search

zulip / zulip-desktop

Zulip Desktop client for Mac, Windows and Linux.
https://zulip.com/apps
Apache License 2.0
847 stars 429 forks source link

Remove uses of the electron.remote module #915

Open andersk opened 4 years ago

andersk commented 4 years ago

The Electron security documentation recommends disabling the remote module for improved sandboxing, and it also has a number of performance and reliability problems. We should stop using it. This may require some rethinking of how our logic is split between the main process and the renderer processes.

abhigyank commented 4 years ago

Electron has released a separate remote module, which is a replacement for the built-in remote module in Electron. It does still recommend to use ipc methods instead, in its readme. So what do you propose would be good for us to do here?

manavmehta commented 4 years ago

@abhigyank from what I can comprehend, it is still available to use but not recommended. IPC primitives (ipcRenderer and ipcMain) are. Earlier, it was supposed to be moved to userland.

timabbott commented 4 years ago

I would guess they're moving it to a separate module so that they can delete it from electron core because a lot of use of it can result in security problems. Since use of this module doesn't seem important to the design of Zulip, we should just figure out how to remove use of it from the codebase.