[bobblywobbles]

> #6 - Security "Tauri is very secure by default, on the other hand I can't say the same about Electron... With Electron you have full access to Node APIs, so a hacker could easily exploit the very powerful Node APIs."

It's fair to believe this, given there's so much material out on the web affirming the fact. I've written about this at length in other places; applications with Electron pre version 5 [0] (released April 2019) were not secure. It's entirely possible and easy to build a secure Electron app today. I started building a secure app Electron template in 2020 [1] (that I still maintain) to address this security issue. I've also written about a history of the framework [2] and steps to build your own Electron app with today's best practices [3].

[0] - https://github.com/electron/electron/releases/tag/v5.0.0 [1] - https://github.com/reZach/secure-electron-template [2] - https://www.debugandrelease.com/the-ultimate-electron-guide/ [3] - https://www.debugandrelease.com/creating-a-simple-electron-a...

[atwood22]

It's _possible_ to build a secure Electron app, but it's also very easy to build an insecure Electron app. Even if you follow best practices regarding context isolation, it's very easy to introduce a subtle security issue like

    contextBridge.exposeInMainWorld('myAPI', {
      send: ipcRenderer.send
    })

[frutiger]

This is a weird claim anyway.

If you're loading first-party content into the view, then it's no less secure than running, e.g. a Node.js script (or Python, Ruby, C++ program, Rust program, etc.) as the current user. A program you downloaded being able to do things it's supposed to do is generally a feature, not a bug.

If you are loading third-party content, then sure, it's a completely different ball game.