←back to thread

Less is safer: How Obsidian reduces the risk of supply chain attacks

(obsidian.md)
421 points saeedesmaili | 3 comments | 19 Sep 25 22:02 UTC | HN request time: 0.778s | source
Show context
gejose ◴[19 Sep 25 23:42 UTC] No.45308131[source]▶
This is one way to look at it, but ignores the fact that most users use third party community plugins.

Obsidian has a truly terrible security model for plugins. As I realized while building my own, Obsidian plugins have full, unrestricted access to all files in the vault.

Obsidian could've instead opted to be more 'batteries-included', at the cost of more development effort, but instead leaves this to the community, which in turn increases the attack surface significantly.

Or it could have a browser extension like manifest that declares all permissions used by the plugin, where attempting to access a permission that's not granted gets blocked.

Both of these approaches would've led to more real security to end users than "we have few third party dependencies".

replies(18): >>45308149 #>>45308208 #>>45308212 #>>45308222 #>>45308224 #>>45308241 #>>45308572 #>>45308600 #>>45308749 #>>45310219 #>>45310642 #>>45310881 #>>45310991 #>>45311185 #>>45311760 #>>45311782 #>>45312975 #>>45313054 #
1. zargon ◴[19 Sep 25 23:51 UTC] No.45308208[source]▶
That's ok. I haven't come across an Obsidian plug-in that's worth introducing a dependency for.
replies(1): >>45308269 #
2. myvoiceismypass ◴[19 Sep 25 23:59 UTC] No.45308269[source]▶
I use “Templater” and “Dataview” but now I am rethinking my usage; they were required for the daily template I use (found here on HN) but this is probably overkill.
replies(1): >>45308329 #
3. cgriswald ◴[20 Sep 25 00:08 UTC] No.45308329[source]▶
I did too but have switched over to “bases” now that that’s in core. Before that I had an apparmor profile restricting Obsidian from reaching the web.