Skip to content

Proposal: Extremely dangerous mode #1110

Open
@GarboMuffin

Description

@GarboMuffin

Motivation:

  • some people want to use Node.js APIs in their projects
  • those people will inevitably make their own forks
  • if people want to do the horrible and insecure thing, is there value in giving them the least bad way of doing it?
    • we can ensure proper warnings and discouragement
    • they can still reliably get our security and feature updates

Proposed desktop editor changes:

  • command line flag like --i-will-not-ask-for-help-when-i-accidentally-install-malware will make editor window be started with nodeIntegration enabled
    • no GUI option; only command line flag
    • document in README.md after userscript section
    • precedent for reducing security via command line arguments exists via standard Chromium arguments --no-sandbox, --disable-gpu-sandbox, --disable-web-security
  • show non-skippable window each time this mode is used to make sure people who use this are aware of the risks
  • restrict availability to installs directly from our website, not app stores, to ensure compliance
  • update unsandboxed extension warning to describe actual risks

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions