91–100 of 241 posts
I run Obsidian with restricted capabilities: no network access, and no filesystem access outside its own directory. I only enable network access when updating plugins/themes. Same way I run any other application that could potentially execute untrusted code.
Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it. That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I ha…
> actively reject multiple safety warnings Is this like a popup? which most people actively accept without blinking I think plugin/extensions should be a bit harder to run by default. I get the user friction from extra hurdles before using their plugins etc., but I don't think there is an actually safe way to execute arbitrary code, unaudited, without sandboxing, or other restrictions.
There's no protections beyond that, community plugins can do whatever they want. Thankfully, the vast majority of them are open-source.
Earlier quoted context omitted.
lol we told you plugins were insecure years ago. I distinctly remember getting flamed in your discord because I said that they had full disk access. Too little too late.
You better delete all third-party applications for they are having full disk access.
In 2026, applications, third or even first party, don't need to have full-disk access, and are not given either. They see a jailroot environment. I give full disk access to the terminal app, and a handful of others. 90% of them, nope.
At least that's the case in macOS, I'm pretty sure Windows can do that too. Linux of course has had such capability since forever, but I guess most distros you need to manually take care of it.
I use the plugin for Git, and the one for tasks. Hope those are safe!
You are safe. The way this hack works is that someone online would contact you, share a obsidian valut with you, you open the vault, you download & install a plugin the hacker tells you to install to open the vault. It's all described in the article if you would like to read it.
The issue is that this could happen to anyone who just searches the malicious plugin's name and installs it. Worse if it's a popular one that gets compromised.
Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it. That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I ha…
> actively reject multiple safety warnings Is this like a popup? which most people actively accept without blinking I think plugin/extensions should be a bit harder to run by default. I get the user friction from extra hurdles before using their plugins etc., but I don't think there is an actually safe way to execute arbitrary code, unaudited, without sandboxing, or other restrictions.
Am I the only one who thinks Obsidian is perfect without plugins? Half the reason I switched to it from Anytype was that it was rather spartan in its offerings. If they announced tomorrow they would ban plugins, I would not care.
Earlier quoted context omitted.
> It takes 5 minutes in their Discord channel to see the founders are D&D nerds, not competent engineers. I know absolutely nothing about Obsidian but I'd expect quite a few competent engineers to also be D&D nerds no!? Are you saying the two are mutually exclusive?
No I'm not. But I'd encourage you to visit and see for yourself why these outcomes are completely predictable.
Earlier quoted context omitted.
What software do you use that would be immune to a scenario where you disable all protections to take some action?
One whose protections can’t be disabled.