Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Less is safer: Reducing the risk of supply chain attacks

obsidian.md

Post reply on HN
Print view View original

211–220 of 274 posts

Re: Less is safer: Reducing the risk of supply chain attacks

#211

Post by johnisgood »

rufugee wrote: post #185
johnisgood wrote: post #164

Earlier quoted context omitted.

I feel like I should keep track of all my comments on HN because I remember writing a lengthy comment on firejail more than once. I cannot keep doing this. :D For user-space, there is usually bubblewrap vs. firejail. I have not personally used bubblewrap, so I cannot comment on that, but firejail is great at what it does. The last comment was about restricting clipboard access to either X11 or Wayland which is possib…

So do you configure firejail to give each app their own separate, permanent home directories? Like "firejail --private=/home/user/firejails/discord discord", "firejail --private=/home/user/firejails/chromium chromium", and so on?

I have my own Discord.profile!

This is my ~/.config/firejail/Discord.profile[1]:

  include disable-common.inc
  include disable-devel.inc
  include disable-interpreters.inc
  include disable-shell.inc

  noblacklist /sys/fs
  noblacklist /sys/module

  keep-config-pulse
  keep-dev-shm

  name discord
  apparmor
  caps.drop all
  caps.keep sys_admin,sys_chroot
  netfilter
  nodvd
  #nogroups
  #noinput
  nonewprivs
  noroot
  notv
  #nou2f
  #novideo
  protocol unix,inet,inet6
  #shell none

  disable-mnt
  private-cache
  #private-tmp

  noexec /tmp

  dbus-user filter
  dbus-user.talk org.freedesktop.Notifications

  private-bin Discord,cut,echo,egrep,electron,electron[0-9],electron[0-9][0-9],grep,head,sed,sh,tr,xdg-mime,xdg-open,zsh,gzip,wget,curl,notify-send
  private-etc alternatives,asound.conf,ca-certificates,crypto-policies,fonts,group,ld.so.cache,ld.so.preload,localtime,login.defs,machine-id,password,pki,pulse,resolv.conf,ssl

  noblacklist /usr/lib/discord/
  whitelist ${HOME}/.config/discord
  read-write ${HOME}/.config/discord
  whitelist ${DOWNLOADS}
  whitelist ${HOME}/.config/pulse/*

  include whitelist-common.inc
  include whitelist-var-common.inc
  include whitelist-run-common.inc
  include whitelist-runuser-common.inc
I have some things commented out but you could probably uncomment most.

Some has this, too:

  disable-mnt
  private-dev
  private-cache

  env http_proxy=socks5://127.0.0.1:9050
  env https_proxy=socks5://127.0.0.1:9050
FWIW, once you start whitelisting, it will only have access to those directories and files only, so Discord has no access to anything other than its own directory and ${DOWNLOADS}, which I should probably change.

You should check out the default profiles for many programs / apps under directory "/etc/firejail".

[1] You run it via "firejail Discord" or "firejail ./Discord" if you name it "Discord.profile".

Re: Less is safer: Reducing the risk of supply chain attacks

#212

Post by johnisgood »

wonger_ wrote: post #168
johnisgood wrote: post #164

Earlier quoted context omitted.

I feel like I should keep track of all my comments on HN because I remember writing a lengthy comment on firejail more than once. I cannot keep doing this. :D For user-space, there is usually bubblewrap vs. firejail. I have not personally used bubblewrap, so I cannot comment on that, but firejail is great at what it does. The last comment was about restricting clipboard access to either X11 or Wayland which is possib…

FYI you can search your comment history with hn.algolia.com: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Thank you, exactly what I have been looking for!

Re: Less is safer: Reducing the risk of supply chain attacks

#213

Post by NelsonMinar »

gejose wrote: post #16

This is one way to look at it, but ignores the fact that most users use third party community plugins. Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault. Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community,…

I agree Obsidian plugins do nothing about safety. But I'm not sure "most users use plugins", that's not my impression from reading the subreddit. I wonder if there's any data on it?

