troad

No, I don't agree. Asking plugins to pinky-promise which resources they will and will not use is absolutely meaningless from a security perspective. If anything, it engenders a false sense of security in end users, and continues a pattern whereby Obsidian tacitly endorses things that are inherently risky.

The fundamental issue here is that the current plugin model is intrinsically broken, and tinkering around the edges is just a diversion of efforts from clearing that tech debt. It doesn't need to happen overnight, but it does need to happen.

The meaningful improvement here is the promise of sandboxed plugins in the future, assuming I understood correctly, and that's just a fairly vague promise at this stage. I absolutely and in full earnestness wish you guys the best with that one. It will meaningfully improve Obsidian and make it easier to recommend to others.

It has a nice and fully-featured editor, it syncs reliably between devices and it has a mobile app for notes on the go. I don't see why I wouldn't use it.

(What a weird false dichotomy? As if the only two choices were either to extract every possible pound of flesh from something, or not use it at all?)

This word has a surprising amount of regional pronunciations. Each of the US, UK, and Australia pronounce it slightly differently. [0]

[0] https://languagehat.com/solder/

No, it isn't. It's never rude to respectfully try to understand how others speak. If it were, we'd have to shutter all the linguistics departments.

That's good to hear, thanks for letting me know. I might check it out again.

For what it's worth - and I know I'm being very critical of the plugin security model here - I also think Obsidian is very good, and am a paying customer.

Part of my frustration with this is that I've seen hobbyist video games with a more robust plugin security model than Obsidian's plugins. It's possible to do better than just "yolo, eval(github)", and I feel like it would thoroughly improve Obsidian for me, and apparently many others (judging by all these comments), if Obsidian invested in creating a secure plugin ecosystem rather than putting lipstick on the existing yolo plugin vortex.

Just because Obsidian is in JS, and JS has a terrible culture around package security, doesn't mean Obsidian needs to inherit and propagate that culture.

I have indeed read the blog post. Can you point out which part of my post is inaccurate? It is certainly possible I misunderstood something.

Surely you're not about to claim that asking plugins to "disclose" what resources they use is in any way comparable to sandboxing and permissions.

This is an important observation, but there were specific technological choices that Old FB made that were conducive to becoming and staying high-trust. For so long as your feed was just your friends and family, you'd effectively perceive FB itself as the place where your friends and family are. It was ingenious.

Facebook figured out how to scale this high-trust environment infinitely (mutual friending required, limiting engagement to friends or mutuals, etc), and then threw it all away when your feed stopped being "your dear friend Jenny got married" and became "your dear friend Dua Lipa wants you to buy her new album".

No permissions system, nothing resolved. Plugins still have access to everything - full disk, network, etc. How does one even speak of security vulnerabilities when the security model of Obsidian plugins is just straight up "click here for RCE".

All I see is a spanking new interface that will accelerate the pace of plugin turnover, bringing forward the next inevitable security incident.

> the enshittification

A strong reason to stick to using Obsidian as just a Markdown editor and not get sucked into the plugin ecosystem at all. If your Obsidian vault is just a folder of Markdown files, you're ready to leave at a moment's notice.

If I ever go in on some plugin ecosystem, it'll be FOSS, non-commercial, and have been around long enough to drink. (Emacs?) Haven't felt the need; a Markdown vault for reference resources + pen & paper for ephemera suffices for me.

I always thought it was strange how intolerant Homebrew is of users who are not surfing the bleeding edge.

I held out using MacPorts for ages, but there came a point when I just could not reasonably expect to find the software I needed on MacPorts, but could on Homebrew, and so I switched. I wish Homebrew hadn't won that particular mindshare war. Moving from MacPorts to Homebrew felt like downgrading from an actual package manager to a duct-taped shell script.

The first safety warning assures the user that "plugin security is important to [Obsidian]". That Obsidian plugins undergo initial code review by Obsidian themselves. That "many" plugins are open source and that Obsidian has a "large community of developers who watch out for each other". (At this point I'm not sure how this screen even qualifies as a safety warning. Seems more like a billboard for enabling plugins?)

