5 ms·

No permissions system, nothing resolved. Plugins still have access to everything - full disk, network, etc. How does one even speak of security vulnerabilities

by troad 5mo ago

No permissions system, nothing resolved. Plugins still have access to everything - full disk, network, etc. How does one even speak of security vulnerabilities when the security model of Obsidian plugins is just straight up "click here for RCE". All I see is a spanking new interface that will accelerate the pace of plugin turnover, bringing forward the next inevitable security incident.

kepano 5mo ago
It seems like you have not read the blog post.
- rtrgrd 5mo ago
  Just wanted to say a huge thankyou for being so patient in the forum; it's quite annoying that the comment section is a more a function of the title + personal opinions than a function of the blog content. I love using obsidian, and thanks so much for all the work that you and the team have put in :)
  - kepano 5mo ago
    Thank you! It means a lot <3
    - troad 5mo ago
      For what it's worth - and I know I'm being very critical of the plugin security model here - I also think Obsidian is very good, and am a paying customer. Part of my frustration with this is that I've seen hobbyist video games with a more robust plugin security model than Obsidian's plugins. It's possible to do better than just "yolo, eval(github)", and I feel like it would thoroughly improve Obsidian for me, and apparently many others (judging by all these comments), if Obsidian invested in creating a secure plugin ecosystem rather than putting lipstick on the existing yolo plugin vortex. Just because Obsidian is in JS, and JS has a terrible culture around package security, doesn't mean Obsidian needs to inherit and propagate that culture.
- troad 5mo ago
  I have indeed read the blog post. Can you point out which part of my post is inaccurate? It is certainly possible I misunderstood something. Surely you're not about to claim that asking plugins to "disclose" what resources they use is in any way comparable to sandboxing and permissions.
  - kepano 5mo ago
    As I wrote, yes, a permission system is planned. But 1. we cannot oversimplify the problem of getting from here to there, 2. permissions are not a panacea. If you look at the scorecards for a few plugins you'll immediately see issues that a permission system wouldn't catch. Millions of people depend on thousands of Obsidian plugins. We cannot just flip a switch and break everyone's workflows overnight. It will be a gradual process. We're working on it, and I hope you'll at least concede that this is better than nothing.
    - troad 5mo ago
      No, I don't agree. Asking plugins to pinky-promise which resources they will and will not use is absolutely meaningless from a security perspective. If anything, it engenders a false sense of security in end users, and continues a pattern whereby Obsidian tacitly endorses things that are inherently risky. The fundamental issue here is that the current plugin model is intrinsically broken, and tinkering around the edges is just a diversion of efforts from clearing that tech debt. It doesn't need to happen overnight, but it does need to happen. The meaningful improvement here is the promise of sandboxed plugins in the future, assuming I understood correctly, and that's just a fairly vague promise at this stage. I absolutely and in full earnestness wish you guys the best with that one. It will meaningfully improve Obsidian and make it easier to recommend to others.
      - kepano 5mo ago
        It's not tacit, it's explicit. People should have the freedom to do dangerous things as long they understand and accept the risks. I'm not interested in making software that imposes limits on what a person can do with their own computer. I completely understand if you disagree, in which case Obsidian is not for you. It's perfectly fine to not recommend it! Obsidian is not trying to be for everyone. See also: https://stephango.com/saw https://stephango.com/saw
dSebastien 5mo ago
This is a HUGE improvement to the status quo. Give it some time. They do care

by troad 5mo ago

kepano 5mo ago

It seems like you have not read the blog post.

rtrgrd 5mo ago
Just wanted to say a huge thankyou for being so patient in the forum; it's quite annoying that the comment section is a more a function of the title + personal opinions than a function of the blog content. I love using obsidian, and thanks so much for all the work that you and the team have put in :)
- kepano 5mo ago
  Thank you! It means a lot <3
  - troad 5mo ago
    For what it's worth - and I know I'm being very critical of the plugin security model here - I also think Obsidian is very good, and am a paying customer. Part of my frustration with this is that I've seen hobbyist video games with a more robust plugin security model than Obsidian's plugins. It's possible to do better than just "yolo, eval(github)", and I feel like it would thoroughly improve Obsidian for me, and apparently many others (judging by all these comments), if Obsidian invested in creating a secure plugin ecosystem rather than putting lipstick on the existing yolo plugin vortex. Just because Obsidian is in JS, and JS has a terrible culture around package security, doesn't mean Obsidian needs to inherit and propagate that culture.
troad 5mo ago
I have indeed read the blog post. Can you point out which part of my post is inaccurate? It is certainly possible I misunderstood something. Surely you're not about to claim that asking plugins to "disclose" what resources they use is in any way comparable to sandboxing and permissions.
- kepano 5mo ago
  As I wrote, yes, a permission system is planned. But 1. we cannot oversimplify the problem of getting from here to there, 2. permissions are not a panacea. If you look at the scorecards for a few plugins you'll immediately see issues that a permission system wouldn't catch. Millions of people depend on thousands of Obsidian plugins. We cannot just flip a switch and break everyone's workflows overnight. It will be a gradual process. We're working on it, and I hope you'll at least concede that this is better than nothing.
  - troad 5mo ago
    No, I don't agree. Asking plugins to pinky-promise which resources they will and will not use is absolutely meaningless from a security perspective. If anything, it engenders a false sense of security in end users, and continues a pattern whereby Obsidian tacitly endorses things that are inherently risky. The fundamental issue here is that the current plugin model is intrinsically broken, and tinkering around the edges is just a diversion of efforts from clearing that tech debt. It doesn't need to happen overnight, but it does need to happen. The meaningful improvement here is the promise of sandboxed plugins in the future, assuming I understood correctly, and that's just a fairly vague promise at this stage. I absolutely and in full earnestness wish you guys the best with that one. It will meaningfully improve Obsidian and make it easier to recommend to others.
    - kepano 5mo ago
      It's not tacit, it's explicit. People should have the freedom to do dangerous things as long they understand and accept the risks. I'm not interested in making software that imposes limits on what a person can do with their own computer. I completely understand if you disagree, in which case Obsidian is not for you. It's perfectly fine to not recommend it! Obsidian is not trying to be for everyone. See also: https://stephango.com/saw https://stephango.com/saw

dSebastien 5mo ago

This is a HUGE improvement to the status quo. Give it some time. They do care