Hacker News Reader

Comment by WorldMaker | Hacker News Reader

But that's an Apple problem, not a "you" problem in that case. In Electron the security burden for tracking Chromium CVEs and sending updates out is entirely yours, whereas with Tauri you outsource it. In Electron, Chromium CVEs are your CVEs. In Tauri, Safari CVEs remain Apple's CVEs and technically entirely outside the scope of your application bundle. The trade-off for "old macOS webviews" is that it's not your problem other than general, basic old pre-Chromium hegemony HTML kindness of building web apps that gracefully fail if features aren't available, which is probably what you should do anyway?

View on HN

Your users don't care whose fault it is. Your app isn't working. You can choose to cut those users off, and that's totally an option...sometimes.

Mac users are probably a little more tolerant of this than non-Mac users, because of the general upgrade treadmill, but whether you can get away with it is a question only you can answer for your app.

That's still a very different class of problem from a CVE break of a single-point-of-failure is the point. Someone decides to use your Electron app's old Chromium build and a known CVE in it as a target vector for infecting or remote controlling user's machines is a very different problem from "because we are using system webviews this small CSS/JS feature doesn't work in this version of macOS, please upgrade". Even if the user rightfully blames you the app developer for both issues and doesn't allow you to point fingers upstream, one is a severe security threat that can destroy entire brands and the other is "mere tarnish" on a brand. (I know which class of problem I'd rather deal with, given the choice here.)

It depends though, yeah? Like, at least then you can issue a patch. If a CVE sprouts up on an old version of an OS, you're pretty hosed.

This actually makes me think Electron will be a lot easier to support. Because at least you'd be able to control which version of Chromium your app ships with. If you're using Tauri, you'll need to support all the different versions of WebView that are out there.

Reply on news.ycombinator.com