Given that vaults are just Markdown documents, and plugins are so safe (or so Obsidian seems to claim), why should a person feel at all concerned clicking yes to these prompts? Is it still a social engineering attack when the app appears to encourage you along the way? Are these even safety warnings, or just (vaguely encouraging) confirmation dialogs?

I don't see how Obsidian should come off as completely blameless here. They've always tacitly encouraged this wild west plugin ecosystem, because it's an obvious generator of value. They don't get to absolve themselves of any responsibility by pointing at safety warnings, when those "safety warnings" spend (far!) more time explaining why the user might want to click "yes" than "no".

To be clear, I like and use (and pay for!) Obsidian. But the design of Obsidian plugins was clearly broken from the beginning, and the official messaging around them has always been more encouraging than wary. This sort of event is an absolutely inevitable consequence of those decisions.

> multiple safety warnings in Obsidian

Idk, I've always thought it was odd that the "community plugins" settings pane seemed more concerned with assuring the user that community plugins were fine than actually explaining the risk.

There is literally a single sentence about the fact that plugins "may cause data integrity and security issues", and it is hedged with the mealy-mouthed modifier "like any other software you install". The absolute majority of it - maybe 80% of the text by window height - is about the measures Obsidian does to vet and secure plugins. All of it appears to be written with the intent to placate any concerns.

Is this the safety warning? The screen that says that community plugins could cause issues "like any other software", but they're actually super safe and vetted and totally fine? Is it surprising that a person, faced with a screen like this, would be susceptible to a social engineering attack?

Slightly orthogonal, but I'm curious how much effort is going into capturing historic hardware in accurate FPGA representation?

There'll come a day when the final physical 6502, 80486 (etc etc) powers off for the final time, and it seems like these technologies would be worth preserving. (I'm sure this is much easier said than done, not trying to minimise the effort involved.)

Is there a project that does something like this?

There have been protests against tourism in Spanish cities, esp. Barcelona.

As always, the protests are really about local issues (lack of housing, jobs, etc) and foreigners are being scapegoated. A lot of this has a dark edge - e.g. locals spraying water on people that appear foreign to them. The framing around sustainability and 'over-tourism' allows the far left to get in on the xenophobia that's been so useful to the far right. Much easier to attack foreigners than actually come up with solutions to deliver more housing or jobs.

Media narratives aside, these incidents have not affected tourism at all. Spain is and continues to be a massive tourism destination, and the average tourist has never even heard of any of this.

> And I think the value that various cloud companies and tech companies derive from open source by far exceeds their contributions to it.

Isn't that how literally all economic exchange works? Why do you think your boss pays your salary?

If the argument is that Amazon should invest 110% of their OSS-derived profits back into OSS, then OSS ceases to have any value to them. They would simply write their own closed-source software, which would be trivial for a company of Amazon's size, and we'd all be poorer off for not having OSS. Getting one percent of someone's profit is better than getting zero percent.

Me too.

All I want is a top-notch Markdown editor with a mobile app and trustworthy sync, and that's what Obsidian gives me. And if ever Obsidian goes away or is enshittified, I'll still have a perfectly good folder of Markdown documents that I can take elsewhere.

> Not sure what's going on here, but this reads like 90s cosplay.

This reads like Reddit-style "debunk" culture to me.

Improbable things happen. They happen often, because even if the individual improbable thing is itself improbable, the sum total probability of improbable events is high enough that some improbable event happens to all of us with regularity.

Yes, people actually used to get lost. Take a wrong turn, lose your bearings, and you're on some dust road in a corn field. Car GPS did not meaningfully exist. Many people (then, as now) can barely read a map. Highway signage can be busy and confusing. People are young and inexperienced and tired.

Literally any single person who drove before the smartphone era will be able to recount a story to you of getting lost at least once.

> This was certainly before the opioid epidemic and probably also before the heyday of meth. So shirtless guy was probably just a shirtless Kentuckian checking if OP was OK.

Note how this sort of thing is not actually debunking anything in the article, OP said nothing about opioids or the shirtless man's motivation. All we know is that (a) OP awoke in a car in an unfamiliar place, (b) a shirtless stranger hovered over OP, (c) OP found this disconcerting. It's such a tell-tale sign of Reddit-style debunk culture to "fact check" recounts by inventing details, wildly hypothesising, and then "fact checking" their own wild hypotheses against a Wikipedia-level understanding of the situation.

