Re:Updated Microsoft Store App Developer Agreement: New Reve...
by gpm on Wednesday March 06, 2019 @06:49PM
(#19324201)
In fact, while I may be mistaken, it looks to me like you are currently serving binaries vulnerable to the exploit linked, which is known to be being attacked in the wild.
Your package-lock.json references electron 3.1.3, which was released at the end of January, while that vulnerability was only patched Feb 27. I think (but you should check) that 3.1.5 includes the patch. Edit: It doesn't. The only way to get this patch seems to be to update to Electron 5.x.
Re:Updated Microsoft Store App Developer Agreement: New Reve...
by datastreamer on Thursday March 07, 2019 @03:54PM
(#19332290)
Yes.. I disclose this in the post that I linked to...
It's not even a disclosure. I don't claim it's because they're blocking electron apps as a blanket.
They aren't rejecting your code because you use Electron. They are rejecting your code because you use Electron to browse the web.
To see why this is a bad idea, one only has to look so far as the third post currently on the from page of HN: https://news.ycombinator.com/item?id=19321775 Do you think that microsoft can reasonably rely on this patch being promptly applied to all the electron apps in it's store?
Electron may primarily be developed by GitHub, a recent acquisition, but it is not well suited for this purpose.
You can see that this post is tricking other people in the replies to it, e.g. the one discussing slack, the first reaction of the microsoft employee that kindly replied, and the person who replied saying "I have a electron app in the microsoft store".