Less is safer: Reducing the risk of supply chain attacks
1–10 of 274 posts
Re: Less is safer: Reducing the risk of supply chain attacks
#2missed opportunity for "less is secure"
Re: Less is safer: Reducing the risk of supply chain attacks
#3I’ve been using other apps than Obsidian for notes and sharing, so this is nice to read and consider. But isn’t Obsidian an electron app or whatever? Electron has always seemed resource intensive and not native. JavaScript has never struck me as “secure”. Am I just out of touch?
Re: Less is safer: Reducing the risk of supply chain attacks
#4missed opportunity for "less is secure"
"Secure" is a different, harder promise than safeR.
Re: Less is safer: Reducing the risk of supply chain attacks
#5I’ve been using other apps than Obsidian for notes and sharing, so this is nice to read and consider. But isn’t Obsidian an electron app or whatever? Electron has always seemed resource intensive and not native. JavaScript has never struck me as “secure”. Am I just out of touch?
JavaScript is a very secure language. The browser is a massive success at running secure JavaScript on a global scale. Every website you use is running JavaScript and not able to read other site data. Electron is the same, running v8 to sandbox JavaScript. Assuming you aren't executing user input inside that sandbox (something many programming languages allow, including JS), it's very secure.
The problem with supply chain attacks is specifically related to npm, and not related to JS. npm as an organization needs to be taking more responsibility for the recent attacks and essentially forcing everyone to use more strict security controls when publishing their dependencies.
Re: Less is safer: Reducing the risk of supply chain attacks
#6Love it. Jonathan Blow had a nice thread about dependencies a while back: https://x.com/Jonathan_Blow/status/1924509394416632250
Re: Less is safer: Reducing the risk of supply chain attacks
#7Yes, you are responsible for all the code you ship to your users. Not pinning dependencies is asking for trouble. It is literally, "download random code from the Internet and hope for the best."
Re: Less is safer: Reducing the risk of supply chain attacks
#8What about the third party extensions?
Re: Less is safer: Reducing the risk of supply chain attacks
#9I’ve been using other apps than Obsidian for notes and sharing, so this is nice to read and consider. But isn’t Obsidian an electron app or whatever? Electron has always seemed resource intensive and not native. JavaScript has never struck me as “secure”. Am I just out of touch?
Javascript is probably one of the most used, depending on how you measure it, languages on earth.
It runs on a majority of computers and basically all phones. There will be many security issues that get discovered b y virtue of these facts.
What makes you think that "native" apps are any more secure?
Re: Less is safer: Reducing the risk of supply chain attacks
#10missed opportunity for "less is secure"
"Secure" is a different, harder promise than safeR.
but still along the same lines as "safer". the stresses are different, "safer" has the stress as "SAY-fer" and "secure" has the stress as "sih-KYOOR". the latter sounds more similar (and rhymes better) with "more", the originator of the phrase "less is more"