Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Future of Obsidian Plugins

obsidian.md

Post reply on HN
Print view View original

71–80 of 186 posts

Re: The Future of Obsidian Plugins

#71

Post by kepano »

doginasuit wrote: post #63
obsidianbases1 wrote: post #35

Earlier quoted context omitted.

Trusted source > open-source As long as it's trusted, there is no lock-in, and the model supports maintaining the software, what do you have to lose?

I don't think it makes any sense given the history of tech companies to count any of them as a trusted source. Open source doesn't ask for your trust, and it is the only way to get off on the right foot.

Speaking as someone who spends most of his time making open-source software, open source still requires trust. Almost all Obsidian plugins are open source, yet the reason for this new review system is that people don't have the time or ability to vet every line of code of every piece of software. Open source software is only as reliable as the maintenance infrastructure around it. It makes promises that can't be guaranteed about its dependencies, its maintainers, the formats it uses, etc.

See also: https://stephango.com/self-guarantee

Re: The Future of Obsidian Plugins

#72

Post by kepano »

pier25 wrote: post #57
kepano wrote: post #31

Earlier quoted context omitted.

That's because Obsidian is black. But we're planning to add light mode in the near future :)

I'm a fan of Obsidian and your work but dark mode only is an issue for a big percentage of the population. https://medium.com/@h_locke/why-dark-mode-causes-more-access...

The app has had light mode since 2020 :)

Obsidian is a small team and I am pretty much the only person working on the website but I hope to add it soon.

Re: The Future of Obsidian Plugins

#74

Post by kepano »

btown wrote: post #51
kepano wrote: post #30

Obsidian CEO here. We've been working for nearly a year to launch this new Community site and review system. I'm very excited about this first version but there are many more improvements to come. I've tried to be exhaustive with the blog post, FAQs, and next steps on our roadmap, but I am sure I forgot some things, so feel free to ask! This has been an incredibly challenging project for a number of reasons. We're on…

Congrats on the launch! Curious about whether the automated scanning system flags expansions of scope and network domain access for internal/human review. For instance, an AI summarization plugin that starts by saying it accesses url="api.openai.com"+path with a user-supplied OpenAI key is going to be incredibly common - and I'm really excited for what the community builds here! But what if that plugin has an update…

Every update is scanned, and we will be regularly re-scanning all the latest versions of every plugin as we improve the system. The review system is based on our eslint plugin which itself open source and reproducible, so anyone can contribute to improving it: https://github.com/obsidianmd/eslint-plugin

And since plugins are open source, users can also audit the code and flag issues via the Community site.

Re: The Future of Obsidian Plugins

#75

Post by [deleted] »

kepano wrote: post #69
simonw wrote: post #53

Earlier quoted context omitted.

I have a bunch of projects with plugins and I've sometimes thought about introducing a "reviewed" mechanism where the project marks specific versions as reviewed and trusted. One of the things that's held me back (aside from the huge time commitment) is my fear that people will come to depend on that review process, such that if the process misses an obfuscated exploit the project itself will be blamed for the subseq…

I can't speak for other platforms but neither option you propose seems right for Obsidian. I think the right approach for us is somewhere in between. If we were too controlling there wouldn't be the freedom of exploration that we see in the Obsidian community. There are so many niche use cases. Plugins can target a minuscule number of users, and that's a great thing. That's why malleability is one of our core princip…

[deleted]

Re: The Future of Obsidian Plugins

#76

Post by joemi »

presbyterian wrote: post #45
obsidianbases1 wrote: post #35

Earlier quoted context omitted.

Trusted source > open-source As long as it's trusted, there is no lock-in, and the model supports maintaining the software, what do you have to lose?

