Hacker News Reader

Comment by lukevp | Hacker News Reader

Why does discord even let users access dev tools? This is trivially easy to disable in prod builds. Seems odd. Is there a valid use case?

View on HN

> Why does discord even let users access dev tools? This is trivially easy to disable in prod builds.

Even if you disable the usual way to pop the dev tools open in desktop electron mode, this is a dangerous attitude. A malicious client can always edit the DOM, send arbitrary data to your server, read whatever you send back, etc. "Disabling the dev tools" is never the correct solution to any security problem.

I didn’t say that they should do this for security of the execution environment of the code, I’m not sure how you got to that interpretation. The GP said that there is output to tell users not to compromise themselves by blindly pasting unsafe code, which is easily prevented by disabling dev tools altogether, and there is no reason for an end user to have access to dev tools in an electron app. The other replies are probably what the GP meant and were related to the web version of discord.

> there is output to tell users not to compromise themselves by blindly pasting unsafe code

For reference: https://user-images.githubusercontent.com/47160230/51995729-...

This is also present in the Electron version of Discord.

> there is no reason for an end user to have access to dev tools in an electron app.

Certainly there is - there are various user-made applications that take advantage of Discord being built on Electron to allow you to write your own custom styles and scripts.

I assume the parent is referring to the web version, where a big warning is output on the console of the browser’s built-in dev tools. I don’t know of any way for a website to disable the browser’s dev tools.

Makes sense, forgot there was a web client. Thanks!

Many products show this warning e.g. Google Photos, Facebook.

Reply on news.ycombinator.com