Live data from Hacker News

Less is safer: Reducing the risk of supply chain attacks

obsidian.md

271–274 of 274 posts

Re: Less is safer: Reducing the risk of supply chain attacks

#271

Earlier quoted context omitted.

Buffer overflows are 0.001 percent of security incidents in practice. Let's fix private key leakage and supply chain issues before worrying about C++ haxxors p0wning your machines.

Memory management vulnerabilities are estimated to account for 70% of bugs. As less code at trust boundaries is being written in memory-unsafe languages, we'll get to 0.001%!

"Vulnerabilities" != security incidents.

Re: Less is safer: Reducing the risk of supply chain attacks

#272

Earlier quoted context omitted.

I feel like I should keep track of all my comments on HN because I remember writing a lengthy comment on firejail more than once. I cannot keep doing this. :D For user-space, there is usually bubblewrap vs. firejail. I have not personally used bubblewrap, so I cannot comment on that, but firejail is great at what it does. The last comment was about restricting clipboard access to either X11 or Wayland which is possib…

> bubblewrap vs. firejail In case anyone else is curious, I found the following comparison in bubblewrap's repo. - https://github.com/containers/bubblewrap#related-project-com... I'm gonna try both and see which one I like. Thanks for this info! You're sure living up to your user name there. (:

To comment on the Pulseaudio bit from the link: you will want "keep-config-pulse" and "whitelist ${HOME}/.config/pulse/*".

> You're sure living up to your user name there. (:

You are too kind, thank you!

Re: Less is safer: Reducing the risk of supply chain attacks

#273
post #87

Earlier quoted context omitted.

> Obsidian plugins have full, unrestricted access to all files in the vault. Unless something has changed, it's worse than that. Plugins have unrestricted access to any file on your machine. When I brought this up in discord a while back they brushed it aside.

Having recently read through a handful of issues on their forums, they seems to brush aside a lot of things. It's a useful tool but the mod / dev team they have working with the community could use some training.

[deleted]

Re: Less is safer: Reducing the risk of supply chain attacks

#274

Earlier quoted context omitted.

There are better alternatives. It's just that people have convinced themselves they need the features Obsidian offers - because it makes them feel smart and important. At the end of the day, you're just taking notes. If you write a journal, don't put it in something like Obsidian. Even Apple Notes is better (in security, privacy, etc) in this regards.

Well I’m pretty convinced I need obsidian because it’s just the best way to manage stuffs and I hate overcomplicated stuffs. I use it to remember stuffs and classify important informations, for instance I had issue fo years with my government to end my enterprise. I made a note in obsidian « enterprise closure » and every time there was a mail, I would save it as pdf and import it into the note. Same for every letter…

Not much different from naming the PDF and the TXT file with the same title (but different extension) and writing your thoughts inside the TXT file. Also searchable in spotlight.
Post reply on HN