Use case or problem Community plugins are great and one of the great features of Obsidian is allowing the ecosystem to thrive. However, community plugins pose a lot of security challenges - even if we trust the developer of a plugin, supply chain insecurities and attacks through dependencies are qui…

Hi @EleanorKonik , in that case I have to apologize - it seems that I completely misinterpreted your comments. I interpreted your comment as an ironic and over-topped mockery and not as a genuine approach of providing your emotions. I am very, very sorry for this - the usual subtones of a normal fac…

While I don’t understand the specifics of everything you say here, I can get the gist and would assume most people would appreciate more security. Perhaps if the critics of your suggestions won out, there could be a compromise that would provide a middle ground between safe mode on and safe mode off…

Hey @I-d-as , thanks for your reply! It seems that my proposal or problem domain is not clear enough, which doesn’t help getting it on the agenda… Could you elaborate, which parts you have trouble understanding, so that I can rewrite or extend them? Is it too technical to understand? Edit: I’ve rep…

I don’t really have any objections per se — this isn’t my area of expertise. I just want to note that I’m reasonably confident —based on my experiences with people asking me about new plugins they heard about through the Roundup — that a potential unintended side-effect of this might be that more pl…

[image] EleanorKonik: “I don’t necessarily feel able to commit to looking at things every 14 days, this isn’t my day job and I have kids, so I’m not going to submit, but if you guys want it, here’s the link to the github repo, you can install it via BRAT.” I agree with this. I think we can’t …

[image] argentum: As a user, you can also take up part of this work I think it’s important that users have an understanding and take responsibility for their own security. Neither software, nor the internet can be separated into safe and dangerous. There are degrees of risk across the board (…

Thank you for your support and a lively discussion, @argentum , @Dor and @EleanorKonik . [image] argentum: I agree with this. I think we can’t reasonably expect that plugin devs provide support as if it was a full-time job. Most people in the community are creating and maintaining plugins as volu…

[image] LarsKumbier: I’d even go as far as saying, that you should not write a plugin, if you are unable to support a few minutes every two weeks to accept a security PR - you are endangering every user of your plugin, if you don’t do this regularly. When I see a statement like this, it says …

[image] LarsKumbier: In my experience, regular security updates are not only best practice, but they also only take a few minutes 95% of the time due to non-breaking changes. And if it’s pipelined, it’s a breeze. I’d even go as far as saying, that you should not write a plugin, if you are unabl…

Eleanor, being salty and condescending is uncalled for and unnecessary, and does not add anything to this otherwise respectful exchange of opinions. I grossly misinterpreted @EleanorKonik post. Please refer to my next message to keep it up. I’ll leave the original reply here for future reference, s…

[image] argentum: I am speaking for myself only right now: I don’t need peer-pressure to add more work to my plate. Personally, this would make me pull my plugins from the store, even if we made this an opt-in workflow. [image] argentum: For many developers, plugins are their first progra…

Obsidian Forum

Community Plugin - Security Hint and Quality Gate

Basement

show post in topic

Home
Categories
Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled