Electron considered harmful
-
For the second time in less than a week, users of the popular end-to-end encrypted Signal messaging app have to update their desktop applications once again to patch another severe code injection vulnerability.
Discovered Monday by the same team of security researchers, the newly discovered vulnerability poses the same threat as the previous one, allowing remote attackers to inject malicious code on the recipients' Signal desktop app just by sending them a message—without requiring any user interaction.
I used to recommend Signal. That Chrome App client wasn't exactly my taste but Chrome isn't the worst platform either. Electron? Oh fuck off. That makes Bruce Schneier's recommendation of WhatsApp downright palatable.
