They're trying to expose IPC to the renderer in an unsafe way. See their discussion on this GH issue https://github.com/electron/electron/issues/21437 (referenced from the main readme as blocking some features they want to implement)
On their "building a secure app" page they complain about Electron's quick release cadence https://github.com/reZach/secure-electron-template/blob/mast...
> The trouble that I've found with electron, is that their release schedule is crazy, with only a few months before each major release. We know that electron is a young framework, but it is hard to keep up so quickly!
Electron releases quickly to pull in critical upstream security fixed from chromium.
That reasoning is explained pretty thoroughly in the best practices documentation https://electronjs.org/docs/tutorial/security#17-use-a-curre...
I haven't looked at their implementations of the other security best practices, so these might be the only red flags, but I'd still recommend against just blindly copying the template without understanding and verifying the best practices they're attempting to implement.
Thank you for your feedback. This template has not yet been reviewed but I hope to get candid feedback like yours on spots that may have been missed.
I am planning to change the way the IPC renderer is exposed; Marshall from the Electron team pointed me to a better way of doing so and I hadn't had time to update the repo yet. That will be something I update soon in the code and in the docs.
The best practices I take from Electron themselves; https://electronjs.org/docs/tutorial/security. If there are other security reports please send them to me and the template can be enhanced further.
I just did, the repo is now MIT. Enjoy!
Thank you, I will read up on this!
It is an electron-like framework written in Rust, and is designed to be as lightweight as possible.
Is now MIT licensed. I realized after you said GPL that this isn't what I wanted for the repo!
Yes, it is quite possible to do that. One of my down the road goals is to add light obfuscation to the source code upon packaging. If anyone is motivated, they can break into _any_ source code and repackage.
I'd also like to add some form of checksumming, but again if they have access to the source code they can change anything they want to.
I guess my preferred solution for be for Electron to find a way to put the ASAR inside the main binary and find it there and then codesign that, I'm not sure why it hasn't happened yet AFAIK.
Note that I'm saying "Electron validating the signature" - not web app doing that, which I assume what you meant by "hand-rolling".
Yes, it is still possible — https://github.com/electron/asar
That's on my roadmap! Do you have ideas on how a testsuite for that might work? I am open to suggestions.
On a lighter note :
> Feature #1
> Only load secure content - (Need help!)
What kind of help? For this template project ?!
Yes, I need help as I wasn't able to test the security recommendation. I found some snippets but they didn't work when I tested locally.