3 ms·

In what universe is it trusted? This blog post is an admission that they've been lying to their userbase about their review process for years, with updates rece

by kid64 5mo ago

In what universe is it trusted? This blog post is an admission that they've been lying to their userbase about their review process for years, with updates receiving no review whatsoever. Enjoy your mass exfiltration.

kepano 5mo ago
Huh? The old review process has always been well-documented and occurred via PRs on GitHub completely in the open. It was a known limitation and something that we set out to revamp with the new system. From the docs: > The Obsidian team is small and unable to manually review every new release of community plugins. Instead, we rely on the help of the community to identify and report issues with plugins. https://github.com/obsidianmd/obsidian-help/blob/master/en/Extending%20Obsidian/Plugin%20security.md https://github.com/obsidianmd/obsidian-help/blob/master/en/E...
- kid64 5mo ago
  I realize you're just doing your job as CEO to shape perceptions here, but this is your best effort? The docs should have correctly stated "we don't review ANY new community plugin release". Hint: This is where you would admit the review process itself was meaningless theater intended to provide a false sense of security to users that trusted you.
  - kepano 5mo ago
    That would not have been accurate though.
    - kid64 5mo ago
      For those that aren't aware, this is all meant to distract/confuse you in light of this story: https://cyber.netsecops.io/articles/obsidian-plugin-abused-in-campaign-to-deploy-phantom-pulse-rat/ https://cyber.netsecops.io/articles/obsidian-plugin-abused-i...
      - kepano 5mo ago
        We've been working on the project for nearly a year, so no. https://github.com/obsidianmd/eslint-plugin/commits/ https://github.com/obsidianmd/eslint-plugin/commits/
        kid64 5mo ago
        Just say "I think my users are stupid" and be done with it. The timing of your announcement is obviously not a coincidence. You are genuinely terrible at this.
        kepano 5mo ago
        I certainly feel that I am losing brain cells here :)
        kid64 5mo ago
        https://news.ycombinator.com/item?id=48088576 https://news.ycombinator.com/item?id=48088576 What, no smiley face in those comments? Maybe a silly shrug would have been appropriate.

by kid64 5mo ago

kepano 5mo ago

Huh? The old review process has always been well-documented and occurred via PRs on GitHub completely in the open. It was a known limitation and something that we set out to revamp with the new system. From the docs: > The Obsidian team is small and unable to manually review every new release of community plugins. Instead, we rely on the help of the community to identify and report issues with plugins. https://github.com/obsidianmd/obsidian-help/blob/master/en/Extending%20Obsidian/Plugin%20security.md https://github.com/obsidianmd/obsidian-help/blob/master/en/E...

kid64 5mo ago
I realize you're just doing your job as CEO to shape perceptions here, but this is your best effort? The docs should have correctly stated "we don't review ANY new community plugin release". Hint: This is where you would admit the review process itself was meaningless theater intended to provide a false sense of security to users that trusted you.
- kepano 5mo ago
  That would not have been accurate though.
  - kid64 5mo ago
    For those that aren't aware, this is all meant to distract/confuse you in light of this story: https://cyber.netsecops.io/articles/obsidian-plugin-abused-in-campaign-to-deploy-phantom-pulse-rat/ https://cyber.netsecops.io/articles/obsidian-plugin-abused-i...
    - kepano 5mo ago
      We've been working on the project for nearly a year, so no. https://github.com/obsidianmd/eslint-plugin/commits/ https://github.com/obsidianmd/eslint-plugin/commits/
      - kid64 5mo ago
        Just say "I think my users are stupid" and be done with it. The timing of your announcement is obviously not a coincidence. You are genuinely terrible at this.
        kepano 5mo ago
        I certainly feel that I am losing brain cells here :)
        kid64 5mo ago
        https://news.ycombinator.com/item?id=48088576 https://news.ycombinator.com/item?id=48088576 What, no smiley face in those comments? Maybe a silly shrug would have been appropriate.