11 ms·

Be Careful with Obsidian

127 points by allenleee 1y ago

terespuwash 1y ago
There are many good reasons to trust Obsidian team (they are not VC backed, they clearly state they don’t own your data, you are not locked in). If you don’t trust them because they are not open-source then If you want to be a purist about it, then just use an open-source markdown editor instead.
- kgwgk 1y ago
  > they clearly state seems a low bar for trusting (that part especifically)
  - efilife 1y ago
    Your files are stored locally in .md
- miggol 1y ago
  The author dedicates an entire paragraph to how much they trust the Obsidian team. It isn't open source purism, they are warning users that good intentions don't prevent a developer from writing software containing vulnerabilities. Usage of user-created plugins and access to cloud accounts aggravates the risk posed by a vulnerability. Open source reduces vulnerabilities over time, so those who want to heed the author's warning may indeed want to switch to an open-source Markdown editor. Just not because the Obsidian team is Evil.
  - illiac786 1y ago
    The title is either poorly chosen or shows a different intention than the content of the article I would argue. The objective seems to scare readers, and then nuance the statement in the article. Some call this clickbait, at the expense of the great obsidian team.
bobertdowney 1y ago
> Obsidian’s source code is closed When I toggle developer mode (Command + Option + i on my mac) I see what appears to be the source code (it’s an Electron app). Maybe it’s not the full source though. And I guess it’s very difficult to read since it’s minified.
- swiftcoder 1y ago
  Open-source is not about being able to view the source code at point-of-execution. It's about having a license to modify/distribute that source code
- gorgabal 1y ago
  That is not meaningfully open source. Even if that would be the full source code, it still wouldn't have an open source licence, although then it technically would be free(as in freedom) software, not just open source, but most people assume open source = free software. I trust the obsidian team, but I don't trust the plugins.
k8sToGo 1y ago
Is this a Mac thing? On Windows this is how most applications are distributed. Same with Spotify etc. Also even if it is open source, who really verifies the binary is built from the source published?
- justincormack 1y ago
  Mac app store distribution is not that common. Some apps are available in the store or as direct downloads. The store adds the sandboxing restrictions, which dont work for many apps, eg its not very easy to install a cli.
- joshvm 1y ago
  > Also even if it is open source, who really verifies the binary is built from the source published? Apple notarization is usually the way for non Store downloads. Non-notarized apps present a warning and require overriding security settings to run (with admin privilege). There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub, only that some sanity checks have been performed and the binary is not a known threat (or has been modified). https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution https://developer.apple.com/documentation/security/notarizin...
  - bobertdowney 1y ago
    > There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub Sorry what if the open source project made their CI/CD pipeline public? So users could exercise it, produce their own build, and then compare that to the notarized one? Would I then be able to verify that what I downloaded from the developer’s website is identical to what is built with the open source code? Just curious.
    - warpspin 1y ago
      In theory, yes, you could compare it. In practice, the build would need to be reproducible which is non-trivial depending on the size the of the project and the external dependencies the project itself has.
tonyhart7 1y ago
need obsidian open source alternative
- mastazi 1y ago
  I'm not sure what your needs are, but I've been using Joplin and it works for me.
  - teekert 1y ago
    Tried Joplin, it creates an unholy mess of files. I far prefer the clear format of Obsidian.
    - ezst 1y ago
      Next step is to give up on files/filesystem. As long as it's opensource, there's no lock-in. As long as the storage backend is clean and structured (SQLite or comparable), you actually get so much more (full text indexing, standard querying, ...) I initially was cautious when going from "bunch of .MD files" to https://triliumnotes.org/ https://triliumnotes.org/ , since it's been pretty great.
      - teekert 1y ago
        Hmmm, it has been years since I last tried it, perhaps it is time for another chance indeed. Thanx.
- rubymamis 1y ago
  You can check my FOSS note-taking app: https://notes-foss.com https://notes-foss.com
  - pcthrowaway 1y ago
    Looks great! I'll follow along so I can try it out if syntax-aware code blocks and callouts are ever supported
imputation 1y ago
