Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

Story of 'smoodit' (1) : Electron to Tauri

This article documents the story behind the development of text editor named as smoodit, and the lessons learned along the way. Plan, and starting The primary objective which I've plan was to implement private-based text…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

This article documents the story behind the development of text editor named as smoodit, and the lessons learned along the way.






Plan, and starting



The primary objective which I've plan was to implement private-based text editor desktop application with assistant, to boost editing efficiency by offering predictive text capabilities that anticipate user's needs.



On making PoC, I started with Electron platform, which is close to the industry standard. I initially thought about calling external LLM(from ChatGPT, Gemini, Claude...) APIs, but after thinking about offline mode and cost management, I decided to go with an embedded model. After evaluating a few methods, I settled on "Ollama" because of how easily it could be integrated into the workflow.






Why I think of migrating from Electron to Tauri



Electron has been the go-to for desktop apps for years, but its massive resource footprint (thanks to Chromium) started weighing down my project. My application needed to run Python backend and Local LLM engine (Ollama) simultaneously. The requirement to bundle an LLM significantly increased the application's footprint, depending on the model used. This made me much more conscious of the bundle size, which eventually became one of the primary catalysts for my decision to migrate.





For a project where performance and system agility are paramount, Tauri v2 emerged as the clear answer to next step.





  • Frontend: React + Vite (leveraging Tauri v2 APIs).


  • Backend (Sidecar): A FastAPI server packaged into a single binary using PyInstaller.


  • AI Engine (Sidecar): A raw Ollama binary serving local LLMs.






The Migration Roadmap






Phase 1: Mastering the Tauri Sidecar



One of Tauri's powerful features is "Sidecar" — ability to bundle and execute external binaries alongside application core.




  • Packaging Python: It used pyinstaller to freeze Python app into a standalone executable and make it run independent.

  • Configuration: I registered both backend_server and the ollama binaries in src-tauri/tauri.conf.json under externalBin.

  • In Tauri v2, sidecar binaries must include target triple suffix (ex> -aarch64-apple-darwin) in their filenames to be correctly identified during runtime.






Phase 2: Bridging the Frontend and Sidecars



WebView security policies are very strict about local network requests.




  • Instead of standard fetch, utilized @tauri-apps/plugin-http plugin. This allows React frontend to bypass CORS issues and speak directly to local FastAPI backend.

  • User Experience: Added "Health Check Polling" mechanism. The UI remains in "Initializing" state until the backend sidecar reports status 200 OK, ensuring no requests are lost in the void during startup.






Debugging stories



The most interesting (and stressful) part of any migration is the troubleshooting. Here are several issue I've encountered and how I've fixed.






For MacOS' user — Quarantine



When downloading or bundle third-party binaries, MacOS marks them with a "Quarantine" attribute. When Tauri tried to spawn Ollama, it would fail silently without any visible error.

So, I've added a cleanup step in our package.json build script using xattr -d com.apple.quarantine to strip these attributes from all bundled binaries before execution.






PIPE Buffer Hang



Originally, I've used subprocess.PIPE to capture Ollama's logs in Python. However, when the log data exceeded system's buffer size, the entire Ollama process would freeze (hang).

For this, I've redirected sidecar output to a dedicated log file at ~/ollama_sidecar.log. This not only prevented the buffer-related hangs but also gave us a persistent way to inspect server logs.






Zombie Processes and Lifecycle Management



Also, I've struggled with Ollama instances status staying alive after application closed (zombie processes) because it was running on separate process.

So I've used start_new_session=True in Python subprocess spawn, to detach child from the parent session. Furthermore, I've implemented socket-based port check to verify if the port was truly bound before declaring the server ready.






So, was this worth it?



The results speak for themselves. The installation package size plummeted compared to the Electron version, and memory usage is significantly lower. The combination of a React UI and the speed of Tauri v2, backed by the raw power of Python and Ollama, makes for a truly premium developer tool experience.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Story of 'smoodit' (1) : Electron to Tauri
id: 095df201-c2be-4a2b-9cba-6049dce6b44e
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Story of \'smoodit\' (1) : Elect" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Story of smoodit 1  Electron to Tauri")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Story of smoodit 1  Electron to Tauri*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Story of smoodit 1  Electron to Tauri"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Story of 'smoodit' (1) : Electron to Tau.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Story of 'smoodit' (1) : Electron to Tauri

Thematisch verwandte Begriffe: Story, smoodit, Electron, Tauri · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97818 | phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and i…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag