6 ms·

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disre

by kid64 4mo ago

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

ImPostingOnHN 4mo ago
The attack here requires not just enabling community plugins, but also syncing the attacker's vault to your computer, and also separately enabling the synchronization of the attacker's plugins with yours.
- guiambros 4mo ago
  Yes, in this specific case. Obsidian Plugins are still incredibly vulnerable. A compromised plugin will essentially take over your machine. There's no sandboxing of any kind. It's even more insecure than browser extensions (that could steal your auth tokens, but at least don't have unfettered access to your filesystem). This is really unfortunate. I love Obsidian and am a paid subscriber for many years, but the community plugins needs a security overhaul asap, before someone gets hurt.
  - Ferret7446 4mo ago
    The same is true for all software on your machine.
    - Groxx 4mo ago
      Not even slightly. Browser extensions are a trivial counter-example, as are all flatpacks, and anything restricted by user/group. That covers probably literally a majority of all software on your computer, because people have been voluntarily restricting their software to protect you from their potential accidents for decades.
      - ImPostingOnHN 4mo ago
        > That covers probably literally a majority of all software on your computer If you're running GNU/Linux, chances are you'll have hundreds, if not thousands, of pieces of software that run totally unsandboxed. Yes, a very small minority of applications are unfortunately primarily distributed via flatpak or snap, and the distributors don't care about the user experience, so it's error-ridden and problem-ridden, but chances are you can get a "normal computer program" version of it unencumbered by such grossness.
        Groxx 4mo ago
        And tons won't be part of e.g. root, or dialout (to pick one I've had to deal with a lot lately), or many other more-privileged-than-default groups, yes. That's a permissions system working as intended. Besides. They said "all software on your machine". That is trivially false, to a significant degree.
        ImPostingOnHN 4mo ago
        I was pointing out that the claim that "literally a majority of all software on your computer" runs sandboxed is also trivially false, to a significant degree
        Groxx 4mo ago
        A majority have more access controls than obsidian plugins, yes. I think that's fairly safe to say, given that new system installs often have hundreds of processes already running. Sandboxing, at least in the sense of easily configurable access with default deny on most even somewhat sensitive things: agreed, sandboxing is fairly uncommon in general, definitely not a majority on most systems. When ignoring the elephant in the room: mobile OSes.
        ImPostingOnHN 4mo ago
        > A majority have more access controls than obsidian plugins, yes A majority run as me, a minority run with root privileges. > I think that's fairly safe to say, given that new system installs often have hundreds of processes already running. Precisely! Those hundreds of pre installed processes are running without sandboxing, or any access control beyond what Obsidian has. For example, did you know you can just `ls` a directory, or `cat` a file, and both of those applications will run with full, unsandboxed, unrestricted access as you? And there are countless preinstalled applications just like those.
kid64 4mo ago
Yeah, but these attacks are possible without any of that complexity.
Loocid 4mo ago
As one of those people that uses Obsidian without plugins, what plugins do you consider essential?
- cpach 4mo ago
  Same here, zero plugins for me.
- fnordlord 4mo ago
  I rely on Advanced URI, which opens certain functionality up to external apps. I use Raycast and with Cmd+Space, it lets me open vaults or daily notes. And Obsidian_to_Anki, but that's probably just me because I have no clue how to use Anki otherwise.
- troad 4mo ago
  Me too. All I want is a top-notch Markdown editor with a mobile app and trustworthy sync, and that's what Obsidian gives me. And if ever Obsidian goes away or is enshittified, I'll still have a perfectly good folder of Markdown documents that I can take elsewhere.
- lossyalgo 4mo ago
  An ADD/SUM feature on tables was the first plugin I installed. It could be argued this should be part of the TABLE but I guess the dev team has a lot on their plate not to mention I'm not even sure if there's a feature request for this ability.
- pfooti 4mo ago
  Yeah, I don't use any community plugins. I take notes in obsidian. And it turns out, having multiple years worth of notes and todos in a tree of crosslinked markdown files is pretty handy in this AI era. I take notes in obsidian and run the Gemini cli from my vault. Works a treat.
- wolvoleo 4mo ago
  For me these are the self hosted livesync, copilot and readitlater for better web clippings. I really don't want my notes on other people's servers so the official sync will never be an option unless they enable that to be self hosted as an option.
Barrin92 4mo ago