I had to do some gap analysis between note-taking apps with a graph view functionality to allow me to visualise my knowledge-base. Obsidian was my initial choice but I had grievances with it. I ended up going with Logseq for many reasons - yes it appears to be less mature however that doesn't mean that it is inferior by any measure (and open-source)
- Lapel2742 1y ago
  > I ended up going with Logseq for many reasons - yes it appears to be less mature however that doesn't mean that it is inferior by any measure (and open-source) If I remember correctly it was inferior to Obsidian because Logseq used a proprietary format. Yes, it was/is officially markdown but not in a format that is easily transferred. I don't know if it changed but Logseq documents where literally just a big Markdown list if I remember correctly. Personally I do see the problem with closed source solutions but the real problem with Obsidian are AFAIk the plugins and not the App itself. I mean: They have a long way to go to be even remotely as evil as people at Google or Microsoft. But if that ever happens I simply walk away with my .md documents.
  - deleted 1y ago
    [deleted]
  - quxbar 1y ago
    Exactly this. After the enshittification of evernote I swore I would only write documents in formats and contexts where I can easily pick up and move.
- ezst 1y ago
  On the same boat few months (actually, almost 2 years!) ago, I found Logseq too limiting as soon as one need to manage notes consistently ("typing" them as collections of notes of similar nature and acting on their properties as metadata), went through quite a long list of contenders (including AnyType) and ultimately settled with https://triliumnotes.org/ https://triliumnotes.org/
  - 1y ago
Havoc 1y ago
Don’t really see much of a reason to single out obsidian in this
msuniverse2026 1y ago
I really like the obsidian canvas.
jiri 1y ago
But files obsidian works with are just bunch of .md files that can be viewed or edited with anything, nano, notepad, visual studio code etc. So does it really matter it is or it is not open source?
- worthless-trash 1y ago
  It does if you care about your editor.
- eviks 1y ago
  How is your point relevant to the security risks of community plugins? But also - no, they aren't, they use plugin-customized non-standard markdown format, so while the extension is the same, you can't view/edit them with anything just like you can't edit Word xml files with notepad (of course, it's not as extreme as Word xml, unless you're an extreme user of custom plugins)
- phoronixrly 1y ago
  It does if you care about running shady binary blobs on your system, and if you care about ethics.
moooo99 1y ago
I think the increasingly widespread attitude that only open source software is good and trustworthy increasingly annoying and problematic. Building software takes time and resources. Experienced show that most open source projects do not make enough money to make the resource investment worthwhile, much less the time investment. I generally like people being able to out food on the table, and if that means I have to pay for their software to use it or get updates, then I am happy to do so if that software is of value for me. That of course doesn‘t mean I appreciate unnecessary vendor lock in, hostile subscription models, etc. All of these things are common with proprietary software, but they are not inherent to it. Obsidian is a great example. Easy to takeout open formats, generous licensing model and no aggressive licensing implementation that makes it impossible to use the software offline. The team behind it seems to be able to make a living and people can still feel safe about the access to their notes. Even if its not open source, it would be great progress if we‘ve had more software like obsidian
- phoronixrly 1y ago
  Closed-source software is unethical regardless of any of your unsubstantiated claims on its or open-source software's security.
  - iamsaitam 1y ago
    Why do you think it's unethical?
    - phoronixrly 1y ago
      I will assume you're not trolling but that just don't know what FOSS is about. Check this out https://www.gnu.org/philosophy/free-sw.en.html https://www.gnu.org/philosophy/free-sw.en.html
      - sanswork 1y ago
        You don't have to be ignorant of FOSS to disagree with the statement that closed source software is unethical.
ihorcher 1y ago
The scary thing is that nowadays everything is backdoored. And developers/product owners can even don't know about it. Obsidian is an electron app, thus uses npm, and with npm we now get like at least one malicious package per month. If they have package autoupdate it's just a matter of time and effort for an attacker to plant something shady there. This could be simple crypto-stealer, or this could be a way to access people's personal vaults.
- Rohansi 1y ago
  What is the alternative? Everyone stop using package managers?
eviks 1y ago
Plugin sandboxing is the answer to such community extension concerns, but then that's unfortunately only part of the bright future ahead...
dsissitka 1y ago
If you're a Linux user you might like Firejail for this. firejail --appimage --net=none --private=~/path/to/jail ~/path/to/Obsidian.AppImage --private=~/path/to/jail limits access to your home directory to ~/path/to/jail and when you don't want Obsidian to have internet access you can take it away with --net=none.
- elric 1y ago
  Note that if you already have an Obsidian vault, suddenly jailing it might break things. Obsidian stores a bunch of state in ~/.config/obsidian which will no longer be valid. And amusingly/frustratingly, the GTK file picker doesn't take the jail into account and seems to produce invalid paths. And because --private mounts some bits as temporary filesystems, you might end up losing state. Try before you buy.
  - sph 1y ago
    And all of these issues such as sandboxing and portals are solved by using the Flatpak version instead.
    - nchmy 1y ago
      I don't know much about flatpak. How does it solve these issues?
      - sph 1y ago
        It provides a sandbox, an API to access stuff outside of it (portals), and standard tools to customize what your software has access to (Flatseal, KDE app settings). It's based on the same technology as Docker containers, but for user-space GUI apps. AppImage is a binary distribution format that does none of that stuff, so you need external tools, like firejail, to limit what the application has access to.
Robdel12 1y ago
This is ridiculous. The macOS app is signed. codesign -dv /Applications/Obsidian.app Executable=/Applications/Obsidian.app/Contents/MacOS/Obsidian Identifier=md.obsidian Format=app bundle with Mach-O universal (x86_64 arm64) CodeDirectory v=20500 size=759 flags=0x10000(runtime) hashes=13+7 location=embedded Signature size=8975 Timestamp=Sep 29, 2025 at 12:22:41 PM Info.plist entries=39 TeamIdentifier=6JSW4SJWN9 Runtime Version=15.4.0 Sealed Resources version=2 rules=13 files=23 Internal requirements count=1 size=172 Also, I love OSS as much as the next person, but not everything needs to be.
- eviks 1y ago
  does the fact that the app is signed mean it must use sandboxing? > it isn’t required to use sandboxing
- pcthrowaway 1y ago
  I'm not sure how this is relevant? The code is signed but that doesn't mean it doesn't contain backdoors. Without it being open source or at the very least source-available, we can't know This is of course true of many other apps we run on Mac (though I suspect a non-zero number of common apps have backdoors); Obsidian also runs without sandboxing though, is used by many to record their innermost thoughts, and as the author mentioned, there's also the potential for data to leak via compromised extensions. Am I missing something, or does the fact that it's signed tell us nothing except that the Obsidian company signed off on it? If so, I'd really like to understand if you had a purpose of sharing this... is there a tacit implication that "surely a company can be trusted"?
agsnu 1y ago
I wouldn’t hold not being on the Mac App Store against it. The MAS is sort of a failed ecosystem with very low usage/engagement, and all the downsides of the iOS store like potentially lengthy review times (can be a lot longer than the iOS store since it seems to play second fiddle) and arbitrary capricious rejections when you’re just trying to ship innocuous bug fixes to users.
colesantiago 1y ago
Would it be best to be closed source and pay to get the source code with 1 year updates, (except say license server unless you're enterprise)? That way the author can still keep the source closed and those who want code can pay for it. I very rarely see OSS being monetized successfully without a community fork destroying the original project. OSS still requires money to maintain the project and sparse donations really don't really cut it.
deafpolygon 1y ago
I know this may go against the ethos of some folks on HN, but I switched to Apple Notes and haven't looked back. At the end of the day, you either use the tool or the tool uses you. For diagrams, mindmaps, etc... I just use Freeform now -- screen capture or export the board as PDF to paste into my notes. It's deceptively flexible and more powerful than it would appear.
- CaRDiaK 1y ago
  to add, in the latest version of MacOS / iOS you can import / export as Markdown, which is quite nice.
ugur2nd 1y ago
Obsidian is a startup that's been on my radar. It inspires me. They're able to go so far as to challenge Notion with their small team, which I appreciate. By the way, I'm not saying Notion is bad. I think it's revitalizing the industry. On the other hand, I was unaware of the vulnerabilities in the Apple ecosystem. Or rather, I didn't think there would be. The article raised my awareness.
deleted 1y ago
[deleted]
thomascountz 1y ago
The set of open source code and verifiable code overlap, but one doesn't always imply the other. In either case, provenance needs to be established. I think it would be reasonable for Obsidian to ship signed checksums and a public transparency log (e.g., Sigstore) for builds (plugins authors could do the same?). A more granular plugin permissions system would be great too, even though most plugins are OSS.
