few hundred lines and I can tell you, it's way easier to just write it new from scratch, especially if you have a product that you like and can just copy.

I’ve reversed and broken real-life products written in JS, Java, WebAssembly and native code.

Minified JS and obfuscated Java (DexGuard or ProGuard) are almost identical in complexity, you can restore the actual datatypes still, and you can even restore the rough outlines of where control structures were.

Obfuscated WebAssembly, NaCl or native code is much worse to work with, and often data structures and control structures are gone entirely.

I'd be very interested about your findings decompiling wasm. Do you have a blog, by chance?

From parent's HN profile:

Janne Koschinski, CompSci student. https://github.com/justJanne

Current maintainer of QuasselDroid https://quasseldroid.info/ https://github.com/sandsmark/QuasselDroid

I don’t maintain a blog currently, sorry. And if I had one I doubt I’d be able to write interesting articles about this topic.

Generally I share such info on IRC, and then it gets just forgotten over time.

It's still better than it would be if it was a normal web app hosted on his server.

Or, at least, it has the potential to be better.

I agree with you. The discussion has somewhat de-railed off-topic into a discussion about Electron. While that is an interesting discussion, it is pretty off-topic.

Is it off topic though? This is HN after all.

My partner actually has the opposite pain-point:

She wants an e-mail client that stores attachments remotely, only downloading them as requested by by the client. Is there an e-mail service that does things this way?

Apple Mail has this as a setting, works with any IMAP provider.

Can't Thunderbird do that? I'd imagine most IMAP clients do this.

This is what Ivelope is currently doing :) However there will be a setting for people who want to download all attachments as well.

That’s a setting in outlook

Compared to web-based clients. But the best email client (MailMate) is already local.

Reply on news.ycombinator.com