Making Obsidian's network & sync components source-available

[AND]

Use case or problem

The idea is to improve community trust in Obsidian’s security and privacy model.

Proposed solution

Currently, some of Obsidian’s feature set is available as ‘core plugins’. These are not source-available or open source.

Following the discussion in Open Sourcing of Obsidian and the concerns some (albeit small) group of people are raising regarding the closed-source nature of Obsidian in regards of private and confidential data, I suggest rendering the networking and sync components of Obsidian into a separate ‘core plugin’ which would then be made source-available. The complete networking and synchronisation capacity of Obsidian will be contained in this core plugin, and nowhere else.

The idea is to be able to alleviate fears regarding data security and privacy, while keeping most of Obsidian closed-source. The networking & sync capacities have no much use for anyone that would attempt to steal the code, and they would be released under a source-available license that doesn’t permit code theft.

Yes, I know that no one can be sure that all the networking and sync code was contained within this plugin. But since we are consistently being reminded by people that we need to trust the developers, they would do this in a bona fide manner to increase community trust for security- and privacy-minded users. I think this is a fair trade.

A bonus would be that if you turn off this plugin from within Obsidian, and Obisidian still requests Internet access, it would be a sign that this was not done well or at all. Again, I am aware that this can be circumvented, but if we trust the developers, they won’t circumvent it.

That would be the gist of my feature request. Feel free to discuss.

Current workaround (optional)

Related feature requests (optional)

Open Sourcing of Obsidian

[WhiteNoise]

Since this is not a feature of the software per se, I am gonna move this meta.

[argentum]

See also:

Security of the plugins

Basically on desktop you can use per-app or IP tables firewalls, and on mobile you can use mobile firewalls or just switch off Internet access to Obsidian. Some suggestions: Windows: TinyFirewall Mac: Lulu Linux: OpenSnitch (+ GUI) Android: NetGuard (supports IP tables as well) iOS: [no idea]

[AND]

Hah, of course, I wrote that post

The thing is that we sometimes need to allow Obsidian internet access, for example to download a plugin (although this can be done by manually installing plugins) or to extract embedded data from websites (e.g. clipped web pages).

It would be best if we are sure that Obsidian’s networking & syncing is doing only what it’s supposed to do.

[argentum]

Absolutely, however this needs to be posted for other users that may stumble upon this thread, given that there are no plans to make Obsidian source-available or open source in the foreseeable future. This has been discussed extensively in the open source thread and we have a definitive answer from the devs:

@Licat

To recap,

• As a user, it would be great if the app can continue to work if we go out of business.
• As a business, we don’t want to go out of business.
• As a user, it would be great if there’s a lot of “competition”.
• As a business, it’s really stressful if competitors can take your work, copy it and sell it as their own. Licenses don’t prevent copying, and lawsuits are expensive and time consuming.

I think we are both right, but for us as a business it just makes more sense to stay close sourced. This is unlikely to change for the foreseeable future.

I’ll add that given that Sync is key to the sustainability of Obsidian, this component in particular is unlikely to become source-available (imo) at all.