freefaler 1y ago
It's a strange article. Yes it's not an open source, but based on what is the author suspicious? Any bad behaviours from the authors? Change of ownership? Plugin risks? For me this is the least problematic non-open source software: - non VC funded (like Mattermost enshitification after VC) - open source formats - community plugins with source code (it's JS)
reassess_blind 1y ago
You should always be careful with closed source software. You should also be careful with open source software, unless you're building from source and manually checking the source in each update isn't malicious, which let's be real, nobody does.
- warpspin 1y ago
  Plus, in theory you'd also need reproducible builds for everything because who knows what your compiler did to the source ;-) Reality is, as you already implied: in practice you cannot "be careful" except avoiding obvious malware. At SOME point you have to trust SOMEONE, unless you use TempleOS in which case you can trust whatever god you have.
nrvn 1y ago
Not being able to give granular permissions to folders is not the problem of an app which regardless of being open or closed source may be compromised. Remember that the risk is zero if and only if you avoid the risk, i.e. in this particular case do not install Obsidian. Macos: - does not have a granular permissions model as far as I know; - deprecated sandbox-exec that allowed to achieve the above; - macos appstore is a very strange phenomenon, I would not put much trust in it by default. Obsidian: - has a system of community plugins and themes which is dangerous and has been discussed multiple times[0]. But the problem of managing community plugins is not unique to them. Malicious npm packages, go modules and rust crates (and you name it) anyone?.. you are on your own here mostly. And you need to perform your own due diligence of those community supported random bits. Obsidian could hugely benefit from an independent audit of the closed source base. That would help build trust in the core of their product. [0]: https://www.emilebangma.com/Writings/Blog/An-open-letter-to-the-Obsidian-team https://www.emilebangma.com/Writings/Blog/An-open-letter-to-...
- joomla199 1y ago
  If MacOS, an OS with posix style permissions, app level permissions, and folder access limits per app does not have a “granular permissions model”, which OS does? What are you trying to say?
- wiether 1y ago
  > Obsidian could hugely benefit from an independent audit of the closed source base. They do a yearly audit: https://obsidian.md/security https://obsidian.md/security
  - yencabulator 1y ago
    Meanwhile, any plugin can do anything.
    - wiether 1y ago
      Sure, but that's not the issue raised by the article And if it was the other way around, I guess people would be complaining about how closed it is for the developers I think part of its success is due to the ecosystem composed of hundreds of plugins.
dSebastien 1y ago
Community plugins and the way they're approved and not reviewed over time due to limited resources is the main problem. There are many facets to that. Plugins have unrestricted access, they can start servers, make http calls, read/write files ... Plugins get approved once, but are never checked again. And plugins are now increasing in number more rapidly, ...
username135 1y ago
It is astonishingly sharp
chews 1y ago
I've known kepano (their CEO) for almost 20 years, he is an incredible builder and a solid human. My hunch is they would never act in an unsavory way to their users. I get that the point it could be more open (a community build would be slick), and yet it's an incredible product and worthy of financial support. I am glad to be a user and love that it's a part of my daily workflow.
Andaith 1y ago
Somebody read that recent open letter to the Obsidian Team and realized the security implications rather than just the inconvenience :D So far I have uninstalled all themes & plugins except the kanban board - I'm working on it. I'll use core obsidian and that's all.
deleted 1y ago
[deleted]
gxonatano 1y ago
I've used dozens of notetaking tools over the years. Some cloud-based, some markdown-based, some flashy apps, some plain-text, some open-source, and some closed-source. My takeaway from years of jumping between them is this: don't use closed-source notetaking software. Just don't do it. Even if your data is in markdown files, on your own computer, you're still probably stuck with proprietary markdown extensions, and at the very least, you're stuck with muscle memory for the app's UI that you'd have to translate to some new system eventually. Startup companies come and go, on a monthly basis. Developers move on to shiny new projects. You can't take that risk, or any other security risks, with your personal notes.