I think that's especially important to point out because it reminded me of a blog post by Obsidian that also was discussed here[1], where they talked about reducing supply chain risk by not relying on dependencies, but people quickly pointed out that this is only possible because users depend so heavily on extensions. Just look at that top comment and here we are now. This combination of software relying on third parties without security seems to be untenable. Personally I've gotten rid of just about as many extensions as I can anywhere and switched to batteries included software. [1]https://news.ycombinator.com/item?id=45307242 https://news.ycombinator.com/item?id=45307242
deleted 4mo ago
[deleted]
AlienRobot 4mo ago
The real problem is people believing "plugins" are not full software. If you install a dozen mini-apps from random developers you never heard about, you can't complain if one is malware. Krita also has a plugin system based on Python. Any "plugin" has the same level of access as running a python script. Personally I blame operating systems for not providing a way to isolate how programs interact with user files.
- pdpi 4mo ago
  Software engineers at large would benefit from playing World of Warcraft, and seeing the ongoing fight between Blizzard and add-on authors. WoW's whole UI is built in the same Lua environment as add-ons, and Blizzard has implemented some interesting restrictions (like the taint system[0]) to prevent add-ons from completely automating gameplay. 0. https://wowpedia.fandom.com/wiki/Secure_Execution_and_Tainting https://wowpedia.fandom.com/wiki/Secure_Execution_and_Tainti...
  - AlienRobot 4mo ago
    World of Warcraft is one of the most popular MMO's ever made. You simply can't expect every software that wants a plugin system to have the same security practices as the most used software in the world. In fact, there are many reasons why you might want a plugin to have full filesystem and internet access, such as batch processing or simply adding things directly from webpages. Sandboxing this will just make plugins less useful. In the end it's a problem of trust. You're installing software from untrustworthy developers because you trust the name of the application those plugins are associated with. You could fix the problem in Obsidian, but the same problem will happen in other software. Some of which simply can't justify bothering with sandboxing plugins. This is just the way plugins are.
    - pdpi 4mo ago
      > You simply can't expect every software that wants a plugin system to have the same security practices as the most used software in the world. I'm not saying that I think they should, or that I expect them to. I'm saying that it's one particular implementation of sandboxing that has a bunch of interesting properties, and that makes it worth studying.
jjice 4mo ago
But I use it every day without plugins. Seriously though, I agree with your sentiment that community plugin security can and needs to be improved, but how does someone saying they use it every day "disregard software usability as a formal discipline, along with decades of UX research and standards"
wasabi991011 4mo ago
If you want to use a niche, academic definition of "usable", that's fine but you better be ready to explain yourself. Because in general, "usable" means "people use it". Which they do for Obsidian without community plugins without issues.
- eviks 4mo ago
  To make an actual counter, you need numbers. If only a tiny niche of users use it without community plugins, then yes, it's unusable (in a practical definition of the term)
  - joemi 4mo ago
    If that's so, then without numbers, it's neither usable nor unusable.
    - eviks 4mo ago
      Indeed, if you don't know anything about use, you can't say much about usability.
raincole 4mo ago
> Obsidian is not a usable system without community plugins. It's horse hockey. Plenty users use the vanilla Obsidian. > Folks will reply "but I use it every day without plugins". Because they do. You're saying that they should lie about their usage to fit your narrative?
- PurpleRamen 4mo ago
  > Plenty users use the vanilla Obsidian. They are irrelevant for this dispute, because these problems do not concern them. And the amount of people using plugins because of some real demand is not low.
  - deleted 4mo ago
    [deleted]
  - raincole 4mo ago
    What dispute? The parent comment says that Obsidian is not usable without plugins and it's simply nonsense. It would be very charitable to call this a "dispute." Could Obsidian handle plugin permission better? I guess so. But that doesn't mean the users have to use plugins. It's ultimately the user's choice. Blender has zero security guards over the addons besides the OS's and the ecosystem thrives. So does Minecraft. These communities are essentially "arbitrary Python/Java code goes brrrr."
    - PurpleRamen 4mo ago
      > What dispute? The discussion about the plugin-system, and the people who need it to which degree. > The parent comment says that Obsidian is not usable without plugins and it's simply nonsense. Sure, fair. But the comment happened in the context of talking about the plugin-system, and parent comment seems on the side that for them obsidian is worthless without plugins. Saying that other people have no need for them is pointless, because they are not in the picture. Phrasing could indeed be better, but talking about people who are not concerned by the problem is not really adding anything to the discussion.
jpk2f2 4mo ago
Using it daily without plugins is, by definition, a "usable system".

by kid64 4mo ago

ImPostingOnHN 4mo ago

The attack here requires not just enabling community plugins, but also syncing the attacker's vault to your computer, and also separately enabling the synchronization of the attacker's plugins with yours.

guiambros 4mo ago
Yes, in this specific case. Obsidian Plugins are still incredibly vulnerable. A compromised plugin will essentially take over your machine. There's no sandboxing of any kind. It's even more insecure than browser extensions (that could steal your auth tokens, but at least don't have unfettered access to your filesystem). This is really unfortunate. I love Obsidian and am a paid subscriber for many years, but the community plugins needs a security overhaul asap, before someone gets hurt.
- Ferret7446 4mo ago
  The same is true for all software on your machine.
  - Groxx 4mo ago
    Not even slightly. Browser extensions are a trivial counter-example, as are all flatpacks, and anything restricted by user/group. That covers probably literally a majority of all software on your computer, because people have been voluntarily restricting their software to protect you from their potential accidents for decades.
    - ImPostingOnHN 4mo ago
      > That covers probably literally a majority of all software on your computer If you're running GNU/Linux, chances are you'll have hundreds, if not thousands, of pieces of software that run totally unsandboxed. Yes, a very small minority of applications are unfortunately primarily distributed via flatpak or snap, and the distributors don't care about the user experience, so it's error-ridden and problem-ridden, but chances are you can get a "normal computer program" version of it unencumbered by such grossness.
      - Groxx 4mo ago
        And tons won't be part of e.g. root, or dialout (to pick one I've had to deal with a lot lately), or many other more-privileged-than-default groups, yes. That's a permissions system working as intended. Besides. They said "all software on your machine". That is trivially false, to a significant degree.
        ImPostingOnHN 4mo ago
        I was pointing out that the claim that "literally a majority of all software on your computer" runs sandboxed is also trivially false, to a significant degree
        Groxx 4mo ago
        A majority have more access controls than obsidian plugins, yes. I think that's fairly safe to say, given that new system installs often have hundreds of processes already running. Sandboxing, at least in the sense of easily configurable access with default deny on most even somewhat sensitive things: agreed, sandboxing is fairly uncommon in general, definitely not a majority on most systems. When ignoring the elephant in the room: mobile OSes.
        ImPostingOnHN 4mo ago
        > A majority have more access controls than obsidian plugins, yes A majority run as me, a minority run with root privileges. > I think that's fairly safe to say, given that new system installs often have hundreds of processes already running. Precisely! Those hundreds of pre installed processes are running without sandboxing, or any access control beyond what Obsidian has. For example, did you know you can just `ls` a directory, or `cat` a file, and both of those applications will run with full, unsandboxed, unrestricted access as you? And there are countless preinstalled applications just like those.

kid64 4mo ago

Yeah, but these attacks are possible without any of that complexity.

Loocid 4mo ago

As one of those people that uses Obsidian without plugins, what plugins do you consider essential?

cpach 4mo ago
Same here, zero plugins for me.
fnordlord 4mo ago
I rely on Advanced URI, which opens certain functionality up to external apps. I use Raycast and with Cmd+Space, it lets me open vaults or daily notes. And Obsidian_to_Anki, but that's probably just me because I have no clue how to use Anki otherwise.
troad 4mo ago
Me too. All I want is a top-notch Markdown editor with a mobile app and trustworthy sync, and that's what Obsidian gives me. And if ever Obsidian goes away or is enshittified, I'll still have a perfectly good folder of Markdown documents that I can take elsewhere.
lossyalgo 4mo ago
An ADD/SUM feature on tables was the first plugin I installed. It could be argued this should be part of the TABLE but I guess the dev team has a lot on their plate not to mention I'm not even sure if there's a feature request for this ability.
pfooti 4mo ago
Yeah, I don't use any community plugins. I take notes in obsidian. And it turns out, having multiple years worth of notes and todos in a tree of crosslinked markdown files is pretty handy in this AI era. I take notes in obsidian and run the Gemini cli from my vault. Works a treat.
wolvoleo 4mo ago
For me these are the self hosted livesync, copilot and readitlater for better web clippings. I really don't want my notes on other people's servers so the official sync will never be an option unless they enable that to be self hosted as an option.

