[ibash]

> Obsidian plugins have full, unrestricted access to all files in the vault.

Unless something has changed, it's worse than that. Plugins have unrestricted access to any file on your machine.

When I brought this up in discord a while back they brushed it aside.

[Tallain]

Having recently read through a handful of issues on their forums, they seems to brush aside a lot of things. It's a useful tool but the mod / dev team they have working with the community could use some training.

[esseph]

If you're using a flatpak, that's not actually the case. It would have very restricted access to the point where you even would have to explicitly give it access to user /home.

[s_ting765]

You're wrong. The obsidian flatpak ships by default with access to /home. https://github.com/flathub/md.obsidian.Obsidian/blob/5e594a4...

[pipes]

So if I run their software in a container they can't access my entire filesystem. I don't think that is a security feature.

It sounds like if I ever run obsidian I should be using flat seal too.

[HSO]

What if you run little snitch and block any communications from obsidian to anything?

[elric]

Or firejail. Or QubesOS using a dedicated VM. There are options, but it would still be nice if Obsidian had a more robust security model.

[formerly_proven]

Little snitch can block open(2)?

[qbit42]

Is this true on Mac? Usually I am notified when programs request access outside the normal sandboxed or temp folders. Not sure how that works in any detail though.

[raybb]

Ah I guess that's one reason some folks started running it in a docker container. I think Linux server recently released a container for it.

[eli]

To be fair it also ships with the ability to install community plugins disabled.

[hsbauauvhabzb]

To be fair, it’s no worse of a dumpsterfire than any other plug-in ecosystem.