Remove Fluent Reader

[redoomed1]

Why should this tool be removed?

Fluent Reader’s last commit was on October 15th, 2023, more than a year ago. That in itself is not the reason I am proposing for its removal.

According to Fluent Reader’s GitHub README, one of the app’s dependencies is Electron. One of Fluent Reader’s last commits involved updating the app’s Electron version to v27.0.0 to fix a critical vulnerability with WebP (see link to GitHub issue in the following paragraph). For reference, the current stable Electron version at the time I’m writing this is v33.0.2.

There is already precedent for removing tools which, because of their unmaintained status, have dependencies which lag behind upstream (see hat.sh). In Fluent Reader’s case, lagging behind in Electron updates is particularly problematic due to

1. the fact that Fluent Reader is used to render web content, likely from various different sources if you subscribe to many RSS feeds
2. the well-documented security issues of Electron, including the aforementioned WebP vulnerability

Electron webp vulnerability

@sha123

Electron apps often have severe security issues compared to a Chromium-based WebView:

• Not keeping up with security updates
• Deactivated sandbox
• If sandbox is enabled, lax IPC and permissions allow for easy sandbox escapes and access to sensitive data
• Exposing huge attack surface, despite not keeping the security of Chromium intact.
• Electron should never be used with untrusted web content. WebView can do that.

See Critical vuln that lets miscreants hijack computers via Slack? Sucks in air We’ll give you $1,750 for it • The Register
and
Platform Security Part Deux with Justin Schuh (search for “electron”)

@pinkandwhite

yet another shitty electron app and they lagged behind the current electron version for a while too with all the bug and security implications thereof

[delosmzp (Walter Burns)]

From a user’s POV, I never really liked Fluent.

I prefer relying on the web versions of RSS Readers like BazQux or Feedbin. No real dependencies here but a browser with internet.

[Niek-de-Wilde]

Looking at what you laid out here, I am agreeing with the motion for removal, especially as there are better maintained alternatives.

[rottenwheel]

RSSGuard is one.