It profoundly annoys me to see such a pedestrian response to an interesting and thoughtful piece. It adds nothing. It actively detracts, in that people with interesting things to share equivocate over doing so, because they cannot be bothered dealing with this lowly form of engagement. And so we get a sea of Redditors and their worthless "well akshually"s drowning out the actual human experiences that are actually worth reading.

> Urgency, expectations… too high these days.

Hear hear.

I was amused to watch the trajectory of all my older relatives, from "I don't understand why you spend all your time on that computer" to "I texted you some idle shower thought ten minutes ago, and it's frankly rude that you haven't replied yet".

Lots of people seem to have lost all sense of perspective.

> To me as a Brit, "buffalo" is not and cannot be a verb, and it's not a place anyone much has heard of either

Very fair! Given the structure of the underlying sentence, I wonder if there are other words that could pull triple duty as an adjective, verb and noun and make such a sentence work.

> But that was written ninety years ago. Things have changed.

Right! Though my point was more about recent reprints leaving those sections untouched.

Just to double check, I pulled a lovely 2023 edition of Válka s mloky off my bookshelf and snapped a photo for you. [0] Not only is the pre-modern orthography left unaltered ("W gednech cizjch nowinách..." for "V jednech cizích novinách..."), but the editors took pains to use an era-appropriate typeface for that section. Note also the repetition of pre-modern orthography for quoted noun phrases in the otherwise modern section below ("jak se jmenoval ten [gistý welitel]?").

I don't think the editors thought this page would be unreadable to a Czech reader in 2023.

> I am reminded of listening to a dad explaining to his little son at Prague Zoo that "tram" was pronounced "trem" in English. I wanted badly to jump in and correct him, but I didn't.

Though of course your correction would only be applicable for the standard modern English of southeast England. :) Americans and Canadians say /æ/ (if not /ɛə/ [1]), and Australian English does actually use the /ɛ/ that the Czech father was presumably saying (if not /e/). I suspect the most surprising thing about that word to a Czech would be the usual affricated realisation of word-initial /t/ as /tʃ/ (=č) when followed by /ɹ/ as in tram, train, etc.

Point taken about language change more broadly, I agree. French takes this to a hilarious extreme. (Textbooks: "Qu'est-ce que nous voulons?" Reality: "On veut quoi?")

Czech is tricky too, as I'm sure you know, being somewhat diglossic in the relationship between 'standard' Czech (to a large degree a 19th century artifice) and actually spoken ('common') Czech. Then you have the added layer of dialects, which often get completely ignored or denigrated (except Prague dialect, which seems to have a hall pass). Czech resources will teach 'standard' Czech and maybe throw in some Prague dialect for colour, which of course leaves the learner largely unequipped to handle the actual ('common') Czech most of the country speaks day to day (without actually giving them a full capacity to handle standard Czech either, which can be rather arcane in its higher registers).

The situation is even worse in Moravia, where the entire rich tapestry of dialects - as different from one another as they are from Bohemian and west Slovak dialects - is just reduced to the single stereotypical Brno slang term for tram ("šalina").

I'm not a huge fan of how Czechs view and relate to (and teach) Czech. I wish there were a better appreciation that the norms of standard Czech, promulgated by the Ústav pro jazyk český, are not akin to the laws of gravity or murder, but one norm among many (and in many cases not even a particularly good norm).

[0] https://imgur.com/a/E87u7QY

[1] https://en.wikipedia.org/wiki//æ/_raising

Just as a contrapoint to the other commenters, I've had Mac do this on PDFs that I myself scanned many years ago. Pretty sure they were not malware.

I suspect what triggered it was the fact that the files had journeyed through many filesystems in their time - HFS, ext4, NTFS, APFS - and they probably picked up some unholy combination of impossible attributes.

I thought it was pretty egregious to have Apple helpfully try to delete important PDFs that I've been lugging around for years.

That's very cool. Don't knock yourself - congratulations on reaching a good level in such a fiendish language. My own SO hovers between A2 and B1 after many years, so I absolutely appreciate how frustrating Czech can be.

