TechPulseTechPulse
Back to News
Advertisement
Advertisement

⚡ Community Insights

Discussion Sentiment

64% Positive

Analyzed from 1017 words in the discussion.

Trending Topics

#obsidian#plugins#plugin#community#system#access#users#should#don#need

Discussion (33 Comments)Read Original on HackerNews

badcryptobitch•1 minute ago
My worse fear has materialized. This is why I've never used an external Obsidian plugin and only my own plugins. It was only a matter of time before some malicious code ended up in one.
jjice•16 minutes ago
I really like Obsidian. I use it every day and I don't use any community plugins because the permissions aren't up to snuff. I hope for a day where a plugin defines what it will need and that gets presented to me as a user.

I have to imagine the Obsidian team is going to respond seriously to this and I look forward to seeing what they do. They have my full confidence. I'm surprised the system was initially designed as it is without those better permissions and sandboxing, though.

slowmover•about 3 hours ago
> The victim is prompted to enable the "Installed community plugins" synchronization feature.

Obsidian has the proper protections in place to prevent this type of attack, and the victims are being convinced to ignore them. This is just a successful social engineering event. I hate to see Obsidian dragged down by this headline, since this attack is not exploiting a vulnerability in it or its plugin system.

Groxx•about 2 hours ago
Ehm. No? https://obsidian.md/help/plugin-security#Plugin+capabilities

>Due to technical limitations, Obsidian cannot reliably restrict plugins to specific permissions or access levels. This means that plugins will inherit Obsidian's access levels. As a result, consider the following examples of what community plugins can do:

    Community plugins can access files on your computer.
    Community plugins can connect to internet.
    Community plugins can install additional programs.
Obsidian has no protection at all. Installing a plugin gives it full access to your computer.

This was only a matter of time, and honestly I think it's inexcusably negligent that they shipped a plugin system like this at all since about 2010 (or arguably much earlier).

pointlessone•about 2 hours ago
It does give full access but Obsidian does tell you that. Community plugins are not enabled by default, you have to enable them manually. Same happens with a shared vault: once you get it you still have to manually enable plugins. So far no one managed to sneak in a plugin completely unnoticed.
kid64•about 2 hours ago
That's horse hockey. Obsidian is not a usable system without community plugins.

Folks will reply "but I use it every day without plugins".

That position disregards software usability as a formal discipline, along with decades of UX research and standards.

Groxx•about 2 hours ago
"Hey users: don't do insecure things. Here's a button to do cool insecure things!" is not a plugin security model.
Paul-E•about 2 hours ago
Obsidian seems like a perfect candidate for a WASM/WASI based plugin system that would properly sandbox plugin code.
Groxx•39 minutes ago
For at least the vast majority, yes definitely. I'm fine with full bypasses existing (say a webgl thing, or web previews, custom VCS integration, there are tons of legitimate reasons to escape a sandbox), but they should be an abnormality with heavy warnings and proportionate community attention to watch for issues, not the only option.

I don't think they meant it this way, but I honestly consider unsafe official plugin systems to be negligent to the point of being actively malicious. By releasing one, if you ever become successful you have explicitly chosen to screw over an unknown number of your users to save yourself a relatively small amount of work in the short term. It might be single digit users, or it might be septuple digit users - is it really worth it?

(Unsafe unofficial plugins, like most games? Mildly unfortunate but I think that's fine. Though a healthy modding community around your stuff should be a VERY STRONG sign that you should introduce a safe version to protect your users, if it won't cause you to implode (it definitely can)).

moron4hire•about 2 hours ago
A program one runs on one's computer can and should be able to do computer things. The alternative road you're advocating for ends in hardware attestation https://news.ycombinator.com/item?id=48086190
cmbailey•about 3 hours ago
Right, I'm a heavy Obsidian user myself, and love it.

I think the value of this disclosure is more in spreading awareness about plugins, and demonstrating the vector. Where less sophisticated users may think, "Oh, this is just a collection of markdown files. I don't need to be too worried about malicious code."

vetchzero•20 minutes ago
Obsidian does not have auto update for community plugins. The steps for updating them right now is checking for updates and then updating all or individually. A bad update to one of the popular plugins could compromise lot of systems.

If one already gets the functionality they need from a plugin, does it make sense to update anymore?

zhivota•about 2 hours ago
Even being social engineering, the design of the plugin system allowing this means the platform is completely unusable as a sharing tool. It's good to know but to me this is not "I need to remember to have these settings correct to use a shared Obsidian vault", this for is instead "never accept a shared Obsidian vault, demand a plaintext export".
hresvelgr•about 1 hour ago
Am I the only one who thinks Obsidian is perfect without plugins? Half the reason I switched to it from Anytype was that it was rather spartan in its offerings. If they announced tomorrow they would ban plugins, I would not care.
CGamesPlay•39 minutes ago
I'm also switching back to Obsidian after a few-year stint on Anytype, and the Notebook Navigator plugin is the only one I have installed. This is (I assume) a UI-only plugin, which shouldn't need access to external network or processes, so a quite good candidate for sandboxed plugins.
kid64•about 2 hours ago
This is just the first detected and reported instance, in all likelyhood such attacks have been happening for some time. When will the fanatic userbsse finally admit that using Obsidian in any enterprise setting is just plain malpractice?

It takes 5 minutes in their Discord channel to see the founders are D&D nerds, not competent engineers. It was never meant for serious work.

dspillett•about 2 hours ago
> the founders are D&D nerds, not competent engineers

The two are not mutually exclusive. What would you trust more than a nerd? A jock? A spod? An MBA?

Any evidence of other examples if bad engineering you can point to, or are your thoughts on the pluggin system and throwing shade at random groups of people all you've got?

[FYI: I know little of obsidian other than planning to look into it at some point as people I know use and like it. I stepped into this set of comments in case there was something useful I should be passing on to those people]

chillfox•about 1 hour ago
The attack relies on social engineering to get the victim to disable protections and could just as easily have happened with a plugin for any code editor.

Anyway, What I like about obsidian is that it can handle a truly huge amount of notes without slowing down, and the notes are just markdown files on disk, so there's no lock in. I have used evernote, ms one note and zoho notebook before, and had issues with all of them.

dspillett•39 minutes ago
That isn't a response to my post, it is a bit of information already present in the thread that isn't relevant to my question followed by a positive review. This suggests that a shill brigade has been attracted to these comments. I suggest you don't do that, it isn't a good look.
flashman•15 minutes ago
well there was this previous issue in the crypto community where it turned out someone was not a competent engineer and should have stuck to their online exchange for magic: the gathering
amazingamazing•about 1 hour ago
What software do you use that would be immune to a scenario where you disable all protections to take some action?
TacticalCoder•about 2 hours ago
> It takes 5 minutes in their Discord channel to see the founders are D&D nerds, not competent engineers.

I know absolutely nothing about Obsidian but I'd expect quite a few competent engineers to also be D&D nerds no!?

Are you saying the two are mutually exclusive?

kid64•about 1 hour ago
No I'm not. But I'd encourage you to visit and see for yourself why these outcomes are completely predictable.