Tauri vs. Electron

[mars-monkey]

I recently heard of an Electron alternative called Tauri.

Basically, it's faster, more lightweight, more secure, and uses native rendering engines on different platforms.

Have you guys looked at it all?

[SpacingBat3]

It seems very immature, not fully supporting needed web APIs for implementing a WebCord – for instance, I've noticed it lacks support for WebRTC on Linux. I've also found it lacks support of ARM platforms.

(...) native rendering engines (...)

I really hate this term – in fact, what does mean native rendering engines? This problem is especially visible on Linux, where there's not even a standard API or library to render and theme windows. It seems to use Webkit+GTK, which may or may not be native from user's desktop enviroment perspective – for instance, the end-user might prefer QT instead and QT-based browser engine would be more suited and native at this point. And both QT/KDE and GTK are not the only existing libraries on Linux, there're other, less popular ones. This is why I think this term is misleading, because while for many users it could be a true statement, others may argue it is not a native solution with the specific desktop configuration.

(...) more secure (...)

What makes browser more secure? I would argue that Tauri is more secure than any other Webkit-based or other native engine-based browser or application. And Rust does not protect from everything outside of its scope: Tauri's libraries and dependencies might not be focused on the security, neither written or based on Rust. It could also be said that Tauri itself is as secure as Rust protections are. And Electron is focused a lot on security (e.g. it has sandboxing, content isolation, complex process architecture to prevent unpriviledged scripts from accessing the system resources), probably more than even NW.js (EDIT: to not make it misleading: Tauri is not NW.js; I just put this in my comment as an example of software similar to Electron, but not taking care of the remote content on its own) is, since it is designed to work in local and remote environments. I may not be the security expert there through and I don't guarantee that Electron itself is fully secure – but I think most of its vulnerabilities would be dependant to Chromium security and the same is with Tauri.

[Pakrohk]

The numbers of the vulnerabilities doesn't necessarily say that given browser is unsafe – they just say how many of these were detected in the code and at least some work has been done to mitigate or fix them.

In fact, this proves the fact how browser popularity and their attractiveness helps to gain attention of the security researchers to take their time and participate in a bounty program.

Of course, I didn't said Chromium is more secure than any browser – I just want to say by that you can't measure the software security based on numbers of the vulnerabilities found by anyone (and there's probably no trustworthy way to measure security; I think we can however measure how given software tries to take care of the vulnerabilities or if there are any coding practises focused on limiting their existance). I saw the article similar to this one – except it were saying that Debian is the most unsafe distro based on the numbers of the vulnerabilities found in it, compared to other distros.

It's also funny to me see that Chromium vulnerabilities doesn't count at all (according to the article not mentioning at all they're using the same engines under the hood) to Edge or Opera vulnerabilities – like these were entirely different browser engines…

Unfortunately, most of the problems were related to the blink render engine, and again, unfortunately, most of its bugs have remained fixed for a long time (of course, there are bugs for the Chromium ecosystem that can be from its security team, such as extensions not being checked and exploits being activated even if you have not installed the extension).
Among other problems of electron is the abnormal consumption of resources when it does not need it, and this can be inherited from the blink system, maybe there is another reason that my knowledge is not enough to explain.

DIT: TL;DR your comment sweat_smile – I still don't agree that's what native software is. And from the users' perspective it matters which API your software uses – as an XFCE user myself, I prefer GTK software over QT and ideally I would love to not use QT at all. I'm pretty sure a lot of KDE users whose either can't find a GTK equivalent of their theme (or even it if exists it doesn't match the system look well) would prefer the QT software over GTK.

As I mentioned earlier, these two platforms are trying hard to integrate, for more information you can check out the links I am posting.
arch linux wiki : qt
Kvantum
Plasma GTK Config
Uniform look for Qt and GTK applications

Not sure what you mean by the mentioned security feature and what kind of signals do you mean… Could you make it more clean for me?

sandboxing

This problem can be solved, but the electron itself does not solve this problem.
While the default browser is firefox or the default system editor software is neovim, Discord sometimes opens links using wine on servers or uses notepad to edit files.
(In my opinion, Discord should only download files to the system instead of running them.)
To solve this problem, you need to change the links sent from Discord (the whole electronic ecosystem) in xdg-open.

As a side note, global hotkeys are something what portals don't implement right now (or at least from what I believe; maybe a PR implementing a portals for it got pulled, but that still means other software needs to prepare for it), so I believe there's no way for the hotkeys to be integrated that well as you would like on Wayland (I believe hotkeys still work when window is focused, like on X11). There's also no implementation on my side for global hotkeys at all, so I'm not sure what do you mean by that…

Just use pipewire to solve this problem, just like Obs_studio did to solve the screen recording problem.