> Blb vlk pln žbrnd zdrhl hrd z mlh Brd skrz vrch Smrk v čtvrť srn Krč.

I do enjoy this one. It's all the more amusing in that it only uses fairly common vocab (though somewhat stylised inflection).

Speaking of parsing, you may be aware of the perfectly valid English sentence "Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo". Or the sentence "The horse raced past the barn fell". If not, enjoy. :)

> I think you over-estimate the abilities of ordinary Czechs!

Very possibly! I think two of the examples I provided (the poem Máj and the quote from the Kralická bible) would genuinely be comprehensible to most Czechs, but I might be being too generous with the Karlštejn quote.

If I render it into standard orthography, give or take some endings I had to guess by squinting at the image on my phone, it comes out as:

> V těchto se dozvídá síních pilné robě, Bohu čím povinné, bratřím, vlasti, sobě.

Reordered to simplify the structure, and with glosses, you can probably make it out:

> V těchto [in these] síních [halls] se pilné [diligent] robě [child; archaic] dozvídá [learns, finds out], čím [that which is] povinné [compulsory] Bohu [dative, i.e. to/for God], bratřím [to/for brothers], vlasti [to/for the homeland], sobĕ [to/for oneself].

There is some basic vocab here (Bůh, bratr, vlast), some intermediate vocab (dozvědět se, pilné), and one clear-cut archaism (robě). The overall structure is quite poetic and somewhat inorganic - e.g. the separation of těchto and síních in "V těchto se dozvídá síních" is unnatural, and makes me think of scholastic Latin.

I'm honestly not sure how an ordinary person might read this. I think if it were in standard orthography, it would probably be fairly readable, but if you layer pre-modern orthography on top of the structural acrobatics and archaisms, you're probably right that the average person may struggle.

Čapek uses pre-modern orthography (e.g. gegj for její) for stylistic effect ('ye olde... ') in small sections of Válka s mloky, and modern editions do not generally transcribe these sections into modern orthography, so I think there is at least the implication that a literate Czech ought to be able to read it. To what extent that expectation has a relationship to reality I'm honestly unsure. The Czechs can be (far too) normative when it comes language, as you probably know, so perhaps the literati insist it be printed as is, and everyone else is just too scared to admit they can no longer read it. :P

Thank you for looking through that; that's very interesting and helpful.

I've read some surreal recounts of the Canonical interview process. The CEO appears to have a fairly extreme fixation on candidates' high school experiences.

Needless to say, this is just absolutely bizarre. What kind of kid you were is a terrible proxy for professional competence or even present-day fit. (Not to mention that people's high school experiences are very likely to differ greatly based on things like socioeconomic status, race, sex, sexual orientation, disability, etc., and imposing a normative idea of what high school experiences ought to look like would probably unfairly discount candidates through no fault of their own.)

The disconnect here is that I have a degree in polsci and have read much of Chomsky, and you're repeating a "debunking" (replete with declarations of "fallacies") in a manner that is popular with people whose level of familiarity with political science is "I am active on Reddit".

"Therefore, without further clarification, I must assume" (what a mouthful!) that you are an argumentative teen with a "debate me bro" mindset.

One of the key problems of online exchange is that it is impossible to synthetise expertise without someone much less knowledgeable driving by, and demanding ELI5 level proof. They believe that they must be capable of reaching the same conclusion as someone who has spent years on the topic, and they must get it now, and they firmly believe that the onus is on the expert to give it to them (for some reason). The implication being that years of familiarity are irrelevant unless you replace your nuanced point with "pan in the face"-level direct evidence, such as would satisfy the "debate me bro" teenager who is demanding it. All expertise is invalid except that which an inexperienced Redditor can see with his own eyes (an obvious parallel exists here to conspiracists who "do their own research").

Consider that it would be relatively trivial for me to just type "Chomsky khmer rouge" into Google and throw some random refs at you, and that there may be some reason I haven't done so.

It is both (a) pointless - in that I truly do not care one jot if I have provided a satisfying level of evidence to you (and what about the next Redditor that comes along? and the next one? are we to be stuck at this level of discourse forever?), and (b) fairly deleterious to discussion that happens at a level more sophisticated than first principles.