127 points by allenleee 1y ago

There are many good reasons to trust Obsidian team (they are not VC backed, they clearly state they don’t own your data, you are not locked in). If you don’t trust them because they are not open-source then If you want to be a purist about it, then just use an open-source markdown editor instead.

kgwgk 1y ago
> they clearly state seems a low bar for trusting (that part especifically)
- efilife 1y ago
  Your files are stored locally in .md
miggol 1y ago
The author dedicates an entire paragraph to how much they trust the Obsidian team. It isn't open source purism, they are warning users that good intentions don't prevent a developer from writing software containing vulnerabilities. Usage of user-created plugins and access to cloud accounts aggravates the risk posed by a vulnerability. Open source reduces vulnerabilities over time, so those who want to heed the author's warning may indeed want to switch to an open-source Markdown editor. Just not because the Obsidian team is Evil.
- illiac786 1y ago
  The title is either poorly chosen or shows a different intention than the content of the article I would argue. The objective seems to scare readers, and then nuance the statement in the article. Some call this clickbait, at the expense of the great obsidian team.

bobertdowney 1y ago

> Obsidian’s source code is closed When I toggle developer mode (Command + Option + i on my mac) I see what appears to be the source code (it’s an Electron app). Maybe it’s not the full source though. And I guess it’s very difficult to read since it’s minified.

swiftcoder 1y ago
Open-source is not about being able to view the source code at point-of-execution. It's about having a license to modify/distribute that source code
gorgabal 1y ago
That is not meaningfully open source. Even if that would be the full source code, it still wouldn't have an open source licence, although then it technically would be free(as in freedom) software, not just open source, but most people assume open source = free software. I trust the obsidian team, but I don't trust the plugins.

k8sToGo 1y ago

Is this a Mac thing? On Windows this is how most applications are distributed. Same with Spotify etc. Also even if it is open source, who really verifies the binary is built from the source published?

justincormack 1y ago
Mac app store distribution is not that common. Some apps are available in the store or as direct downloads. The store adds the sandboxing restrictions, which dont work for many apps, eg its not very easy to install a cli.
joshvm 1y ago
> Also even if it is open source, who really verifies the binary is built from the source published? Apple notarization is usually the way for non Store downloads. Non-notarized apps present a warning and require overriding security settings to run (with admin privilege). There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub, only that some sanity checks have been performed and the binary is not a known threat (or has been modified). https://developer.apple.com/documentation/security/notarizing-macos-software-before-distribution https://developer.apple.com/documentation/security/notarizin...
- bobertdowney 1y ago
  > There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub Sorry what if the open source project made their CI/CD pipeline public? So users could exercise it, produce their own build, and then compare that to the notarized one? Would I then be able to verify that what I downloaded from the developer’s website is identical to what is built with the open source code? Just curious.
  - warpspin 1y ago
    In theory, yes, you could compare it. In practice, the build would need to be reproducible which is non-trivial depending on the size the of the project and the external dependencies the project itself has.

tonyhart7 1y ago

need obsidian open source alternative

mastazi 1y ago
I'm not sure what your needs are, but I've been using Joplin and it works for me.
- teekert 1y ago
  Tried Joplin, it creates an unholy mess of files. I far prefer the clear format of Obsidian.
  - ezst 1y ago
    Next step is to give up on files/filesystem. As long as it's opensource, there's no lock-in. As long as the storage backend is clean and structured (SQLite or comparable), you actually get so much more (full text indexing, standard querying, ...) I initially was cautious when going from "bunch of .MD files" to https://triliumnotes.org/ https://triliumnotes.org/ , since it's been pretty great.
    - teekert 1y ago
      Hmmm, it has been years since I last tried it, perhaps it is time for another chance indeed. Thanx.
rubymamis 1y ago
You can check my FOSS note-taking app: https://notes-foss.com https://notes-foss.com
- pcthrowaway 1y ago
  Looks great! I'll follow along so I can try it out if syntax-aware code blocks and callouts are ever supported

imputation 1y ago

I had to do some gap analysis between note-taking apps with a graph view functionality to allow me to visualise my knowledge-base. Obsidian was my initial choice but I had grievances with it. I ended up going with Logseq for many reasons - yes it appears to be less mature however that doesn't mean that it is inferior by any measure (and open-source)

