Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Future of Obsidian Plugins

obsidian.md

Post reply on HN
Print view View original

91–100 of 186 posts

Re: The Future of Obsidian Plugins

#91

Post by AntiUSAbah »

kepano wrote: post #30

Obsidian CEO here. We've been working for nearly a year to launch this new Community site and review system. I'm very excited about this first version but there are many more improvements to come. I've tried to be exhaustive with the blog post, FAQs, and next steps on our roadmap, but I am sure I forgot some things, so feel free to ask! This has been an incredibly challenging project for a number of reasons. We're on…

Finally!

When i tried obsidian and discoverd that the data table thing was not build in but some plugin which has full access, i deleted Obsidian quickly after.

But you are only 7 people? Crazy :D

Re: The Future of Obsidian Plugins

#92

Post by zie »

kepano wrote: post #30

Obsidian CEO here. We've been working for nearly a year to launch this new Community site and review system. I'm very excited about this first version but there are many more improvements to come. I've tried to be exhaustive with the blog post, FAQs, and next steps on our roadmap, but I am sure I forgot some things, so feel free to ask! This has been an incredibly challenging project for a number of reasons. We're on…

I love that under disclosures "Plugin might make requests to 1 external domain", if you click on it, it shows the domain: "github.com". great work!

Example from https://community.obsidian.md/plugins/zotlit

Re: The Future of Obsidian Plugins

#93

Post by tredre3 »

kid64 wrote: post #88
kepano wrote: post #72

Earlier quoted context omitted.

The app has had light mode since 2020 :) Obsidian is a small team and I am pretty much the only person working on the website but I hope to add it soon.

Wtf are you doing with all the money? Hire some actual engineers already, Jesus.

Most people don't pay for Obsidian, do you imagine they're raking in hundreds of millions?

It's hard to know how many users they have, and they're overrepresented on this forum so it's easy to be carried away with our estimates, but let's say they have 1M active users. Then let's say 5% of them pay the $50/yr for sync. That's only $2.5M, divided between 5-10 people.

Good salary, but not outrageous and not much room to add many employees.

Re: The Future of Obsidian Plugins

#94

Post by obsidianbases1 »

AntiUSAbah wrote: post #91
kepano wrote: post #30

Obsidian CEO here. We've been working for nearly a year to launch this new Community site and review system. I'm very excited about this first version but there are many more improvements to come. I've tried to be exhaustive with the blog post, FAQs, and next steps on our roadmap, but I am sure I forgot some things, so feel free to ask! This has been an incredibly challenging project for a number of reasons. We're on…

Finally! When i tried obsidian and discoverd that the data table thing was not build in but some plugin which has full access, i deleted Obsidian quickly after. But you are only 7 people? Crazy :D

Obsidian Bases are built-in data tables.

Re: The Future of Obsidian Plugins

#95

Post by AntiUSAbah »

obsidianbases1 wrote: post #94
AntiUSAbah wrote: post #91

Earlier quoted context omitted.

Finally! When i tried obsidian and discoverd that the data table thing was not build in but some plugin which has full access, i deleted Obsidian quickly after. But you are only 7 people? Crazy :D

Obsidian Bases are built-in data tables.

Wow true since last year of may.

Re: The Future of Obsidian Plugins

#96

Post by trvz »

zie wrote: post #92
kepano wrote: post #30

Obsidian CEO here. We've been working for nearly a year to launch this new Community site and review system. I'm very excited about this first version but there are many more improvements to come. I've tried to be exhaustive with the blog post, FAQs, and next steps on our roadmap, but I am sure I forgot some things, so feel free to ask! This has been an incredibly challenging project for a number of reasons. We're on…

I love that under disclosures "Plugin might make requests to 1 external domain", if you click on it, it shows the domain: "github.com". great work! Example from https://community.obsidian.md/plugins/zotlit

I'd say that may be as harmful as it is helpful. Amateur users may have heard of Github and would therefore trust that domain, but you can upload malware to Github just as easily as anything else.

Re: The Future of Obsidian Plugins

#97

Post by gitgud »

Groxx wrote: post #64
andai wrote: post #26

Earlier quoted context omitted.

>I think the best (only?) way to solve the plugin security problem would be to properly sandbox them with an explicit API and permission system. I want to say "and especially prevent them from touching my private data (i.e. the whole point of Obsidian plugins being to read/write the documents)". But if it can't talk to the internet, I kind of don't see the issue. EDIT: Apparently due to how JS and Electron works, Obs…

Confirmed: https://obsidian.md/help/plugin-security#Plugin+capabilities There is no sandboxing at all. Every plugin has full access to your computer.

Well damn, start the countdown till the inevitable exploit of this.

I’m thinking maybe 1 or 2 weeks from now…

Re: The Future of Obsidian Plugins

#98

Post by kepano »

kid64 wrote: post #89
obsidianbases1 wrote: post #35

Earlier quoted context omitted.

Trusted source > open-source As long as it's trusted, there is no lock-in, and the model supports maintaining the software, what do you have to lose?

In what universe is it trusted? This blog post is an admission that they've been lying to their userbase about their review process for years, with updates receiving no review whatsoever. Enjoy your mass exfiltration.

Huh? The old review process has always been well-documented and occurred via PRs on GitHub completely in the open. It was a known limitation and something that we set out to revamp with the new system.

From the docs:

> The Obsidian team is small and unable to manually review every new release of community plugins. Instead, we rely on the help of the community to identify and report issues with plugins.

https://github.com/obsidianmd/obsidian-help/blob/master/en/E...

Re: The Future of Obsidian Plugins

#99

Post by pier25 »

kepano wrote: post #84
pier25 wrote: post #82

Earlier quoted context omitted.

It works for blog posts and articles but not anything more complex than that.

Try Obsidian Web Clipper's Reader feature for Firefox :) https://obsidian.md/help/web-clipper/reader

Tried it with this URL:

https://community.obsidian.md/

Most of the content is missing.

Re: The Future of Obsidian Plugins

#100

Post by subscribed »

kepano wrote: post #69
simonw wrote: post #53

Earlier quoted context omitted.

I have a bunch of projects with plugins and I've sometimes thought about introducing a "reviewed" mechanism where the project marks specific versions as reviewed and trusted. One of the things that's held me back (aside from the huge time commitment) is my fear that people will come to depend on that review process, such that if the process misses an obfuscated exploit the project itself will be blamed for the subseq…

I can't speak for other platforms but neither option you propose seems right for Obsidian. I think the right approach for us is somewhere in between. If we were too controlling there wouldn't be the freedom of exploration that we see in the Obsidian community. There are so many niche use cases. Plugins can target a minuscule number of users, and that's a great thing. That's why malleability is one of our core princip…

Why not both?

Have the reviewed / approved plug-ins in the directory, whatever that's not a wild west free-for-all-malware, then have two other levels, alpha channel (submitted) and beta channel (machine-reviewed only, not yet approved).

Display only the main channel by default, but make it easy for the user to click through the earning(s) and indemnity message, and enable either of these two.

So I could have stable, slow moving, sanitised plug-ins, but someone else could instantaneously get access to the most recent ones.

Post reply on HN