Less is safer: Reducing the risk of supply chain attacks (obsidian.md)

Article summary

The article discusses how Obsidian, a note-taking app, reduces the risk of supply chain attacks by minimizing its dependencies on third-party code and using a strict version-pinning and lockfile approach. This approach allows for a smaller surface area for potential attacks and provides a clear audit trail for changes. The app's developers also prioritize slow and deliberate upgrades, allowing for a delay between upgrading dependencies and pushing releases. This delay acts as an early-warning window for potential security issues.

Main themes

• Supply chain security
• Dependency management
• Version pinning
• Security risks
• Electron apps
• JavaScript security

What commenters say

• JavaScript is a secure language due to its memory management and sandboxing capabilities, making it less vulnerable to security threats.
• The security of a programming language is not inherent, but rather dependent on how it is used and the runtime environment in which it is executed.
• Minimizing dependencies and using a private registry can help mitigate supply chain risks, but it is not a foolproof solution and requires ongoing effort to stay up-to-date with security fixes.
• Pinning dependencies can prevent the adoption of security fixes and updates, creating a trade-off between stability and security.
• Electron apps, such as Obsidian, can be resource-intensive and may have performance issues, particularly on mobile devices.
• Native apps are not inherently more secure than Electron apps, and security depends on various factors, including the programming language and runtime environment.
• The use of JavaScript and Electron does not necessarily make an app insecure, and security depends on the implementation and design of the app.
• Rewriting an app in a native language and sandboxing plugins can provide additional security benefits, but may not be a practical solution for all use cases.