Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Less is safer: Reducing the risk of supply chain attacks

obsidian.md

Post reply on HN
Print view View original

141–150 of 274 posts

Re: Less is safer: Reducing the risk of supply chain attacks

#141

Post by dtkav »

bdzr wrote: post #126
dtkav wrote: post #94

Earlier quoted context omitted.

The plugin is called Relay [0] -- it makes Obsidian more useful in a work setting by adding real-time collaboration. One thing that makes our offering unique is the ability to self-host your Relay Server so that your docs are completely private (we can't read them). At the same time you can use our global identity system / control plane to collaborate with anyone in the world. We have pretty solid growth, a healthy p…

Are you worried about being sherlocked at all? I know "multiplayer" is on their official roadmap.

yeah, definitely.

It might not be the most strategic move, but i want to build cool and useful tools, and the Obsidian folks are a big inspiration.

I hope there's a way to collaborate and/or coexist.

Re: Less is safer: Reducing the risk of supply chain attacks

#142

Post by fa3556 »

anon7000 wrote: post #131
fa3556 wrote: post #120

Earlier quoted context omitted.

I think this criticism is unfair because most common packages are covered by the core and extra repos which are maintained by Arch Linux. AUR is a collection of user build scripts and using it has a certain skill cliff such that I expect most users to have explicit knowledge of the security dangers. I understand your concern but it would be weird and out of scope for Arch to maintain or moderate AUR when what Arch is…

Disagree. AUR isn’t any trickier than using pacman most of the time. Install a package manager like Yay or Paru and you basically use it the same way as the default package manager. It’s still the same problem, relying on the community and trusted popular plugin developers to maintain their own security effectively.

I understood GP's point to be that because Obsidian leaves a lot of functionality to plugins, most people are going to use unverified third party plugins. On arch however most packages are in core or extra so for most people they wont need to go to AUR. They are more likely to install the flatpak or get the appimage for apps not in the repos as thats much easier.

yay or paru (or other aur helpers afaik) are not in the repos. To install them one needs to know about how to use AUR in the first place. If you are technically enough to do that, you should know about the security risks since almost all tutorials for AUR come with the security warnings. Its also inconvenient enough that most people wont bother.

In obsidian plugins can seem central to the experience so users might not think much of installing them, in Arch AUR is very much a non essential component. At least thats how I understand it.

Re: Less is safer: Reducing the risk of supply chain attacks

#143

Post by mark_and_sweep »

xenator wrote: post #95

To be honest, right now I'm thinking about isolating of build process for frontend on my local environment. It is seems not hard to send my local environment variables like OPENAI_API_KEY or .ssh/* to some remote machine. I know it is not very different comparing to python or projects in any other language. But I don't feel that I cannot trust node/js community at this point.

Switching to Deno might help. It's sandboxed by default and offers granular escape hatches. So if a script needs access to a specific environment variable or read or write specific files, it's simple to configure that only those accesses are allowed.

Re: Less is safer: Reducing the risk of supply chain attacks

#144

Post by tomsmeding »

fa3556 wrote: post #142
anon7000 wrote: post #131

Earlier quoted context omitted.

Disagree. AUR isn’t any trickier than using pacman most of the time. Install a package manager like Yay or Paru and you basically use it the same way as the default package manager. It’s still the same problem, relying on the community and trusted popular plugin developers to maintain their own security effectively.

I understood GP's point to be that because Obsidian leaves a lot of functionality to plugins, most people are going to use unverified third party plugins. On arch however most packages are in core or extra so for most people they wont need to go to AUR. They are more likely to install the flatpak or get the appimage for apps not in the repos as thats much easier. yay or paru (or other aur helpers afaik) are not in th…

> Its also inconvenient enough that most people wont bother. > in Arch AUR is very much a non essential component.

While somewhat true, we are talking about a user who has installed Arch on their machine. If a user wanted to not bother with installation details, they would've installed Ubuntu.

Re: Less is safer: Reducing the risk of supply chain attacks

#145

Post by wiseowise »

endorphine wrote: post #108
hahn-kev wrote: post #107

Earlier quoted context omitted.

It's no worse than vscode. Sure there's permissions, but it's super common for an extension to start a process and that process can do anything it wants.

And why is VSCode our baseline?

Because it is one of the most popular dev tools out there? If not the most popular. It also uses Electron, like Obsidian. Has thousands of plugins, like obsidian.

Re: Less is safer: Reducing the risk of supply chain attacks

#146

Post by pipes »

esseph wrote: post #111
pipes wrote: post #99

Earlier quoted context omitted.

So if I run their software in a container they can't access my entire filesystem. I don't think that is a security feature. It sounds like if I ever run obsidian I should be using flat seal too.

Er, what? I'm not claiming it's a security feature of Obsidian, I'm saying it's a consequence of running a flatpak - and in this situation it could be advantageous for those interested.

Sorry, it genuinely sounded to me like you were saying that it's not a problem because flat pack.

Re: Less is safer: Reducing the risk of supply chain attacks

#147

Post by testfrequency »

It has been so rewarding and timely to see this post.

I just decided on Thursday after years of covering my ears and eyes from my obsidian-obsessed friends and coworkers that the tool just didn’t make sense to me, and I felt like I’d be in plugin purgatory on my computer for eternity.

I’ve ended up going with Reflect, after ~forever using Apple Notes primarily. So far so good, but I genuinely felt for so long I was supposed to love Obsidian because that’s the trope - appears that’s changing.

Re: Less is safer: Reducing the risk of supply chain attacks

#148

Post by TiredOfLife »

photon_garden wrote: post #81
brentm wrote: post #77

I've been using Roam Research since about 2020. Is Obsidian better?

Haven’t used Roam, but what I like about Obsidian: - All your data is just plain files on your file system. Automation and interop are great, including with tools like Claude Code. - It’s local-first, so performance is good. - It’s extensible. Write extensions in HTML, CSS, and JS. - It’s free. - Syncing files is straightforward. Use git, Syncthing, Google Drive, or pay for their cheap sync service which is quite goo…

In what universe is their sync service cheap?

It's literally at least 100 times more expensive that Dropbox/OneDrive/Google Drive/iCloud sync

Re: Less is safer: Reducing the risk of supply chain attacks

#149

Post by junon »

joshdavham wrote: post #85

There’s some advice that’s been going around lately that I’ve been having trouble understanding: the idea that you should not be updating your dependencies when new patches are released (e.g., X.X.PATCH). I understand that not updating your dependencies when new patches are released reduces the chance of accidentally installing malware, but aren’t patches regularly released in order to improve security? Wouldn’t it g…

The attack that hit my packages two weeks ago was a patch release, taking advantage of this exact assumption. Wasn't a Post-Install script either.

With all of the latest in automated scanning and whatnot, this is more or less a moot point. You'll know when a package is vulnerable, and the alarm bells are loud and unambiguous. I really agree, and have always pushed the point, that version ranges are the worst things you can have if you care about supply chain attacks.

Re: Less is safer: Reducing the risk of supply chain attacks

#150

Post by yoavm »

Mountain_Skies wrote: post #63

Absolutely love Obsidian but had to stop using it because Electron apps don't play well with Wayland. After lots of tinkering around with flags and settings for compatibility layers, it became obvious that it would never work seamlessly like it did on Windows (and probably does on x11). So it was either give up Wayland compositors or give up Obsidian. Luckily I don't use any plugins, so moving to other software was e…

What issues are you seeing? Haven't noticed the slightest glitch here, using Sway.
Post reply on HN