I'm not a native English speaker neither my English is perfect by any means, so I don't think I have any rights to blame you for that.

It was not an insulting sentence, but I don't know why I felt so painful. 😿

[SpacingBat3]

Unfortunately, most of the problems were related to the blink render engine, and again, unfortunately, most of its bugs have remained fixed for a long time (of course, there are bugs for the Chromium ecosystem that can be from its security team, such as extensions not being checked and exploits being activated even if you have not installed the extension).
Among other problems of electron is the abnormal consumption of resources when it does not need it, and this can be inherited from the blink system, maybe there is another reason that my knowledge is not enough to explain.

Chromium is somewhat resource-hungry and well-performant at the same time. While on X86 either the perfomance difference doesn't matter or graphics drivers and cards are advanced enought to work even faster on non-Chromium engines, this is not the case for ARM boards. There's a visible difference between Chromium and any other browser I've tested (Firefox/Gecko, Falkon/WebKit) is not performant enough to stand any kind of the competition IMO. Of course, things could improve as I didn't check the performance for quite a long time, but knowing boards like RPi has even the optimized builds of Chromium, I doubt anything is different.

As I mentioned earlier, these two platforms are trying hard to integrate, for more information you can check out the links I am posting.
arch linux wiki : qt
Kvantum
Plasma GTK Config
Uniform look for Qt and GTK applications

For me, no matter if I use Kvantum variant of my theme, QT still doesn't fit well GTK applications IMO. If I had a chance to, I would just simply avoid QT software on GTK distros, ideally avoiding that additional set of libraries that I have to install.

sandboxing

This problem can be solved, but the electron itself does not solve this problem.
While the default browser is firefox or the default system editor software is neovim, Discord sometimes opens links using wine on servers or uses notepad to edit files.
(In my opinion, Discord should only download files to the system instead of running them.)
To solve this problem, you need to change the links sent from Discord (the whole electronic ecosystem) in xdg-open.

Looks like not an issue with the Electron by itself, for me it works exactly as intended. I'm pretty sure it has to do with XDG spec compilance of your distro, which a lot of software actually follows. Simply, if xdg-open does open an incorrect app, I think something's not right with your OS configuration. At least the issue you mention doesn't happen to me – maybe it happened once with another software (non-Electron based), but with the correct configuration everything seems to work as it should be. Moreover, as I said, Electron still uses GTK (unlike to Chrome) for stuff like dialogs (even there's a support for about panel) and it also achieves good Linux integration (even with Wayland) by using portals in modern versions (I've heard it wasn't like that before, not sure through).

And with sandboxing I reffered that Node APIs aren't leaked to the renderer processes. This is currently achieved by multiple techniques, including the multi process architecture in the Chromium itself. Some frameworks like NW.js doesn't actually care about the remote content safety, in which case all loaded remote scripts would have an access to the sensitive APIs allowing to mess with files which itself complicates developing a web applications.

Just use pipewire to solve this problem, just like Obs_studio did to solve the screen recording problem.

WebCord already uses PipeWire for the screen recording under Wayland, using the portals meant for that purpose. Could you please explain me a bit further how that would affect the keybinds issue?

It was not an insulting sentence, but I don't know why I felt so painful. 😿

It wasn't meant to insult anyone, I just wanted to stay neutral (it is not my job to check for the grammar errors in someone else's comments) and say that I also do grammar errors. While the right grammar and using more official forms makes easier for me to just read them, I won't blame anyone doing mistakes or writting their comments without strictly following all language rules. We are all humans, after all 😉.

I've also didn't want to rate your comment in matter of English, I don't want to do it, because… just not. I don't think your English is terrible, I saw much worse sentences posted on the internet (from my point of view as a non-native language speaker; they were in most cases intentionally written like that and other than making it harder to read for me and I would just preffer the forms I know and can understood, I don't blame anyone for writting like that), I just think my opinion about grammar wouldn't be enough trustworthy. I can also imagine how the world would be worse if we would rate everyone's sentences – it's OK to correct someone if he made a typo in order to help this person to improve, but telling someone's English is just terrible based on one or two comments or even arguing that he shouldn't chat in English at all on the Internet (I saw somewhere a few comments like that) sounds just like an insult.

Hope you find my comment less like an insult after that explaination 🙂.

[SpacingBat3]

Also, no matter of any argumentation about Tauri, there's still one issue that seem to disqualify it as for now for making a Discord client on it:

I've noticed it lacks support for WebRTC on Linux.

Without WebRTC, stuff like screen sharing or even connecting to voice channels might not work.