Barrin92 4mo ago

I think that's especially important to point out because it reminded me of a blog post by Obsidian that also was discussed here[1], where they talked about reducing supply chain risk by not relying on dependencies, but people quickly pointed out that this is only possible because users depend so heavily on extensions. Just look at that top comment and here we are now. This combination of software relying on third parties without security seems to be untenable. Personally I've gotten rid of just about as many extensions as I can anywhere and switched to batteries included software. [1]https://news.ycombinator.com/item?id=45307242 https://news.ycombinator.com/item?id=45307242

deleted 4mo ago

[deleted]

AlienRobot 4mo ago

The real problem is people believing "plugins" are not full software. If you install a dozen mini-apps from random developers you never heard about, you can't complain if one is malware. Krita also has a plugin system based on Python. Any "plugin" has the same level of access as running a python script. Personally I blame operating systems for not providing a way to isolate how programs interact with user files.

pdpi 4mo ago
Software engineers at large would benefit from playing World of Warcraft, and seeing the ongoing fight between Blizzard and add-on authors. WoW's whole UI is built in the same Lua environment as add-ons, and Blizzard has implemented some interesting restrictions (like the taint system[0]) to prevent add-ons from completely automating gameplay. 0. https://wowpedia.fandom.com/wiki/Secure_Execution_and_Tainting https://wowpedia.fandom.com/wiki/Secure_Execution_and_Tainti...
- AlienRobot 4mo ago
  World of Warcraft is one of the most popular MMO's ever made. You simply can't expect every software that wants a plugin system to have the same security practices as the most used software in the world. In fact, there are many reasons why you might want a plugin to have full filesystem and internet access, such as batch processing or simply adding things directly from webpages. Sandboxing this will just make plugins less useful. In the end it's a problem of trust. You're installing software from untrustworthy developers because you trust the name of the application those plugins are associated with. You could fix the problem in Obsidian, but the same problem will happen in other software. Some of which simply can't justify bothering with sandboxing plugins. This is just the way plugins are.
  - pdpi 4mo ago
    > You simply can't expect every software that wants a plugin system to have the same security practices as the most used software in the world. I'm not saying that I think they should, or that I expect them to. I'm saying that it's one particular implementation of sandboxing that has a bunch of interesting properties, and that makes it worth studying.

jjice 4mo ago

But I use it every day without plugins. Seriously though, I agree with your sentiment that community plugin security can and needs to be improved, but how does someone saying they use it every day "disregard software usability as a formal discipline, along with decades of UX research and standards"

wasabi991011 4mo ago

If you want to use a niche, academic definition of "usable", that's fine but you better be ready to explain yourself. Because in general, "usable" means "people use it". Which they do for Obsidian without community plugins without issues.

eviks 4mo ago
To make an actual counter, you need numbers. If only a tiny niche of users use it without community plugins, then yes, it's unusable (in a practical definition of the term)
- joemi 4mo ago
  If that's so, then without numbers, it's neither usable nor unusable.
  - eviks 4mo ago
    Indeed, if you don't know anything about use, you can't say much about usability.

raincole 4mo ago

> Obsidian is not a usable system without community plugins. It's horse hockey. Plenty users use the vanilla Obsidian. > Folks will reply "but I use it every day without plugins". Because they do. You're saying that they should lie about their usage to fit your narrative?

PurpleRamen 4mo ago
> Plenty users use the vanilla Obsidian. They are irrelevant for this dispute, because these problems do not concern them. And the amount of people using plugins because of some real demand is not low.
- deleted 4mo ago
  [deleted]
- raincole 4mo ago
  What dispute? The parent comment says that Obsidian is not usable without plugins and it's simply nonsense. It would be very charitable to call this a "dispute." Could Obsidian handle plugin permission better? I guess so. But that doesn't mean the users have to use plugins. It's ultimately the user's choice. Blender has zero security guards over the addons besides the OS's and the ecosystem thrives. So does Minecraft. These communities are essentially "arbitrary Python/Java code goes brrrr."
  - PurpleRamen 4mo ago
    > What dispute? The discussion about the plugin-system, and the people who need it to which degree. > The parent comment says that Obsidian is not usable without plugins and it's simply nonsense. Sure, fair. But the comment happened in the context of talking about the plugin-system, and parent comment seems on the side that for them obsidian is worthless without plugins. Saying that other people have no need for them is pointless, because they are not in the picture. Phrasing could indeed be better, but talking about people who are not concerned by the problem is not really adding anything to the discussion.

jpk2f2 4mo ago

Using it daily without plugins is, by definition, a "usable system".