Re: Less is safer: Reducing the risk of supply chain attacks

#214

Post by Jaxan »

eviks wrote: post #91
da_chicken wrote: post #43

Earlier quoted context omitted.

No, it's not really an issue. GitHub and VS Code are also Electron apps. So are Slack and Discord. Postman is, as well. I'd also be forced to ask... what exactly are you doing with a markdown note-taking application such that performance is a legitimate concern? But, I mean, maybe you're reading this in a Lynx session on your ThinkPad 701C.

> what exactly are you doing with a markdown note-taking application such that performance is a legitimate concern? Launching it and expecting a fast startup.

That’s a reason I moved away from Notion. The startup is so terribly slow (perhaps because it’s updating too often?).

Re: Less is safer: Reducing the risk of supply chain attacks

#215

Post by rufugee »

johnisgood wrote: post #211
rufugee wrote: post #185

Earlier quoted context omitted.

So do you configure firejail to give each app their own separate, permanent home directories? Like "firejail --private=/home/user/firejails/discord discord", "firejail --private=/home/user/firejails/chromium chromium", and so on?

I have my own Discord.profile! This is my ~/.config/firejail/Discord.profile[1]: include disable-common.inc include disable-devel.inc include disable-interpreters.inc include disable-shell.inc noblacklist /sys/fs noblacklist /sys/module keep-config-pulse keep-dev-shm name discord apparmor caps.drop all caps.keep sys_admin,sys_chroot netfilter nodvd #nogroups #noinput nonewprivs noroot notv #nou2f #novideo protocol un…

This is great. Thanks for the detailed reply!

Re: Less is safer: Reducing the risk of supply chain attacks

#216

Post by raybb »

ibash wrote: post #87
gejose wrote: post #16

This is one way to look at it, but ignores the fact that most users use third party community plugins. Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault. Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community,…

> Obsidian plugins have full, unrestricted access to all files in the vault. Unless something has changed, it's worse than that. Plugins have unrestricted access to any file on your machine. When I brought this up in discord a while back they brushed it aside.

Ah I guess that's one reason some folks started running it in a docker container. I think Linux server recently released a container for it.

Re: Less is safer: Reducing the risk of supply chain attacks

#217

Post by Barrin92 »

sunaookami wrote: post #174
jabbany wrote: post #27

Earlier quoted context omitted.

Browser extensions also have a relatively robust permissions-based system. If they wanted to, one would guess that browser-ish local apps based on stuff like Electron/node-webkit could probably figure out some way to limit extension permissions more granularly.

>Browser extensions also have a relatively robust permissions-based system. Yeah and they suck now. We need a better security model where it's still possible to do powerful stuff on the whole machine (it's MY computer after all) without compromises.

>We need a better security model where it's still possible to do powerful stuff on the whole machine

That's not possible. If you can do powerful stuff on the whole machine by definition you have no security. Security is always a question of where you create a perimeter. You can hand someone a well defined box in which they can do what they want, you can give someone broader access with fewer permissions, but whether vertically or horizontally to have security is to exercise control and limit an attack surface.

That's even implicit in the statement that it's YOUR computer. The justification being that there's a dividing line between your computer and other computers. If you'd be part of of a network, that logic ceases to hold. Same when it comes to components on your machine.

Re: Less is safer: Reducing the risk of supply chain attacks

#218

Post by dehugger »

Alive-in-2025 wrote: post #112
dehugger wrote: post #96

Earlier quoted context omitted.

You never actually told us what your OS is.

They must mean macos, right?

I think you could find a dozen different operating systems that someone, somewhere, would say similar about.

Re: Less is safer: Reducing the risk of supply chain attacks

#219

Post by dehugger »

dotancohen wrote: post #137
dehugger wrote: post #96

Earlier quoted context omitted.

You never actually told us what your OS is.

Because that would be a distraction to the point they're actually making.

The point is thoroughly undermined since we can't judge the veracity of their claims
Post reply on HN