Hacker News Reader

Comment by kitsunesoba | Hacker News Reader

The downside of that control though is an application that's arguably a little too specifically targeted — it's understandable wanting to target the same engine but if your app breaks with different but reasonably recent versions of chromium I would say it's too brittle.

It also widens attack vectors considerably when your entire userbase is all on the same probably-outdated build of electron-bundled chromium.

View on HN

System webviews on macOS aren’t updated after a certain point, so Tauri is not necessarily always a win re: your final point.

But that's an Apple problem, not a "you" problem in that case. In Electron the security burden for tracking Chromium CVEs and sending updates out is entirely yours, whereas with Tauri you outsource it. In Electron, Chromium CVEs are your CVEs. In Tauri, Safari CVEs remain Apple's CVEs and technically entirely outside the scope of your application bundle. The trade-off for "old macOS webviews" is that it's not your problem other than general, basic old pre-Chromium hegemony HTML kindness of building web apps that gracefully fail if features aren't available, which is probably what you should do anyway?

Your users don't care whose fault it is. Your app isn't working. You can choose to cut those users off, and that's totally an option...sometimes.

Mac users are probably a little more tolerant of this than non-Mac users, because of the general upgrade treadmill, but whether you can get away with it is a question only you can answer for your app.

That's still a very different class of problem from a CVE break of a single-point-of-failure is the point. Someone decides to use your Electron app's old Chromium build and a known CVE in it as a target vector for infecting or remote controlling user's machines is a very different problem from "because we are using system webviews this small CSS/JS feature doesn't work in this version of macOS, please upgrade". Even if the user rightfully blames you the app developer for both issues and doesn't allow you to point fingers upstream, one is a severe security threat that can destroy entire brands and the other is "mere tarnish" on a brand. (I know which class of problem I'd rather deal with, given the choice here.)

It depends though, yeah? Like, at least then you can issue a patch. If a CVE sprouts up on an old version of an OS, you're pretty hosed.

This actually makes me think Electron will be a lot easier to support. Because at least you'd be able to control which version of Chromium your app ships with. If you're using Tauri, you'll need to support all the different versions of WebView that are out there.

Reply on news.ycombinator.com