Hacker News Reader

Enabling contextIsolation was a lot of work, and required a re-working our native modules (around voice and video) while still maintaining performance.

Getting everything to work in a context isolated world was a many month effort, which had begun long before this bug was reported to our team.

(The majority of this code was written before context isolation even existed :P)

View on HN

It'd be super interesting to hear more about the performance implications of contextIsolation; as an attacker, an intuition for _why_ developers select less-hardened options is quite useful in prioritizing targets.

Once rearchitected there was negligible performance hit. But context bridge etc... basically requires cloning all objects that need to be passed to the renderer/browser window from another context (the native module). If your message passing is frequent and objects are large this can have an adverse impact to performance.

Our video rendering implementation needed to copy frame buffers to the renderer. Doing this over context bridge would have been quite expensive.

A more ideal approach which the team is working on keeps the buffers on the GPU - which should solve all the performance woes and more.

More on this here: https://www.electronjs.org/docs/api/context-bridge

Reply on news.ycombinator.com