Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Less is safer: Reducing the risk of supply chain attacks

obsidian.md

Post reply on HN
Print view View original

71–80 of 274 posts

Re: Less is safer: Reducing the risk of supply chain attacks

#71

Post by lyu07282 »

Mountain_Skies wrote: post #63

Absolutely love Obsidian but had to stop using it because Electron apps don't play well with Wayland. After lots of tinkering around with flags and settings for compatibility layers, it became obvious that it would never work seamlessly like it did on Windows (and probably does on x11). So it was either give up Wayland compositors or give up Obsidian. Luckily I don't use any plugins, so moving to other software was e…

In my experience electron + Wayland was absolutely god awful for a long time, but it got dramatically better in the last 4-5ish months. So depending on when you last tried it, might be worth a revisit. Heavily depends on which GPU+DE though, Nvidia+Plasma here.

Re: Less is safer: Reducing the risk of supply chain attacks

#73

Post by [deleted] »

0cf8612b2e1e wrote: post #19
gejose wrote: post #16

This is one way to look at it, but ignores the fact that most users use third party community plugins. Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault. Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community,…

Don’t most plugin models work this way? Does VSCode, Vim, Emacs, and friends do anything to segregate content? Gaming is the only area where I expect plugins have limited permissions.

[deleted]

Re: Less is safer: Reducing the risk of supply chain attacks

#74

Post by MonaroVXR »

groby_b wrote: post #51

I love Obsidian dearly, but if you build an app that's only really useful with plugins, and that has a horrifyingly bad security model for plugins and little to no assurance of integrity of the plugins... Maybe, just maybe, don't give fullmouthed advice on reducing risk in the supply chain.

But what about VScode?

Re: Less is safer: Reducing the risk of supply chain attacks

#75

Post by callc »

qntmfred wrote: post #50

If the obsidian team did a 2 hour q&a livestream every week, I'd watch every one (or at least get the AI summary). One of my favorite pieces of software ever.

I recently had a similar experience using Libby for the first time.

An absolutely incredible piece of software. If anyone here on HN works on it, you deserve to be proud of your work.

Re: Less is safer: Reducing the risk of supply chain attacks

#76

Post by yen223 »

Scramblejams wrote: post #17
montroser wrote: post #7

Yes, you are responsible for all the code you ship to your users. Not pinning dependencies is asking for trouble. It is literally, "download random code from the Internet and hope for the best."

Pinning dependencies also means you're missing any security fixes that come in after your pinned versions. That's asking for trouble too, so you need a mechanism by which you become aware of these fixes and either backport them or upgrade to versions containing them.

Things like dependabot or renovate solves the problem of letting you know when security updates are available, letting you have your cake and eat it too.

Re: Less is safer: Reducing the risk of supply chain attacks

#78

Post by edoceo »

codazoda wrote: post #35
CuriouslyC wrote: post #18

Earlier quoted context omitted.

Not a huge electron fan (thank god for tauri), but Obsidian is a fantastic app and you shouldn't let the electron put you off of it. You can even hook a MCP up to it and an agent can use it as a personal knowledge base, it's quite handy.

> Thank god for tauri I’d love to try it, but speaking of security, this was the first thing I saw: sh https://create.tauri.app/sh )

Right. But you know how to fetch and inspect (yea?) so, I with you that piping random crap to sh is bad. Maybe these snips encourage that behavior.

Tauri is trustable (for some loose definition) and the pipe to shell is just a well known happy-path.

All that to say it's a low value smell test.

Also, I'm in the camp that would rather git clone and then docker up. My understanding is it gives me a littl more sandbox.

Post reply on HN