The Future of Obsidian Plugins (obsidian.md)

Article summary

Obsidian has launched a new community site and developer dashboard for plugins and themes, featuring automated reviews and a new system for plugin safety. The goal is to make it easy and safe for users to discover and use plugins and themes. The new system includes automated scans for security vulnerabilities and code quality, as well as a scorecard system to provide transparency about plugin safety. The launch is part of a larger set of initiatives to improve the Obsidian ecosystem.

Main themes

• Plugin security
• Automated reviews
• Plugin safety
• Developer dashboard
• Community engagement
• Sandboxing and permissions

What commenters say

• The best way to solve the plugin security problem is to properly sandbox plugins with an explicit API and permission system.
• Automated checks are not enough to reliably assess whether a plugin is malicious and should be supplemented with manual reviews and sandboxing.
• A combination of automated scans, AI review, and manual inspection is necessary to ensure plugin safety and security.
• The lack of sandboxing in Obsidian's current plugin architecture poses a significant security risk, as plugins have full access to the user's computer.
• The new plugin review system is a step in the right direction, but it may not be enough to prevent malicious plugins from being installed.
• The use of AI in plugin review can help surface potential security issues, but it is not a replacement for human review and oversight.
• The Obsidian community should prioritize the development of a sandboxing system to improve plugin security and protect user data.
• The current plugin architecture is not unique to Obsidian and is a common problem in code editors and package managers, but Obsidian's closed-source nature makes it harder to verify its security model.