Search code examples
electrondesktop-application

Is Electron a Reliable Framework for Enterprise Apps?


We can see good applications (such as Slack and Insomnia) going to Electron, but there is safety/stable enough to build an big solution (such as an ERP) with that? Thanks.


Solution

  • As far as stability goes, Electron is very stable. In my experience I've had no stability issues or unanticipated behavior while developing some complex software on Electron.

    However a bigger concern for some is security. Allow me to explain.

    How Electron Packages Applications

    Electron packages applications by bundling all of their javascript components into an asar.

    Asar is a simple extensive archive format, it works like tar that concatenates all files together without compression, while having random access support.

    Why This is a Security Concern

    What this means is that all of your applications code is just put into an archive. This archive can be explored and extracted using the asar command quite trivially.

    npm install asar
    asar extract my-app.asar
    

    While this may not be an issue for open source projects or applications like Slack which rely on a backend paid service, license based or paid products could be easily stolen as there is no code security / obscurity that a traditional compiled application might offer. For some, this may be acceptable, for others it may not. Especially if business logic occurs in the application.

    Can This Issue be Mitigated?

    One potential solution to this issue would be the ability to encrypt the ASAR. This issue has been brought up to the Electron devs, but they have stated that while they are open to a pull request they will likely not be implementing it themselves.

    Another possible technique to mitigate this issue is code obfuscation using something such as UglifyJS. However this is obviously not true protection, just a hiding technique.

    A third solution, one used by NW.js is to compile your JS to a V8 snapshot. However the Electron devs have indicated that this has significant (50%) performance costs and they will likely not support such capability.

    All of this being said, it is possible to decompile / reverse engineer almost any application in any language. Electron just makes it a little easier to do so by "putting your code out there." However they have strong reasoning for doing so (performance gains) and unless you have a paid license product it probably doesn't make much difference to you anyways.

    Further reading: