Security of the plugins

[den]

@ryanjamurphy

A different angle: like literally everything else involving people, the plugin “market” will be a social system. Plugins that look or act fishy will be investigated, debated, discussed, and folks will have agency about whether or not they want to use them. Plugin developers will build reputations and we will trust in them.

Trivial “social” security task:

• provide official chanel (like for themes) where plugin can by uploaded / linked
• provide rating system with user comments
• also add there Obsidian devs (distinguished from normal user) - they are users too, but let say more advances, so people may trust the plugin more if they are rate it hight or comment on it positively)
• provide tab where it will be stated the plugin works offline / online
• mandatory photo, and description for plugin
• mandatory link to author and contact

@Licat

I’m not sure what’s unclear from my response - I would love to address this concern but there isn’t much we can do. Fundamentally, we’re a small team with limited resources - if Obsidian was a billion dollar company, then sure I’d love to throw a couple millions to hire security experts to come up with processes and manually review plugins. If you can provide that kind of funding then I’m sure we can find a way to make things work.

This is just over reaction and not focusing on possible solutions… anyway the API should have security in mind…for example read only access…or also checking if Obsidian is communicating with other then (servers for themes, updates, etc…). Don’t tell me for these you need milion dollars and hundreds of DEV