Lapel2742 1y ago
> I ended up going with Logseq for many reasons - yes it appears to be less mature however that doesn't mean that it is inferior by any measure (and open-source) If I remember correctly it was inferior to Obsidian because Logseq used a proprietary format. Yes, it was/is officially markdown but not in a format that is easily transferred. I don't know if it changed but Logseq documents where literally just a big Markdown list if I remember correctly. Personally I do see the problem with closed source solutions but the real problem with Obsidian are AFAIk the plugins and not the App itself. I mean: They have a long way to go to be even remotely as evil as people at Google or Microsoft. But if that ever happens I simply walk away with my .md documents.
- deleted 1y ago
  [deleted]
- quxbar 1y ago
  Exactly this. After the enshittification of evernote I swore I would only write documents in formats and contexts where I can easily pick up and move.
ezst 1y ago
On the same boat few months (actually, almost 2 years!) ago, I found Logseq too limiting as soon as one need to manage notes consistently ("typing" them as collections of notes of similar nature and acting on their properties as metadata), went through quite a long list of contenders (including AnyType) and ultimately settled with https://triliumnotes.org/ https://triliumnotes.org/
- 1y ago

Havoc 1y ago

Don’t really see much of a reason to single out obsidian in this

msuniverse2026 1y ago

I really like the obsidian canvas.

jiri 1y ago

But files obsidian works with are just bunch of .md files that can be viewed or edited with anything, nano, notepad, visual studio code etc. So does it really matter it is or it is not open source?

worthless-trash 1y ago
It does if you care about your editor.
eviks 1y ago
How is your point relevant to the security risks of community plugins? But also - no, they aren't, they use plugin-customized non-standard markdown format, so while the extension is the same, you can't view/edit them with anything just like you can't edit Word xml files with notepad (of course, it's not as extreme as Word xml, unless you're an extreme user of custom plugins)
phoronixrly 1y ago
It does if you care about running shady binary blobs on your system, and if you care about ethics.

moooo99 1y ago

I think the increasingly widespread attitude that only open source software is good and trustworthy increasingly annoying and problematic. Building software takes time and resources. Experienced show that most open source projects do not make enough money to make the resource investment worthwhile, much less the time investment. I generally like people being able to out food on the table, and if that means I have to pay for their software to use it or get updates, then I am happy to do so if that software is of value for me. That of course doesn‘t mean I appreciate unnecessary vendor lock in, hostile subscription models, etc. All of these things are common with proprietary software, but they are not inherent to it. Obsidian is a great example. Easy to takeout open formats, generous licensing model and no aggressive licensing implementation that makes it impossible to use the software offline. The team behind it seems to be able to make a living and people can still feel safe about the access to their notes. Even if its not open source, it would be great progress if we‘ve had more software like obsidian

phoronixrly 1y ago
Closed-source software is unethical regardless of any of your unsubstantiated claims on its or open-source software's security.
- iamsaitam 1y ago
  Why do you think it's unethical?
  - phoronixrly 1y ago
    I will assume you're not trolling but that just don't know what FOSS is about. Check this out https://www.gnu.org/philosophy/free-sw.en.html https://www.gnu.org/philosophy/free-sw.en.html
    - sanswork 1y ago
      You don't have to be ignorant of FOSS to disagree with the statement that closed source software is unethical.

ihorcher 1y ago

The scary thing is that nowadays everything is backdoored. And developers/product owners can even don't know about it. Obsidian is an electron app, thus uses npm, and with npm we now get like at least one malicious package per month. If they have package autoupdate it's just a matter of time and effort for an attacker to plant something shady there. This could be simple crypto-stealer, or this could be a way to access people's personal vaults.