[Pakrohk]

WebCord already uses PipeWire for the screen recording under Wayland, using the portals meant for that purpose. Could you please explain me a bit further how that would affect the keybinds issue?

Pipewire is available throughout the system, webcord should mute the microphone via pipewire instead of muting internal audio, or define hotkeys for pipewire.

For me, no matter if I use Kvantum variant of my theme, QT still doesn't fit well GTK applications IMO. If I had a chance to, I would just simply avoid QT software on GTK distros, ideally avoiding that additional set of libraries that I have to install.

Maybe your point of view is correct for (WebCord), but I personally see softwares that are built hundreds of times better with the help of qt or rust/gtk.
Against the heavy and uncoordinated outputs of electron, these software are really better and more compatible with the system.
Of course, if it is developed like Telegram, it is garbage in every sense, I mean development with GNU/Linux desktop standard.

It wasn't meant to insult anyone, I just wanted to stay neutral (it is not my job to check for the grammar errors in someone else's comments) and say that I also do grammar errors. While the right grammar and using more official forms makes easier for me to just read them, I won't blame anyone doing mistakes or writting their comments without strictly following all language rules. We are all humans, after all wink.

I've also didn't want to rate your comment in matter of English, I don't want to do it, because… just not. I don't think your English is terrible, I saw much worse sentences posted on the internet (from my point of view as a non-native language speaker; they were in most cases intentionally written like that and other than making it harder to read for me and I would just preffer the forms I know and can understood, I don't blame anyone for writting like that), I just think my opinion about grammar wouldn't be enough trustworthy. I can also imagine how the world would be worse if we would rate everyone's sentences – it's OK to correct someone if he made a typo in order to help this person to improve, but telling someone's English is just terrible based on one or two comments or even arguing that he shouldn't chat in English at all on the Internet (I saw somewhere a few comments like that) sounds just like an insult.

Hope you find my comment less like an insult after that explaination slightly_smiling_face.

Brother, you are dear to our heart. ❤️
You didn't have to explain, I was just joking 😄

Without WebRTC, stuff like screen sharing or even connecting to voice channels might not work.

Bro, this is really scary.

[SpacingBat3]

Pipewire is available throughout the system, webcord should mute the microphone via pipewire instead of muting internal audio, or define hotkeys for pipewire.

I don't think so, no integration like that is probably going to be made by any browser. However, if you want to mute the microphone, why won't you setup a keybind outside of the Discord/WebCord? It would work in another software as well.

The only thing I might work on is the global push-to-talk, which on Wayland is going to be harder to achieve since the API for that is quite fresh (I'm not even sure it made to stable version of any portals implementation) and it is unlikely Electron has prepared anything for it (Wayland is still immature, many browsers actually does not fully integrate with it; outside of Chromium-based browsers, Firefox/Gecko is another example). However, it will definitely work on X11 and other platforms.

Maybe your point of view is correct for (WebCord), but I personally see softwares that are built hundreds of times better with the help of qt or rust/gtk.

It runs better when it fully uses QT and GTK. For WebCord, that's never going to be a thing, as I don't want to use Discord API (for obvious reasons), but wrap web content instead. That's why I still have to use any web browser and Chromium is quite fast in terms of CPU/GPU utilization, especially on ARM (which was WebCord previously focused on). Maybe it does utilize much of the memory, yet many declare WebCord still uses it much less, but that could be as it actually is less complex and it is something that might vary on each new functionality added.

Against the heavy and uncoordinated outputs of electron, these software are really better and more compatible with the system.

Electron is still evolving in terms of Linux support. Seeing how it greatly improved in terms of Wayland support (i.e. they fixed a lot of bugs), I would expect many useful changes in the future.

Bro, this is really scary.

Yeah, Discord seem to use WebRTC everywhere in terms of audio/video share (and it makes sense, since this API is designed for that purpose; at least in terms of web browsers). Even Discord's official client uses a closed-source module specifically designed for their server architecture (unlike generic, open-source Chromium implementation), which is the reason why WebCord is unable to achieve some of the Discord features. Lack of WebRTC would basically mean you can't either join or participate in voice channels. So as long as Tauri won't fully support WebRTC or lack some features implemented in Chromium/Electron, I don't think there's even a point in migrating to it, at least in terms of creating a Discord client.

As of the audio share, I think lack of the support on Chromium side is mostly due to lack of standardized way of doing that. WebRTC specs also don't expect audio support while recording the screen or application (AFAIK it is optional on browser side, not sure if even web applications are meant to prepare for it to occur), so that's most likely a reason why many browser engines just ignore to deal with it or partially implements it (i.e. they mostly care about recording the tab audio, since that doesn't require to take care of integration with all OSes).