Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve browser security #1

Closed
5 of 8 tasks
samuelmaddock opened this issue Sep 11, 2018 · 3 comments
Closed
5 of 8 tasks

Improve browser security #1

samuelmaddock opened this issue Sep 11, 2018 · 3 comments
Labels
help wanted Extra attention is needed

Comments

@samuelmaddock
Copy link
Owner

samuelmaddock commented Sep 11, 2018

Metastream is built using Muon, a fork of Electron for building secure browsers. Muon is being developed by Brave and will soon be abandoned in favor of their own Chromium fork.

While forking Chromium would be ideal for this project, I don't have the resources to do so. This leaves the option of switching back to using Electron.

Electron has recently made some good progress in keeping up-to-date with Chromium (electron/electron#13756) and improving sandboxing support (various). It will need to be evaluated if we can get the same level of security using Electron now, assuming they eventually catch up with Chromium.

One roadblock for using Electron is the lack of a Chrome Extensions API (electron/electron#1498). Metastream's media synchronization is built on top of Muon's extensions API, although it might be possible to implement using a preload script. This also means adding extensions like uBlock Origin would no longer be possible.


General

Update: https://blog.samuelmaddock.com/posts/google-widevine-blocked-my-browser/

Electron contributions roadmap

@samuelmaddock samuelmaddock added the help wanted Extra attention is needed label Sep 11, 2018
@samuelmaddock
Copy link
Owner Author

Electron 4.x.x is in beta now and is using the latest version of chromium (69).

The sandbox renderer doesn't have support for Chrome extensions at all while the normal renderer does. This functionality would need to be added to the sandboxed renderer. There would likely be less chrome.* APIs implemented then what's currently offered by Muon.

While Widevine CDM is supported by Electron, support for Widevine VMP is not—required by netflix, hulu, and more. See electron/electron#12427. castLabs has a fork of electron with support for this. I'd rather not have to rely on it though. I'm going to see if any effort has been made to merge efforts upstream (castlabs/electron-releases#24).

@samuelmaddock
Copy link
Owner Author

samuelmaddock commented Jan 1, 2019

Starting an effort to support Chrome Extensions in the sandboxed renderer of Electron.

Many Chrome APIs will still need to be implemented.

samuelmaddock added a commit that referenced this issue Feb 7, 2019
This is used to get around websites useragent sniffing to detect compatibility (#66). Hopefully this can be dropped when #1 is resolved.
@samuelmaddock
Copy link
Owner Author

Closing as this will be solved by the issue referenced above.

@samuelmaddock samuelmaddock unpinned this issue Apr 22, 2019
mhmdksh pushed a commit to mhmdksh/metastream-plus that referenced this issue Sep 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
help wanted Extra attention is needed
Projects
None yet
Development

No branches or pull requests

1 participant