kepano

4 ms·

31.
by kepano 5mo ago
That would not have been accurate though.
32.
by kepano 5mo ago
That's effectively how the new system works. We just need to add filters so users can choose their preferred level of strictness.
33.
by kepano 5mo ago
Huh? The old review process has always been well-documented and occurred via PRs on GitHub completely in the open. It was a known limitation and something that we set out to revamp with the new system. From the docs: > The Obsidian team
34.
by kepano 5mo ago
An update: https://obsidian.md/blog/future-of-plugins/
35.
by kepano 5mo ago
Try Obsidian Web Clipper's Reader feature for Firefox :) https://obsidian.md/help/web-clipper/reader
36.
by kepano 5mo ago
You can automatically check for updates but it's off by default, and still requires a manual click. Also the new plugin review system automatically scans every release.
37.
by kepano 5mo ago
It's the first I am hearing about it, but I'll take a look!
38.
by kepano 5mo ago
Every update is scanned, and we will be regularly re-scanning all the latest versions of every plugin as we improve the system. The review system is based on our eslint plugin which itself open source and reproducible, so anyone can contrib
39.
by kepano 5mo ago
The app has had light mode since 2020 :) Obsidian is a small team and I am pretty much the only person working on the website but I hope to add it soon.
40.
by kepano 5mo ago
Speaking as someone who spends most of his time making open-source software, open source still requires trust. Almost all Obsidian plugins are open source, yet the reason for this new review system is that people don't have the time or
41.
by kepano 5mo ago
I can't speak for other platforms but neither option you propose seems right for Obsidian. I think the right approach for us is somewhere in between. If we were too controlling there wouldn't be the freedom of exploration that we
42.
by kepano 5mo ago
That's exactly how it works. A plugin is just a folder that you can copy into the .obsidian/plugins folder within your vault.
43.
by kepano 5mo ago
That's because Obsidian is black. But we're planning to add light mode in the near future :)
44.
by kepano 5mo ago
Obsidian CEO here. We've been working for nearly a year to launch this new Community site and review system. I'm very excited about this first version but there are many more improvements to come. I've tried to be exhaustive
45.
by kepano 5mo ago
Yes. That's fixed! There will be some false positives and false negatives as we iron out kinks in the new system, but we're working feverishly in the #plugin-dev channel on Obsidian Discord to help devs. Please be patient, we&#x27
46.
by kepano 5mo ago
We haven't shared anything about sandboxing yet. Yes, to start disclosures will be opt-in because we have to help thousands of developers with existing plugins migrate. However, a permissions system alone is not enough. For example if
47.
by kepano 5mo ago
Read through the blog post. A permissions system is planned in addition to the automated scans and more controls for teams. All are necessary because permissions alone can't solve certain malicious behaviors. Look at some scorecards on
48.
by kepano 5mo ago
No. The attack does not depend on the presence of a specific plugin. The ones listed in the article are just the ones that were used in the POC. Any plugin could be modified by the attacker if the user trusts the attacker and accepts 1. the
49.
by kepano 5mo ago
I agree. https://news.ycombinator.com/item?id=48097206
50.
by kepano 5mo ago
It's not one pop-up. To fully replicate the concept you have to agree on three separate screens (and these are not in quick succession): 1. exit restricted mode to allow third-party plugins 2. trust the author of the vault that's
51.
by kepano 5mo ago
Obsidian is only seven people but we are working on this from all three angles: 1. Make community plugins less necessary over time as basic features become part of core 2. Improve the security of community plugins 3. Make it easy to create
52.
by kepano 5mo ago
You're looking at a different screen than the ones required to replicate this attack. To replicate this attack you have to agree three separate times to increasingly scary messages. Yes it would be good to make it less easy to shoot yo
53.
by kepano 5mo ago
To replicate this attack you have to also reject two more safety warnings. The user has to accept a shared vault (you have to click "trust author of this vault"), and you have to activate syncing remote plugins.
54.
by kepano 5mo ago
The headline on HN is different: "Obsidian plugin was abused to deploy a remote access trojan". It's not a plugin that was abused, but the ability for shared vaults to contain plugins.
55.
by kepano 5mo ago
> More batteries-included Can I ask, what basic functionality is Obsidian missing in 2026? (I work on the app)
56.
by kepano 5mo ago
Consider a quick search. I have answered this question many times over the years, e.g. https://x.com/kepano/status/1701359669791670416 If you look at my GitHub profile[1] you'll see that the majority of my ti
57.
by kepano 5mo ago
The specific plugins don't matter for this attack. The attack relies on the user accepting a shared vault and trusting the shared plugins. A shared vault can contain plugins that don't come from the official directory.
58.
by kepano 5mo ago
In the near term artifact attestation will be visible to users in the directory, and part of the overall scorecard of a plugin.
59.
by kepano 5mo ago
The recommended way to do this is via artifact attestation: https://docs.github.com/en/actions/how-tos/secure-your-work/...
60.
by kepano 5mo ago
How would that make a difference for plugin security? Almost all plugins are already open source. If you mean for the security of the app without plugins you can currently inspect the app's code in app.js and review third-party audits:

More ›