Consider the implications for the progress of society of being forever stuck in ELI5 performative debate for the benefit of random lay people. The FOX News-ification of all of academia. The reduction of all human knowledge to that which is digestible to the average Redditor.

I note also your reference to right-wing propaganda, etc. From an academic perspective, this is just such an irrelevance. I am not a Marxist, for example, but I find Marxism to offer an occasionally useful lens on economic power relations. If you're still indulging in partisan "he says she says", then I respectfully do not think we're operating at the same level on this topic. That's not to diminish your intellect or knowledge in other fields. I'm sure there are many other skills you have that I do not.

You are entirely free to walk away completely confident you're right and I'm wrong, and this is something that will never matter to me in any way for the rest of my life (I will forget that this exchange ever happened within days). I suppose I engage only in the (probably vain) hope that I might plant a seed in you or someone reading this. I'd consider you going back to read Chomsky a win here, even if I disagree with a lot of his conclusions, because at least there's more to him than this "debate me bro" hellscape.

I won't reply again - this is not a good use of my time. Up to you whether you choose to interpret that as a win (epic Redditor destroys boring academic with facts and logic!) or an opportunity for contemplation.

This is a weird take, imho. Should they feel shame for using Dockerfiles in their OCI-standard-compliant tool? Would you be happier if they introduced subtly incompatible Applefiles?

Why are they obliged to emulate the Docker CLI? This limits them to just shadowing someone else's product. Just use Docker if you want their CLI/API, it uses the same virtualization framework under the hood on Macs.

You're surprised that a project by Apple Inc that is basically a wrapper around the Mac virtualisation framework [0] is Mac exclusive?

[0] https://developer.apple.com/documentation/virtualization

> LUA_USE_C89

How much functionality/performance does one lose with this flag? Genuine question, I don't know.

If C89 and C99 were equally performant/functional, it would seem logical to just target C89 (since any C99 compiler should be able to compile C89 too). There must be some reason it's a flag.

That's perfectly readable to me as a speaker of modern Czech, and it appears to have been readable to all the commenters on your post too.

> W téchto se dozwédá sjnjch pilné robé, Bohu čjm povinné, bratřjm, wlasti, sobě.

This is almost modern Czech, with j for í and w for v (which was the standard orthography for hundreds of years and would be familiar to any educated Czech).

Take the most famous poem in Czech, in its original orthography from 1836:

> Byl pozdnj wečer - prwnj mág

> Wečernj mág - byl lásky čas.

This is perfectly readable, like your sign.

One of the comments claims the sign is from 1487 - I would find this extremely unlikely. The mention of vlast (homeland) is suggestive of the era of the National Awakening (19th century), as is the orthography, font, and diacritics. (And the overall theme of education for God and country seems pretty anachronistic for 1487.)

If we go back in time, to say the Kralická Bible (1593), we're still well within the realm of readable text to modern Czechs:

> Na Počátku stwořil Bůh nebe a zemi. Země pak byla nesličná a pustá: a tma byla nad propastj: a Duch Božj wznássel se nad wodami. Y řekl Bůh: Buď swětlo: Y bylo swětlo.

Let's go back all the way to the earliest Slavic texts, about 1300 years ago, which largely predate Czech altogether:

> Iskonï bě slovo. Ï slovo bě u boga. Ï bogъ bě slovo.

A modern Czech would understand most of this, with the probable exception of iskonï ([na] konci, but used here to refer to the beginning). They would probably miss the exact tense being used for bě, but guess that it's a copula (they might see it as a portmanteau of bylo and je, which is close enough). This is probably comparably difficult for a Czech as say Chaucer is for an English speaker (ie not terribly), except it is half a millennium earlier than Chaucer.

Your overall point about language change has merit, but not all languages have changed at the same exact rate. Balto-Slavic languages are relatively conservative as a group (many linguists were very taken with Lithuanian when it was first noticed within Western academia, as it is so conservative that it has considerable utility in the reconstruction of Proto-Indo-European itself).

This is probably more detail than you wanted - I hope it's interesting and helpful. :)

> The sign above the door at the primary school outside Karlstejn Castle is unreadable to a speaker of modern Czech.

What? No it's not. It looks no more than ~100-150 years old, and is perfectly readable if you've ever seen a long s (like ſo).