Re:Obsidian plugin was abused to deploy a remote access trojan
by lossyalgo on Monday May 11, 2026 @07:39AM
(#48093720)
I don't know how hard it would be but IMHO adding some kind of permissions dialog(?) akin to Android would go a long way. 99% of Obsidian plugins don't need full disk access, or internet access for that matter.
[ Parent
| on HN ]
Re:Obsidian plugin was abused to deploy a remote access trojan
by embedding-shape on Monday May 11, 2026 @08:14AM
(#48094001)
That'd require some sort of sandbox, which they already seem to not want to have, for whatever reason. If you don't want that, and you want to use JS, building any sort of permission system on top of that that you cannot easily work around, gets really tricky if not impossible.