Rohansi 1y ago
What is the alternative? Everyone stop using package managers?

eviks 1y ago

Plugin sandboxing is the answer to such community extension concerns, but then that's unfortunately only part of the bright future ahead...

dsissitka 1y ago

If you're a Linux user you might like Firejail for this. firejail --appimage --net=none --private=~/path/to/jail ~/path/to/Obsidian.AppImage --private=~/path/to/jail limits access to your home directory to ~/path/to/jail and when you don't want Obsidian to have internet access you can take it away with --net=none.

elric 1y ago
Note that if you already have an Obsidian vault, suddenly jailing it might break things. Obsidian stores a bunch of state in ~/.config/obsidian which will no longer be valid. And amusingly/frustratingly, the GTK file picker doesn't take the jail into account and seems to produce invalid paths. And because --private mounts some bits as temporary filesystems, you might end up losing state. Try before you buy.
- sph 1y ago
  And all of these issues such as sandboxing and portals are solved by using the Flatpak version instead.
  - nchmy 1y ago
    I don't know much about flatpak. How does it solve these issues?
    - sph 1y ago
      It provides a sandbox, an API to access stuff outside of it (portals), and standard tools to customize what your software has access to (Flatseal, KDE app settings). It's based on the same technology as Docker containers, but for user-space GUI apps. AppImage is a binary distribution format that does none of that stuff, so you need external tools, like firejail, to limit what the application has access to.

Robdel12 1y ago

This is ridiculous. The macOS app is signed. codesign -dv /Applications/Obsidian.app Executable=/Applications/Obsidian.app/Contents/MacOS/Obsidian Identifier=md.obsidian Format=app bundle with Mach-O universal (x86_64 arm64) CodeDirectory v=20500 size=759 flags=0x10000(runtime) hashes=13+7 location=embedded Signature size=8975 Timestamp=Sep 29, 2025 at 12:22:41 PM Info.plist entries=39 TeamIdentifier=6JSW4SJWN9 Runtime Version=15.4.0 Sealed Resources version=2 rules=13 files=23 Internal requirements count=1 size=172 Also, I love OSS as much as the next person, but not everything needs to be.

eviks 1y ago
does the fact that the app is signed mean it must use sandboxing? > it isn’t required to use sandboxing
pcthrowaway 1y ago
I'm not sure how this is relevant? The code is signed but that doesn't mean it doesn't contain backdoors. Without it being open source or at the very least source-available, we can't know This is of course true of many other apps we run on Mac (though I suspect a non-zero number of common apps have backdoors); Obsidian also runs without sandboxing though, is used by many to record their innermost thoughts, and as the author mentioned, there's also the potential for data to leak via compromised extensions. Am I missing something, or does the fact that it's signed tell us nothing except that the Obsidian company signed off on it? If so, I'd really like to understand if you had a purpose of sharing this... is there a tacit implication that "surely a company can be trusted"?

agsnu 1y ago

I wouldn’t hold not being on the Mac App Store against it. The MAS is sort of a failed ecosystem with very low usage/engagement, and all the downsides of the iOS store like potentially lengthy review times (can be a lot longer than the iOS store since it seems to play second fiddle) and arbitrary capricious rejections when you’re just trying to ship innocuous bug fixes to users.

colesantiago 1y ago

Would it be best to be closed source and pay to get the source code with 1 year updates, (except say license server unless you're enterprise)? That way the author can still keep the source closed and those who want code can pay for it. I very rarely see OSS being monetized successfully without a community fork destroying the original project. OSS still requires money to maintain the project and sparse donations really don't really cut it.

deafpolygon 1y ago

I know this may go against the ethos of some folks on HN, but I switched to Apple Notes and haven't looked back. At the end of the day, you either use the tool or the tool uses you. For diagrams, mindmaps, etc... I just use Freeform now -- screen capture or export the board as PDF to paste into my notes. It's deceptively flexible and more powerful than it would appear.

