Using ancient Electron; doesn't support new, supported Electron

[RossSmyth]

I'm attempting to package Audiomoth utilities in Nixpkgs so that I can easily use them, but it is:

1. The Appimage uses Electron 25, this is ancient and I would NOT ever trust this to touch the network like the firmware tool does
2. Doesn't support newer versions

It just fails to run, electron complains about not being able to find audiomoth-hid

[pcprince]

Hi Scott,

We're aware the app uses an old version of Electron. Our hands are somewhat tied. We have a large number of users still running the application on old Linux distributions. When we've tried bringing the Electron version up to date in the past it ends up breaking it for these older distributions (which are technically not end of life yet). Rather than abandon these users we've been attempting to support both them and more up to date users by testing the application on modern distros as well. As far as we were aware it was still running on more up to date operating systems.

As for the security concerns, the Flash App is simply downloading .bin files from this releases page. You can manually download the required firmware version from there and use the local file flash option instead.

[RossSmyth]

What distros are using ancient, known broken Electron? There are several issues at play here:

1. How are they breaking if you are distributing an appimage?
2. If they are building them on their machines, again how are they breaking? npm downloads Electron for you if you build it your self.
3. Why are you letting some people using known insecure versions with many known exploitable CVEs make it worse for everyone else? Tell them to use the AppImage. I'm not sure how them running an old distro makes this any better.
4. Without a lock file the latest versions of all dependencies are downloaded. This is by far the most common way for npm supply chain attacks (there have been a lot recently), and they will target ancient, insecure versions of Electron.

I am a distro maintainer for Nixpkgs and was attempting to package this our repo. As it is this is impossible because the oldest Electron we support is version 40 because we will not let our users use insecure versions.

This is not something to shrug your shoulders at when npm attacks are so common. Many companies and people ship Electron apps to thousands of people every day, and they use secure versions. There is nothing particularly special about this software that makes it an exception, nor are the users who complained.

Also, who's Scott?

[RossSmyth]

Just saying to use the local flashing feature is missing the point.

[pcprince]

Apologies Ross, I mistyped there.

We'll look into updating the dependencies after the immediate next release.