Less is safer: How Obsidian reduces the risk of supply chain attacks

I’ve been using other apps than Obsidian for notes and sharing, so this is nice to read and consider. But isn’t Obsidian an electron app or whatever? Electron has always seemed resource intensive and not native. JavaScript has never struck me as “secure”. Am I just out of touch?

JavaScript is a very secure language. The browser is a massive success at running secure JavaScript on a global scale. Every website you use is running JavaScript and not able to read other site data. Electron is the same, running v8 to sandbox JavaScript. Assuming you aren't executing user input inside that sandbox (something many programming languages allow, including JS), it's very secure.

The problem with supply chain attacks is specifically related to npm, and not related to JS. npm as an organization needs to be taking more responsibility for the recent attacks and essentially forcing everyone to use more strict security controls when publishing their dependencies.

Javascript is probably one of the most used, depending on how you measure it, languages on earth.

It runs on a majority of computers and basically all phones. There will be many security issues that get discovered b y virtue of these facts.

What makes you think that "native" apps are any more secure?

Doesn’t this mean browser sandboxing is secure, not JS? Or are you referring to some specific aspect of JS I’m not aware of? (I’m not aware of a lot of JS)

It’s maybe a nit-pick, since most JS is run sandboxed, so it’s sort of equivalent. But it was explicitly what GP asked for. Would it be more accurate to say Electron is secure, not JS?

Not a huge electron fan (thank god for tauri), but Obsidian is a fantastic app and you shouldn't let the electron put you off of it. You can even hook a MCP up to it and an agent can use it as a personal knowledge base, it's quite handy.

> Thank god for tauri

I’d love to try it, but speaking of security, this was the first thing I saw:

sh <(curl https://create.tauri.app/sh)

It is resource intensive.

It's not a problem on pc, but an obsidian vault with thousands of notes can have a laggy startup on mobile, even if you disable plugins.

Users sidestep this issue with quick capture plugins and apps, but I wish there was a native stripped-down version of obsidian.

No, it's not really an issue. GitHub and VS Code are also Electron apps. So are Slack and Discord. Postman is, as well.

I'd also be forced to ask... what exactly are you doing with a markdown note-taking application such that performance is a legitimate concern?

But, I mean, maybe you're reading this in a Lynx session on your ThinkPad 701C.

If you have to render html, which is what markdown ultimately becomes, you might as well use a web broswer.

I'm really curious about this comment. What would it mean for a programming language to be secure?

Any two Turing-complete programming languages are equally secure, no?

Surely the security can only ever come from whatever compiles/interprets it? You can run JavaScript on a piece of paper.

A number of operating system security features, such as ASLR, exist because low level languages allow reading and writing memory that they didn't create.

Conversely, barring a bug in the runtime or compiler, higher level languages don't enable those kinds of shenanigans.

See for example the heart bleed bug, where openssl would read memory it didn't own when given a properly malformed request.

Turing completeness is irrelevant, as it only addresses computation. Security has to do with system access, not computational capacity. Brainfuck is Turing complete, but lacks any primitives to do more than read from a single input stream and write to a single output stream. Unless someone hooks those streams up to critical files, you can't use it to attack a system.

Language design actually has a lot of impact on security, because it defines what primitives you have available for interacting with the system. Do you have an arbitrary syscall primitive? Then the language is not going to help you write secure software. Is your only ability to interact with the system via capability objects that must be provided externally to authorize your access? Then you're probably using a language that put a lot of thought into security and will help out quite a lot.

Right. But you know how to fetch and inspect (yea?) so, I with you that piping random crap to sh is bad. Maybe these snips encourage that behavior.

Tauri is trustable (for some loose definition) and the pipe to shell is just a well known happy-path.

All that to say it's a low value smell test.

Also, I'm in the camp that would rather git clone and then docker up. My understanding is it gives me a littl more sandbox.

Javascript is a lot more secure than C++, since it's a memory managed language.

> what exactly are you doing with a markdown note-taking application such that performance is a legitimate concern?

Launching it and expecting a fast startup.

Buffer overflows are 0.001 percent of security incidents in practice.

Let's fix private key leakage and supply chain issues before worrying about C++ haxxors p0wning your machines.

I need more evidence to believe this.

I mean, JavaScript doesn’t even have APIs for reading a file from disk, let alone executing an arbitrary binary. (Anything similar comes from a runtime like NodeJS.) You can’t access memory in different JS processes… so what would make it insecure?

To be fair, a plugin system built on JS with all plugins interacting in the same JS context as the main app has some big risks. Anything plugin can change definitions and variable in the global scope with some restrictions. But any language where you execute untrusted code in the same context/memory/etc as trusted code has risks. the only solution is sandboxing plugins

I think I would prefer to see official supports for major package managers, even with unofficial repos (Debian, Macports,...). We went from a time where software were usually tarballed to one where devs are encouraging piping to shell.

That’s a reason I moved away from Notion. The startup is so terribly slow (perhaps because it’s updating too often?).