Hacker News Reader

Comment by zaroth | Hacker News Reader

Every time I’ve looked at using Electron I’ve tried to figure out if it can be made secure from RCE in the face of XSS (which is inevitable).

Discord didn’t set contextIsolation to true. Why? No idea. Would it have been enough if they did? No idea.

View on HN

Enabling contextIsolation was a lot of work, and required a re-working our native modules (around voice and video) while still maintaining performance.

Getting everything to work in a context isolated world was a many month effort, which had begun long before this bug was reported to our team.

(The majority of this code was written before context isolation even existed :P)

It'd be super interesting to hear more about the performance implications of contextIsolation; as an attacker, an intuition for _why_ developers select less-hardened options is quite useful in prioritizing targets.

Once rearchitected there was negligible performance hit. But context bridge etc... basically requires cloning all objects that need to be passed to the renderer/browser window from another context (the native module). If your message passing is frequent and objects are large this can have an adverse impact to performance.

Our video rendering implementation needed to copy frame buffers to the renderer. Doing this over context bridge would have been quite expensive.

A more ideal approach which the team is working on keeps the buffers on the GPU - which should solve all the performance woes and more.

More on this here: https://www.electronjs.org/docs/api/context-bridge

why is XSS inevitable? I've made plenty of Electron apps that don't connect to the net and or don't display any user data. I still chose electron because it was easy to use and let me be cross platform with effectively zero effort

Reply on news.ycombinator.com