CaRDiaK 1y ago
to add, in the latest version of MacOS / iOS you can import / export as Markdown, which is quite nice.

ugur2nd 1y ago

Obsidian is a startup that's been on my radar. It inspires me. They're able to go so far as to challenge Notion with their small team, which I appreciate. By the way, I'm not saying Notion is bad. I think it's revitalizing the industry. On the other hand, I was unaware of the vulnerabilities in the Apple ecosystem. Or rather, I didn't think there would be. The article raised my awareness.

deleted 1y ago

[deleted]

thomascountz 1y ago

The set of open source code and verifiable code overlap, but one doesn't always imply the other. In either case, provenance needs to be established. I think it would be reasonable for Obsidian to ship signed checksums and a public transparency log (e.g., Sigstore) for builds (plugins authors could do the same?). A more granular plugin permissions system would be great too, even though most plugins are OSS.

freefaler 1y ago

It's a strange article. Yes it's not an open source, but based on what is the author suspicious? Any bad behaviours from the authors? Change of ownership? Plugin risks? For me this is the least problematic non-open source software: - non VC funded (like Mattermost enshitification after VC) - open source formats - community plugins with source code (it's JS)

reassess_blind 1y ago

You should always be careful with closed source software. You should also be careful with open source software, unless you're building from source and manually checking the source in each update isn't malicious, which let's be real, nobody does.

warpspin 1y ago
Plus, in theory you'd also need reproducible builds for everything because who knows what your compiler did to the source ;-) Reality is, as you already implied: in practice you cannot "be careful" except avoiding obvious malware. At SOME point you have to trust SOMEONE, unless you use TempleOS in which case you can trust whatever god you have.

nrvn 1y ago

Not being able to give granular permissions to folders is not the problem of an app which regardless of being open or closed source may be compromised. Remember that the risk is zero if and only if you avoid the risk, i.e. in this particular case do not install Obsidian. Macos: - does not have a granular permissions model as far as I know; - deprecated sandbox-exec that allowed to achieve the above; - macos appstore is a very strange phenomenon, I would not put much trust in it by default. Obsidian: - has a system of community plugins and themes which is dangerous and has been discussed multiple times[0]. But the problem of managing community plugins is not unique to them. Malicious npm packages, go modules and rust crates (and you name it) anyone?.. you are on your own here mostly. And you need to perform your own due diligence of those community supported random bits. Obsidian could hugely benefit from an independent audit of the closed source base. That would help build trust in the core of their product. [0]: https://www.emilebangma.com/Writings/Blog/An-open-letter-to-the-Obsidian-team https://www.emilebangma.com/Writings/Blog/An-open-letter-to-...

joomla199 1y ago
If MacOS, an OS with posix style permissions, app level permissions, and folder access limits per app does not have a “granular permissions model”, which OS does? What are you trying to say?
wiether 1y ago
> Obsidian could hugely benefit from an independent audit of the closed source base. They do a yearly audit: https://obsidian.md/security https://obsidian.md/security
- yencabulator 1y ago
  Meanwhile, any plugin can do anything.
  - wiether 1y ago
    Sure, but that's not the issue raised by the article And if it was the other way around, I guess people would be complaining about how closed it is for the developers I think part of its success is due to the ecosystem composed of hundreds of plugins.

dSebastien 1y ago

Community plugins and the way they're approved and not reviewed over time due to limited resources is the main problem. There are many facets to that. Plugins have unrestricted access, they can start servers, make http calls, read/write files ... Plugins get approved once, but are never checked again. And plugins are now increasing in number more rapidly, ...

username135 1y ago

It is astonishingly sharp

chews 1y ago

I've known kepano (their CEO) for almost 20 years, he is an incredible builder and a solid human. My hunch is they would never act in an unsavory way to their users. I get that the point it could be more open (a community build would be slick), and yet it's an incredible product and worthy of financial support. I am glad to be a user and love that it's a part of my daily workflow.

Andaith 1y ago

Somebody read that recent open letter to the Obsidian Team and realized the security implications rather than just the inconvenience :D So far I have uninstalled all themes & plugins except the kanban board - I'm working on it. I'll use core obsidian and that's all.

deleted 1y ago

[deleted]

gxonatano 1y ago

I've used dozens of notetaking tools over the years. Some cloud-based, some markdown-based, some flashy apps, some plain-text, some open-source, and some closed-source. My takeaway from years of jumping between them is this: don't use closed-source notetaking software. Just don't do it. Even if your data is in markdown files, on your own computer, you're still probably stuck with proprietary markdown extensions, and at the very least, you're stuck with muscle memory for the app's UI that you'd have to translate to some new system eventually. Startup companies come and go, on a monthly basis. Developers move on to shiny new projects. You can't take that risk, or any other security risks, with your personal notes.