You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
some people want to use Node.js APIs in their projects
those people will inevitably make their own forks
if people want to do the horrible and insecure thing, is there value in giving them the least bad way of doing it?
we can ensure proper warnings and discouragement
they can still reliably get our security and feature updates
Proposed desktop editor changes:
command line flag like --i-will-not-ask-for-help-when-i-accidentally-install-malware will make editor window be started with nodeIntegration enabled
no GUI option; only command line flag
document in README.md after userscript section
precedent for reducing security via command line arguments exists via standard Chromium arguments --no-sandbox, --disable-gpu-sandbox, --disable-web-security
show non-skippable window each time this mode is used to make sure people who use this are aware of the risks
restrict availability to installs directly from our website, not app stores, to ensure compliance
update unsandboxed extension warning to describe actual risks
The text was updated successfully, but these errors were encountered:
Motivation:
Proposed desktop editor changes:
--i-will-not-ask-for-help-when-i-accidentally-install-malware
will make editor window be started with nodeIntegration enabled--no-sandbox
,--disable-gpu-sandbox
,--disable-web-security
The text was updated successfully, but these errors were encountered: