Less is safer: Reducing the risk of supply chain attacks • Hacker News Board

Re: Less is safer: Reducing the risk of supply chain attacks

#161

Post by aucisson_masque » Sat, Sep 20, 2025, 10:00 AM UTC

shelled wrote: post #115

gejose wrote: post #16

This is one way to look at it, but ignores the fact that most users use third party community plugins. Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault. Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community,…

This app deals with very critical, personal, and intimate data – personal notes and professional/work-related notes, but proudly has an Electron app. This alone has seemed like a massive red flag to me.

Until there is a better alternative you’re left with electron. Nothing come close to obsidian.

Re: Less is safer: Reducing the risk of supply chain attacks

#162

Post by OhMeadhbh » Sat, Sep 20, 2025, 10:08 AM UTC

smodo wrote: post #154

OhMeadhbh wrote: post #152

I've been focused on writing software the last couple of weeks. What is obsidian again? I can't find a simple "what is obsidian?" FAQ on their site. Is it a browser or a node replacement like deno? Or an AI library? Clearly obsidian has plugins, but what are they in service of? If it's a browser, they should have something on their web site that says "obsidian is a really cool browser." I think there are a lot of peo…

It’s a notetaking app.

Thanks.

Re: Less is safer: Reducing the risk of supply chain attacks

#163

Post by dankobgd » Sat, Sep 20, 2025, 10:08 AM UTC

It's kind of weird to use word "less" for software that does million things instead of being a simple note taking tool.

Re: Less is safer: Reducing the risk of supply chain attacks

#164

Post by johnisgood » Sat, Sep 20, 2025, 10:21 AM UTC

dotancohen wrote: post #136

johnisgood wrote: post #123

Earlier quoted context omitted.

I have been using firejail for most of these kind of applications, be it Obsidian, Discord, or the browser I am using. I definitely recommend people start using it.

Sell it to us! Why do you use specifically firejail? There are so many options, from so many different security perspectives, that analysis paralysis is a real issue.

I feel like I should keep track of all my comments on HN because I remember writing a lengthy comment on firejail more than once. I cannot keep doing this. :D

For user-space, there is usually bubblewrap vs. firejail. I have not personally used bubblewrap, so I cannot comment on that, but firejail is great at what it does.

The last comment was about restricting clipboard access to either X11 or Wayland which is possible with firejail quite easily, so if you want that, you can have that.

You can do a LOT more with firejail though.

https://wiki.archlinux.org/title/Firejail

https://man.archlinux.org/man/firejail.1

Re: Less is safer: Reducing the risk of supply chain attacks

#165

Post by nylonstrung » Sat, Sep 20, 2025, 10:25 AM UTC

How much supply chain vulnerability can be mitigated just by pinning known safe versions of dependencies

Did anyone need the newest xz version in the first place? What negative tradeoffs would have come from pinning a 2022 release for example

Re: Less is safer: Reducing the risk of supply chain attacks

#166

Post by hexo » Sat, Sep 20, 2025, 10:29 AM UTC

Really? Is this some kind of perverted joke? Electron based thing wants to brag about less being safer? Get rid of the browser, then we can talk about less.

Unbelievable

Re: Less is safer: Reducing the risk of supply chain attacks

#167

Post by ptx » Sat, Sep 20, 2025, 10:30 AM UTC

An alternative for those who want a native application and/or even less supply-chain risk is Zim [1], which uses GTK and is packaged by the major Linux distributions.

[1] https://zim-wiki.org/

Re: Less is safer: Reducing the risk of supply chain attacks

#168

Post by wonger_ » Sat, Sep 20, 2025, 10:31 AM UTC

johnisgood wrote: post #164

dotancohen wrote: post #136

Earlier quoted context omitted.

Sell it to us! Why do you use specifically firejail? There are so many options, from so many different security perspectives, that analysis paralysis is a real issue.

I feel like I should keep track of all my comments on HN because I remember writing a lengthy comment on firejail more than once. I cannot keep doing this. :D For user-space, there is usually bubblewrap vs. firejail. I have not personally used bubblewrap, so I cannot comment on that, but firejail is great at what it does. The last comment was about restricting clipboard access to either X11 or Wayland which is possib…

FYI you can search your comment history with hn.algolia.com:

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Re: Less is safer: Reducing the risk of supply chain attacks

#169

Post by Mikhail_K » Sat, Sep 20, 2025, 10:33 AM UTC

[flagged]

Re: Less is safer: Reducing the risk of supply chain attacks

#170

Post by lxgr » Sat, Sep 20, 2025, 10:37 AM UTC

4ndrewl wrote: post #129

formerly_proven wrote: post #117

Earlier quoted context omitted.

Little snitch can block open(2)?

I believe they're saying it can open, it just can't send the data anywhere. Seems a little excessive, but here we are.

If it can open and write any file on the OS, it's pretty much game over. Too many ways to exfiltrate data even without network/socket access.