Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposal: Extremely dangerous mode #1110

Open
GarboMuffin opened this issue Jan 13, 2025 · 1 comment
Open

Proposal: Extremely dangerous mode #1110

GarboMuffin opened this issue Jan 13, 2025 · 1 comment
Labels
enhancement New feature or request

Comments

@GarboMuffin
Copy link
Member

GarboMuffin commented Jan 13, 2025

Motivation:

  • some people want to use Node.js APIs in their projects
  • those people will inevitably make their own forks
  • if people want to do the horrible and insecure thing, is there value in giving them the least bad way of doing it?
    • we can ensure proper warnings and discouragement
    • they can still reliably get our security and feature updates

Proposed desktop editor changes:

  • command line flag like --i-will-not-ask-for-help-when-i-accidentally-install-malware will make editor window be started with nodeIntegration enabled
    • no GUI option; only command line flag
    • document in README.md after userscript section
    • precedent for reducing security via command line arguments exists via standard Chromium arguments --no-sandbox, --disable-gpu-sandbox, --disable-web-security
  • show non-skippable window each time this mode is used to make sure people who use this are aware of the risks
  • restrict availability to installs directly from our website, not app stores, to ensure compliance
  • update unsandboxed extension warning to describe actual risks
@Bungerdev
Copy link

:)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants