Yeah, because remote code exploits are particularly an issue with Electron, as opposed an order of magnitude less likely to happen with it compared to native code.

Basically you got it completely backwards. The typical native app (which is not Rust or Java but C/C++/Obj-C, etc) only keeps the unsafe part of Electron, and even drops the sandbox (whose holes can always be patched, but total absense cannot).

Complexity leads to RCEs like the one in TFA, not “unsafe” languages.

It is very disingenuous to say that other native apps keep the unsafe parts; there are no such parts at all.

It should be telling that Microsoft, in one of their most successful products of late, have punched an RCE sized hole in that sandbox unwittingly.

Don't use Teams app, but connect through browser instead... that is if there is no other way to avoid Teams, because you're company has already migrated from Slack.

Correct me if I’m wrong but the XSS stuff still works then. Having all your Office 365 data stolen may be a problem.

Bang our heads on the wall at the appropriate angle. It's only our fault if we get hurt, we must learn to properly use the tools we have

I bang my head against a wall everyday for a living.

Avoid Microsoft for stuff that is important, and don't install their software on your machines if you can help it.

Yeah, because other companies or FOSS have a better track record.

E.g. we can drop Exchange for email for a safe alternative like Sendmail.

Or wuftpd. I once accidentally dropped my keyboard, and it turned out that the keypresses that generated were a remote root exploit for wuftpd.

What are the chances of that happening, that's pretty neat!

Eh, at first I thought so too, but then it turned out my neighbours nan once accidentally hacked the US Navy that way, so after that I didn't feel all that special any more :(

Hehe, that's hilarious.

With wuftpd? P(x)=1

Maybe I’m in a filter bubble, but I’ve never heard of anyone else assigning such low priority to exploits like this.

Yes, Google has a better track record. You brought open source and - totally unrelated - sendmail into it.

>Yes, Google has a better track record.

Do they? This is just from last month: https://www.zdnet.com/article/google-patches-second-chrome-z...

>You brought open source and - totally unrelated - sendmail into it.

No, you brought the totally unrelated "Avoid Microsoft for stuff that is important, and don't install their software on your machines if you can help it." as if Microsoft is the only place to ever had a RCE...

That's Chrome, not meet.

As for bringing in unrelated stuff, no that was still within the context of Microsoft's meeting software. It was someone else that brought in the OS.

Reminds me of the old joke: VirusScanner: We found a virus on your machine called Windows. You you like to remove it?

Starting by anything running on top of Electron.

Especially if said machines are actually built by Microsoft.

In which case they may be nice enough to block some of their software for you https://www.techrepublic.com/article/microsoft-blocks-major-...