Hacker News Reader

It looks like this is just a local web app(?). The only binary I see used is ffmpegsumo.

Given, that can't you just download the repo locally, replace ffmpegsumo with a trusted version from elsewhere, and at least know you aren't running a version that differs from what is on the repo?

View on HN

They are using node-webkit which means any javascript has unrestricted access to the nodejs api http://nodejs.org/api/. It wouldn't be hard to do something malicious with those low level filesystem, network and process modules.

Reply on news.ycombinator.com