Giving up markdown apps in the name of security?

NoteTaker

So I know what you're thinking, .md is just a text file, how can it be insecure?

I've been trying to find non-Electron apps (Windows) that are portable for some time now, but then I realised I was being kinda dumb because Markdown is usually rendered using a web engine (which increases attack surface form what I've heard). Since I store bank and medical info in my notes (sandboxed with Veracrypt), it's one of the few things I'm super protective about. I'm not as privacy-conscious as most folks here

Using a Markdown app without a web engine, I don't know if that's even possible (I'm not a techie). Like seriously, I tried a QT app called Ghostwriter but then I realised QT itself had a web engine so does that mean that "Ghostwriter" had it too? Well, it was 431MB, larger than Obsidian (349MB) and smaller than Zettlr (648MB). Since both are Electron apps, I realised that what I thought was a lightweight alternative probably had a web engine bundled inside.

https://github.com/KDE/ghostwriter/releases/tag/2.1.6. The latest release was in 2022 too so even if it has critical vulnerabilities they might never be fixed.

I need Markdown to be rendered in real time with syntax still shown (like asterisks being visible even while bolded), and well... every app I've tried on Windows seems to need a web engine. Without styling it's just ugly and cluttered to me. Actual plaintext without Markdown stuff might be safer, but my notes are really long and I'd lose the ability to jump to headers, so I'll have to reorganise tens of notes (still considering it)

I honestly think I might be too paranoid and web engines having a larger attack surface might not be that big of a deal for a notes app though. Since the people here seem well-versed in security stuff, I thought I'd ask you guys

DeletedUser1012

Something like this suit your needs? Mind use of AI in coding if that's a concern for you. Not quite real time ask but could be rendered in batch quickly.

https://github.com/liyown/marknative

NoteTaker

DeletedUser1012 Thanks, I'll look into that. I actually wanted to write an app in Golang. because it's known for being easy and portable. There are a couple of Markdown libraries like goldmark...
I'm guessing it just processes the syntax and changes the font size of headers etc.

But if actual programmers haven't made it I don't think a beginner like me could. Like surely there's a catch, it can't be that simple. Apparently, the GUI libs for Golang are terrible too

ClickClickDrone

NoteTaker
Dev here; I can look into making an app like this, but I suppose you use Windows, which I am unable to test on.

NoteTaker

ClickClickDrone Yeah, the only way I'll ever touch Linux again is if Microsoft does something absolutely ludicrous like requiring online verification of a government ID to set up Windows.

I had chosen golang long ago because it was easier to develop for multiple platforms (or so I've heard), and I was trying out Linux at the time. But I don't plan on switching back, and I've had terrible experience with Apple products (needing a buggy iTunes app just to transfer local music files, fuck you Apple). Here's to hoping that legislators stop pushing their verification nonsense everywhere

One of the reasons I wanted to avoid Electron was because even the 'portable' apps would write stuff outside its designated folder... one of the quirks of Chromium, I think. Can't check exactly what's written because I'm not a programmer, and since it has a larger attack surface anyway I decided to avoid it. It has to stay within Veracrypt

ClickClickDrone

NoteTaker
I am unfortunately left with these few options then:

wxWidgets, it is cross-platform, isn't a browser, and is fast because it is C++, but since it is C++, it is not sound from a security point-of-view.
tk, it is relatively slow, and worst of all, has an extremely dated UI, making it a non-starter.
deno, this is unfortunately the best compromise for me; yes it is WebView, but it has many less downsides compared to Electron, and applications are written in a memory-safe language (TypeScript), however, the hellhole of a security landscape that is the Node/Deno ecosystem comes along with it. Please see this document about Deno Desktop.

NoteTaker One of the reasons I wanted to avoid Electron was because even the 'portable' apps would write stuff outside its designated folder... one of the quirks of Chromium, I think.

Uh, what?
This is not unexpected because Electron apps are not confined to the same security perimeters Chromium normally has (well, the renderer is sandboxed, but most people likely don't use IPC to the broker correctly, leading to potential security bugs)

NoteTaker

ClickClickDrone

This is not unexpected because they are not confined to the same security perimeters Chromium normally has.

I wasn't being humble when I said I'm not a programmer, I genuinely haven't written anything other than Hello World in my life

If you plan to create an app using deno, I'm all for testing it but just know that I have no experience at all, that's why I was looking at creating one myself using an 'easy' language like golang

Since Markdown is kind of popular among programmers, maybe the lack of a markdown app without a web engine means most of them aren't that paranoid about security...

NoteTaker

Confirmed that it uses a web engine

https://github.com/KDE/ghostwriter/blob/master/resources/preview.css

It uses CSS and well, webkit is the name of a web engine so yeah

ClickClickDrone

NoteTaker If you plan to create an app using deno

I think I am going with wxWidgets (C++).
Yes, it is memory unsafe, but I am not very proficient with Rust and the other alternatives are arguably worse.

Consider contacting me on Matrix if you want to discuss further, since I do not want to hijack this thread.

NoteTaker

ClickClickDrone Sure, I don't have a Matrix account atm though. Actually, I'm kinda surprised that this thread is relatively inactive, since I thought a privacy community would be quite interested in notes apps (almost everyone takes notes after all).

I don't know much about Android development, but I wonder if Markdown apps on Androids typically use a web engine like their desktop counterparts

ClickClickDrone

NoteTaker I don't know much about Android development, but I wonder if Markdown apps on Androids typically use a web engine like their desktop counterparts

I believe BeauTyXT (available on Accrescent) doesn't use a web engine, but I have not looked through the codebase, so @soupslurpr, please correct me if I am wrong.

The reason why web engines are commonly integrated in Markdown note-taking apps (beside the fact that tools like Electron are very sexy to developers; you use the same codebase for all platforms, all in a high-level language), is that Markdown usually gets transpiled into HTML, and HTML can obviously be very easily rendered via JavaScript by setting the HTMLElement.innerHTML DOM property.

soupslurpr

ClickClickDrone BeauTyXT does use a WebView (system's web engine, not an included one), but only for displaying the generated HTML. The WebView is configured to have JavaScript and internet access disabled. Converting the Markdown to HTML is run with a Rust library in a per-file isolated process.

waffle_goose

Check out QOwnNotes for Desktop. I don't think it's using a web engine.