React Native for Windows and Mac
React Native scares me with its dependency webs:<p><a href="http://npm.anvaka.com/#/view/2d/react-native" rel="nofollow">http://npm.anvaka.com/#/view/2d/react-native</a><p>From my experience, it's really great to work with and definitely saves a ton of work, but the depgraph above fills me with doubt for use in sensitive applications such as in finance or healthcare. For this reason, I've been trying out Flutter or even considering to go back to native apps. Perhaps there's some kind of middle ground where we can create a tight microkernel-like thing natively using secure enclaves and key managers, but expose an API to the "untrusted" parts of the program. This approach is not without its own downsides, such as dark patterns in a compromised UI. However, as one friend pointed out, a lot of those deps are indeed for build time only, which have different risk profiles.<p>The depgraph of reactjs is far simpler and easier for me to understand and therefore feel trust:<p><a href="http://npm.anvaka.com/#/view/2d/react" rel="nofollow">http://npm.anvaka.com/#/view/2d/react</a><p>Does anyone know if there has been reliable research towards the security of the entire RN dependency tree? Seeing a stray dep there that has 1 maintainer on npm/GitHub who has been inactive for over a year makes me nervous. Any one of those JavaScript projects could do something nefarious deep under the hood, and this to me seems to expose a huge surface area for attackers.<p>Here's a classic throwback to keep us on our toes :)<p><a href="https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html" rel="nofollow">https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html</a>