Untitled attachment

Notices where this attachment appears

1. Embed this notice
   srslypascal (srslypascal@chaos.social)'s status on Friday, 27-Oct-2023 18:17:05 JST srslypascal

   in reply to

   @adulau

   They should just get rid altogether of the liability/technical debt that is Electron.

   As of signal-desktop 6.36.0, they still use Electron 25.8.4, which is affected by at least 8 different security issues according to the release notes of Electron 25.9.0 through 25.9.3.

   https://github.com/signalapp/Signal-Desktop/blob/v6.36.0/package.json#L275

   And on top of all of these issues, there remains the issue of the disabled sandbox, which they haven't bothered to fix in over 4 years.

   https://github.com/signalapp/Signal-Desktop/issues/3573