"there is no lock-in" is a thing that's said a lot about Obsidian and, as an Obsidian fan, I feel like isn't totally true. Yes, Obsidian just stores markdown files, but it has unique syntaxes, especially if you're using plugins, that aren't transferable. So while I can get my files out, I still have to go through the annoying process of fixing them and getting it working in whatever new system I switch to when I leav…

Doesn't seem remotely fair to consider lock-in caused by plugins to be an Obsidian lock-in. If the plugin is storing data in such a way that it's not usable in a tool other than Obsidian, that's 100% the plugin's fault, not Obsidian's no matter which way you look at it.

Also, more generally, any software that has unique features will require "the annoying process of fixing them and getting it working in whatever new system I switch to when I leave", whether it's open source or not. So you're not actually looking for open source, you're just looking for something with perfect feature parity to another program.

Re: The Future of Obsidian Plugins

#77

Post by joemi »

doginasuit wrote: post #63
obsidianbases1 wrote: post #35

Earlier quoted context omitted.

Trusted source > open-source As long as it's trusted, there is no lock-in, and the model supports maintaining the software, what do you have to lose?

I don't think it makes any sense given the history of tech companies to count any of them as a trusted source. Open source doesn't ask for your trust, and it is the only way to get off on the right foot.

> Open source doesn't ask for your trust

And yet, I'd wager my life savings that almost no one using open source software actually verifies that it's not malicious in a different way than one would closed source software (ie. reputation), and instead almost everyone just trusts it.

Re: The Future of Obsidian Plugins

#78

Post by chrisweekly »

kepano wrote: post #74
btown wrote: post #51

Earlier quoted context omitted.

Congrats on the launch! Curious about whether the automated scanning system flags expansions of scope and network domain access for internal/human review. For instance, an AI summarization plugin that starts by saying it accesses url="api.openai.com"+path with a user-supplied OpenAI key is going to be incredibly common - and I'm really excited for what the community builds here! But what if that plugin has an update…

Every update is scanned, and we will be regularly re-scanning all the latest versions of every plugin as we improve the system. The review system is based on our eslint plugin which itself open source and reproducible, so anyone can contribute to improving it: https://github.com/obsidianmd/eslint-plugin And since plugins are open source, users can also audit the code and flag issues via the Community site.

Longtime (early adopter) Obsidian user here. Thank you for such an amazing tool. And congrats on the launch!

Curious if you considered oxlint^1? (It's a a faster, simpler, near drop-in replacement for eslint.)

1. https://oxc.rs/docs/guide/usage/linter.html

Re: The Future of Obsidian Plugins

#79

Post by thinkling »

Groxx wrote: post #64
andai wrote: post #26

Earlier quoted context omitted.

>I think the best (only?) way to solve the plugin security problem would be to properly sandbox them with an explicit API and permission system. I want to say "and especially prevent them from touching my private data (i.e. the whole point of Obsidian plugins being to read/write the documents)". But if it can't talk to the internet, I kind of don't see the issue. EDIT: Apparently due to how JS and Electron works, Obs…

Confirmed: https://obsidian.md/help/plugin-security#Plugin+capabilities There is no sandboxing at all. Every plugin has full access to your computer.

Is there auto-updating of plug-ins?

Installing a plug-in and reviewing its code at that point is one thing. But if the plug-in can be updated withut you knowing, then there’s little guarantee of security.

Re: The Future of Obsidian Plugins

#80

Post by kepano »

chrisweekly wrote: post #78
kepano wrote: post #74

Earlier quoted context omitted.

Every update is scanned, and we will be regularly re-scanning all the latest versions of every plugin as we improve the system. The review system is based on our eslint plugin which itself open source and reproducible, so anyone can contribute to improving it: https://github.com/obsidianmd/eslint-plugin And since plugins are open source, users can also audit the code and flag issues via the Community site.

Longtime (early adopter) Obsidian user here. Thank you for such an amazing tool. And congrats on the launch! Curious if you considered oxlint^1? (It's a a faster, simpler, near drop-in replacement for eslint.) 1. https://oxc.rs/docs/guide/usage/linter.html

It's the first I am hearing about it, but I'll take a look!
Post reply on HN