Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Less is safer: Reducing the risk of supply chain attacks

obsidian.md

Post reply on HN
Print view View original

151–160 of 274 posts

Re: Less is safer: Reducing the risk of supply chain attacks

#151

Post by freehorse »

gejose wrote: post #16

This is one way to look at it, but ignores the fact that most users use third party community plugins. Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault. Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community,…

> most users use third party community plugins

Is this true? Is there any source about how many obsidian users use third party plugins? For once I don't. Moreover, obsidian by default runs in "restricted mode" which does not allow for community plugins. You have to specifically enable it to be able to install community plugins, hence I assume somebody who does that understands the risks involved. How many people even get into enabling that?

For me it is not even about security firstmost, the whole appeal of markdown is simplicity and interoperability. The more I depend on "plugins" the more I am locked in into this specific platform.

Re: Less is safer: Reducing the risk of supply chain attacks

#152

Post by OhMeadhbh »

I've been focused on writing software the last couple of weeks. What is obsidian again? I can't find a simple "what is obsidian?" FAQ on their site. Is it a browser or a node replacement like deno? Or an AI library? Clearly obsidian has plugins, but what are they in service of?

If it's a browser, they should have something on their web site that says "obsidian is a really cool browser." I think there are a lot of people out there who are ignoring the hype-train and it would do the community a service if they just started with answering that simple question. I mean sure, I get it, it's a "sharpen your thinking app," but I'm not sure what that means.

Re: Less is safer: Reducing the risk of supply chain attacks

#153

Post by fauigerzigerk »

jabbany wrote: post #39
0cf8612b2e1e wrote: post #33

Earlier quoted context omitted.

I would have thought, but it has been how many years, and as far as I know, there is still no segregation for VSCode extensions. Microsoft has all the money and if they cannot be bothered, not encouraged that smaller applications will be able to iron out the details.

I think it's just because supply-chain attacks are not common enough / their attack surfaces not large enough to be worth the dev time... yet... Sneak in a malicious browser extension that breaks the permissions sandbox, and you have hundreds of thousands to millions of users as an attack surface. Make a malicious VSCode/IDE extension and maybe you hit some hundreds or thousands of devs, a couple of smaller companies…

>Make a malicious VSCode/IDE extension and maybe you hit some hundreds or thousands of devs, a couple of smaller companies, and probably can get on some infosec blogs..

Attackers just have to hit one dev with commit rights to an app or library that gets distributed to millions of users. Devs are multipliers.

Re: Less is safer: Reducing the risk of supply chain attacks

#154

Post by smodo »

OhMeadhbh wrote: post #152

I've been focused on writing software the last couple of weeks. What is obsidian again? I can't find a simple "what is obsidian?" FAQ on their site. Is it a browser or a node replacement like deno? Or an AI library? Clearly obsidian has plugins, but what are they in service of? If it's a browser, they should have something on their web site that says "obsidian is a really cool browser." I think there are a lot of peo…

It’s a notetaking app.

Re: Less is safer: Reducing the risk of supply chain attacks

#155

Post by Pikamander2 »

gejose wrote: post #16

This is one way to look at it, but ignores the fact that most users use third party community plugins. Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault. Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community,…

> could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community, which in turn increases the attack surface significantly.

Ah, the WordPress model.

Re: Less is safer: Reducing the risk of supply chain attacks

#156

Post by s_ting765 »

esseph wrote: post #92
ibash wrote: post #87

Earlier quoted context omitted.

> Obsidian plugins have full, unrestricted access to all files in the vault. Unless something has changed, it's worse than that. Plugins have unrestricted access to any file on your machine. When I brought this up in discord a while back they brushed it aside.

If you're using a flatpak, that's not actually the case. It would have very restricted access to the point where you even would have to explicitly give it access to user /home.

You're wrong. The obsidian flatpak ships by default with access to /home. https://github.com/flathub/md.obsidian.Obsidian/blob/5e594a4...

Re: Less is safer: Reducing the risk of supply chain attacks

#157

Post by seaal »

fa3556 wrote: post #142
anon7000 wrote: post #131

Earlier quoted context omitted.

Disagree. AUR isn’t any trickier than using pacman most of the time. Install a package manager like Yay or Paru and you basically use it the same way as the default package manager. It’s still the same problem, relying on the community and trusted popular plugin developers to maintain their own security effectively.

I understood GP's point to be that because Obsidian leaves a lot of functionality to plugins, most people are going to use unverified third party plugins. On arch however most packages are in core or extra so for most people they wont need to go to AUR. They are more likely to install the flatpak or get the appimage for apps not in the repos as thats much easier. yay or paru (or other aur helpers afaik) are not in th…

The Arch-based distros that most normies will install have AUR helpers instaled by default.

I can't even install Brave without the AUR.

Re: Less is safer: Reducing the risk of supply chain attacks

#158

Post by notpushkin »

4ndrewl wrote: post #129
formerly_proven wrote: post #117

Earlier quoted context omitted.

Little snitch can block open(2)?

I believe they're saying it can open, it just can't send the data anywhere. Seems a little excessive, but here we are.

It still can encrypt everything and demand you pay some ₿₿₿₿.

Re: Less is safer: Reducing the risk of supply chain attacks

#159

Post by HSO »

formerly_proven wrote: post #117
HSO wrote: post #101

Earlier quoted context omitted.

What if you run little snitch and block any communications from obsidian to anything?

Little snitch can block open(2)?

Very, very good point

I got lazy

Time to crank the paranoidmeter up again

ty

Re: Less is safer: Reducing the risk of supply chain attacks

#160

Post by photon_garden »

TiredOfLife wrote: post #148
photon_garden wrote: post #81

Earlier quoted context omitted.

Haven’t used Roam, but what I like about Obsidian: - All your data is just plain files on your file system. Automation and interop are great, including with tools like Claude Code. - It’s local-first, so performance is good. - It’s extensible. Write extensions in HTML, CSS, and JS. - It’s free. - Syncing files is straightforward. Use git, Syncthing, Google Drive, or pay for their cheap sync service which is quite goo…

In what universe is their sync service cheap? It's literally at least 100 times more expensive that Dropbox/OneDrive/Google Drive/iCloud sync

My assumption is that most people on HN are making programmer money. $4 - 5 USD per month is affordable even on a junior engineer’s salary in many parts of the world.

The price per GB isn’t as good as the services you mentioned, but their storage limits are fine for the primary use case — storing a lot of plain text notes.

I’ve also had no problems with it, in contrast with iCloud which has routinely gotten stuck for me.

And if price per GB is what you care most about, use something else. That’s one of the great things about Obsidian.

Post reply on HN