Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obsidian plugin was abused to deploy a remote access trojan

cyber.netsecops.io

Post reply on HN
Print view View original

151–160 of 241 posts

Re: Obsidian plugin was abused to deploy a remote access trojan

#151

Post by PurpleRamen »

Paul-E wrote: post #18
Groxx wrote: post #4

Earlier quoted context omitted.

Ehm. No? https://obsidian.md/help/plugin-security#Plugin+capabilities > Due to technical limitations, Obsidian cannot reliably restrict plugins to specific permissions or access levels. This means that plugins will inherit Obsidian's access levels. As a result, consider the following examples of what community plugins can do: Community plugins can access files on your computer. Community plugins can connect to intern…

Obsidian seems like a perfect candidate for a WASM/WASI based plugin system that would properly sandbox plugin code.

Has WASM/WASI DOM-access? When I last read about the architecture, there was a strict separation between WASM, Javascript and the app, but also a movement to allow UI-customization from WASM-space. Many Obsidian-plugins are adding heavy UI-changes, so without that, it would be kinda pointless.

Re: Obsidian plugin was abused to deploy a remote access trojan

#152

Post by PurpleRamen »

eviks wrote: post #60

What are the reasons behind the fact that almost all of these plugin systems are so poorly engineered? Is it too much work (ie, there are no good plugin development frameworks that already enable proper isolation/permission capabilities) or "simply" a widespread lack of knowledge of what is needed, so devs learn only after their own system has been abused? Both? Something else?

At the core, there is the tradeoff between ability and security. You can give the users power and enable them doing fancy shit, or you can make it secure, stripping any meaningful ability. Usually, people prefer ability over security.

The other problem is that security is hard, and just giving generic access and adding some basic guards is simple.

Re: Obsidian plugin was abused to deploy a remote access trojan

#153

Post by Capricorn2481 »

Groxx wrote: post #51
Ferret7446 wrote: post #37

Earlier quoted context omitted.

The same is true for all software on your machine.

Not even slightly. Browser extensions are a trivial counter-example, as are all flatpacks, and anything restricted by user/group. That covers probably literally a majority of all software on your computer, because people have been voluntarily restricting their software to protect you from their potential accidents for decades.

So in other words, yes the apps have full filesystem access unless you specifically sandbox them with the OS.

Re: Obsidian plugin was abused to deploy a remote access trojan

#154

Post by [deleted] »

PurpleRamen wrote: post #150
raincole wrote: post #122

Earlier quoted context omitted.

> Obsidian is not a usable system without community plugins. It's horse hockey. Plenty users use the vanilla Obsidian. > Folks will reply "but I use it every day without plugins". Because they do. You're saying that they should lie about their usage to fit your narrative?

> Plenty users use the vanilla Obsidian. They are irrelevant for this dispute, because these problems do not concern them. And the amount of people using plugins because of some real demand is not low.

[deleted]

Re: Obsidian plugin was abused to deploy a remote access trojan

#155

Post by raincole »

PurpleRamen wrote: post #150
raincole wrote: post #122

Earlier quoted context omitted.

> Obsidian is not a usable system without community plugins. It's horse hockey. Plenty users use the vanilla Obsidian. > Folks will reply "but I use it every day without plugins". Because they do. You're saying that they should lie about their usage to fit your narrative?

> Plenty users use the vanilla Obsidian. They are irrelevant for this dispute, because these problems do not concern them. And the amount of people using plugins because of some real demand is not low.

What dispute?

The parent comment says that Obsidian is not usable without plugins and it's simply nonsense. It would be very charitable to call this a "dispute."

Could Obsidian handle plugin permission better? I guess so. But that doesn't mean the users have to use plugins. It's ultimately the user's choice. Blender has zero security guards over the addons besides the OS's and the ecosystem thrives. So does Minecraft. These communities are essentially "arbitrary Python/Java code goes brrrr."

Re: Obsidian plugin was abused to deploy a remote access trojan

#156

Post by foofloobar »

Capricorn2481 wrote: post #146
foofloobar wrote: post #123

Earlier quoted context omitted.

[flagged]

This is pearl clutching. This feels like a massive overreaction. If you don't want to use it because it's not open source, that's fine, but you're spreading a lot of snarky FUD about the creators. They are not making excuses, they stated clearly why open sourcing it is tangential to this problem at best, and they're not the only user to call out the hijacking of the thread. They have been quite clear about why they k…

That's your opinion. I respect your choices and your opinions. I speak for myself. This is the first time I've seen this company's CEO post somewhere. I really couldn't trust this software less.

To be fair, when someone comes up with excuses for not making something open source, it comes off as dishonest. Be honest. Say that you want to keep it closed to keep control and make money. There's no need to say otherwise. I do the same. I keep code private to make money. I don't say more than that.

You'll see a plethora of such apps made with LLMs. People will write something custom to meet their own needs and to have the features they need.

Re: Obsidian plugin was abused to deploy a remote access trojan

#157

Post by kevinmgranger »

Daedren wrote: post #93
hackermanai wrote: post #72

Earlier quoted context omitted.

> actively reject multiple safety warnings Is this like a popup? which most people actively accept without blinking I think plugin/extensions should be a bit harder to run by default. I get the user friction from extra hurdles before using their plugins etc., but I don't think there is an actually safe way to execute arbitrary code, unaudited, without sandboxing, or other restrictions.

The pop-ups and "social engineering" in question are things that any users in HN likely already accepted, which is to enable community plugins. These community plugins are the backbone of Obsidian and where a lot of the meat is behind its fame come from. There's no protections beyond that, community plugins can do whatever they want. Thankfully, the vast majority of them are open-source.

I'm gonna push back against the "backbone of Obsidian" part. I'll argue that vanilla Obsidian is plenty powerful enough.

I know many people swore / swear by the datatables plugin, but now that Bases in core, you can get pretty far without it, no?

Re: Obsidian plugin was abused to deploy a remote access trojan

#158

Post by PurpleRamen »

raincole wrote: post #155
PurpleRamen wrote: post #150

Earlier quoted context omitted.

> Plenty users use the vanilla Obsidian. They are irrelevant for this dispute, because these problems do not concern them. And the amount of people using plugins because of some real demand is not low.

What dispute? The parent comment says that Obsidian is not usable without plugins and it's simply nonsense. It would be very charitable to call this a "dispute." Could Obsidian handle plugin permission better? I guess so. But that doesn't mean the users have to use plugins. It's ultimately the user's choice. Blender has zero security guards over the addons besides the OS's and the ecosystem thrives . So does Minecraf…

> What dispute?

The discussion about the plugin-system, and the people who need it to which degree.

> The parent comment says that Obsidian is not usable without plugins and it's simply nonsense.

Sure, fair. But the comment happened in the context of talking about the plugin-system, and parent comment seems on the side that for them obsidian is worthless without plugins. Saying that other people have no need for them is pointless, because they are not in the picture. Phrasing could indeed be better, but talking about people who are not concerned by the problem is not really adding anything to the discussion.

Re: Obsidian plugin was abused to deploy a remote access trojan

#159

Post by pfooti »

Loocid wrote: post #15
kid64 wrote: post #9

Earlier quoted context omitted.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

As one of those people that uses Obsidian without plugins, what plugins do you consider essential?

Yeah, I don't use any community plugins. I take notes in obsidian. And it turns out, having multiple years worth of notes and todos in a tree of crosslinked markdown files is pretty handy in this AI era. I take notes in obsidian and run the Gemini cli from my vault. Works a treat.
Post reply on HN