Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Future of Obsidian Plugins

obsidian.md

Post reply on HN
Print view View original

161–170 of 186 posts

Re: The Future of Obsidian Plugins

#161

Post by uncSoft »

andai wrote: post #26
varun_ch wrote: post #2

I’m not convinced that automated checks will be able to reliably assess whether a plugin is malicious. I think the best (only?) way to solve the plugin security problem would be to properly sandbox them with an explicit API and permission system.

>I think the best (only?) way to solve the plugin security problem would be to properly sandbox them with an explicit API and permission system. I want to say "and especially prevent them from touching my private data (i.e. the whole point of Obsidian plugins being to read/write the documents)". But if it can't talk to the internet, I kind of don't see the issue. EDIT: Apparently due to how JS and Electron works, Obs…

That's why I wrote cyberwriter, my company needs sandboxed apps because we work on sensitive data. Community plugins are too risky running with full system access

Re: The Future of Obsidian Plugins

#162

Post by uncSoft »

pier25 wrote: post #57
kepano wrote: post #31

Earlier quoted context omitted.

That's because Obsidian is black. But we're planning to add light mode in the near future :)

I'm a fan of Obsidian and your work but dark mode only is an issue for a big percentage of the population. https://medium.com/@h_locke/why-dark-mode-causes-more-access...

I was "bullied" into making a light theme for my app as well after refusing for months - I didn't realize how many people need a light mode.

Re: The Future of Obsidian Plugins

#164

Post by presbyterian »

joemi wrote: post #76
presbyterian wrote: post #45

Earlier quoted context omitted.

"there is no lock-in" is a thing that's said a lot about Obsidian and, as an Obsidian fan, I feel like isn't totally true. Yes, Obsidian just stores markdown files, but it has unique syntaxes, especially if you're using plugins, that aren't transferable. So while I can get my files out, I still have to go through the annoying process of fixing them and getting it working in whatever new system I switch to when I leav…

Doesn't seem remotely fair to consider lock-in caused by plugins to be an Obsidian lock-in. If the plugin is storing data in such a way that it's not usable in a tool other than Obsidian, that's 100% the plugin's fault, not Obsidian's no matter which way you look at it. Also, more generally, any software that has unique features will require "the annoying process of fixing them and getting it working in whatever new…

> that's 100% the plugin's fault, not Obsidian's no matter which way you look at it

It doesn't really matter to me whose fault it is. Basically no one is using Obsidian without plugins, and the impact plugins have on your portability is something to consider when choosing to use Obsidian.

Re: The Future of Obsidian Plugins

#165

Post by kepano »

presbyterian wrote: post #164
joemi wrote: post #76

Earlier quoted context omitted.

Doesn't seem remotely fair to consider lock-in caused by plugins to be an Obsidian lock-in. If the plugin is storing data in such a way that it's not usable in a tool other than Obsidian, that's 100% the plugin's fault, not Obsidian's no matter which way you look at it. Also, more generally, any software that has unique features will require "the annoying process of fixing them and getting it working in whatever new…

> that's 100% the plugin's fault, not Obsidian's no matter which way you look at it It doesn't really matter to me whose fault it is. Basically no one is using Obsidian without plugins, and the impact plugins have on your portability is something to consider when choosing to use Obsidian.

Obsidian doesn't collect any telemetry data but my estimate is that less than 10% of Obsidian users use plugins (might be closer to 1%). Most people don't even activate any of the built-in core plugins that are off by default.

Re: The Future of Obsidian Plugins

#166

Post by nthypes »

kepano wrote: post #122
nthypes wrote: post #113

Review is done by LLMs? How you guys decided to deal with prompt injection attacks?

It isn't. Doesn't involve AI. Read the post :)

I read. Where in the post says that Automated Reviews are not using AI / LLMs? What automated review means them?

Re: The Future of Obsidian Plugins

#167

Post by kepano »

nthypes wrote: post #166
kepano wrote: post #122

Earlier quoted context omitted.

It isn't. Doesn't involve AI. Read the post :)

I read. Where in the post says that Automated Reviews are not using AI / LLMs? What automated review means them?

It doesn't say "we don't use AI" but I guess the assumption nowadays is everything uses AI? In my opinion the burden should be to state that something does use LLMs, not that it doesn't.

The post has instructions to reproduce the review results using our open source eslint plugin:

https://github.com/obsidianmd/eslint-plugin

Re: The Future of Obsidian Plugins

#168

Post by xboxnolifes »

troad wrote: post #125
raddan wrote: post #85

Earlier quoted context omitted.

I was wondering at which point the enshittification would be revealed.

> the enshittification A strong reason to stick to using Obsidian as just a Markdown editor and not get sucked into the plugin ecosystem at all. If your Obsidian vault is just a folder of Markdown files, you're ready to leave at a moment's notice. If I ever go in on some plugin ecosystem, it'll be FOSS, non-commercial, and have been around long enough to drink. (Emacs?) Haven't felt the need; a Markdown vault for ref…

If I just use obsidian as a markdown editor without plugins, I have no need for obsidian.

Re: The Future of Obsidian Plugins

#169

Post by adityamwagh »

kepano wrote: post #30

Obsidian CEO here. We've been working for nearly a year to launch this new Community site and review system. I'm very excited about this first version but there are many more improvements to come. I've tried to be exhaustive with the blog post, FAQs, and next steps on our roadmap, but I am sure I forgot some things, so feel free to ask! This has been an incredibly challenging project for a number of reasons. We're on…

Hey man! Would it be possible for you to release a webapp version of Obsidian?

Re: The Future of Obsidian Plugins

#170

Post by antiframe »

nickjj wrote: post #101
andai wrote: post #26

Earlier quoted context omitted.

>I think the best (only?) way to solve the plugin security problem would be to properly sandbox them with an explicit API and permission system. I want to say "and especially prevent them from touching my private data (i.e. the whole point of Obsidian plugins being to read/write the documents)". But if it can't talk to the internet, I kind of don't see the issue. EDIT: Apparently due to how JS and Electron works, Obs…

> But if it can't talk to the internet, I kind of don't see the issue. No internet access doesn't save you. With file system access it can delete a file. Without sudo access it can silently add something to your user's crontab so a few days from now it runs a custom shell script that does anything with internet access. If you're not checking into this sort of thing regularly, you wouldn't know. It can add something t…

> To be fair this isn't a problem unique to Obsidian. Code editor plugins and most programming language package managers have the same problem.

While it's not unique to Obsidian, Obsidian not being open source makes it harder to verify their security model. Personally I use a note taking system which has the same problem but all the code I run is visible to me and I can scan it myself.

Post reply on HN