I’ve been using other apps than Obsidian for notes and sharing, so this is nice to read and consider. But isn’t Obsidian an electron app or whatever? Electron has always seemed resource intensive and not native. JavaScript has never struck me as “secure”. Am I just out of touch?

▲

anon7000 7 hours ago | parent | next [-]

JavaScript is a very secure language. The browser is a massive success at running secure JavaScript on a global scale. Every website you use is running JavaScript and not able to read other site data. Electron is the same, running v8 to sandbox JavaScript. Assuming you aren't executing user input inside that sandbox (something many programming languages allow, including JS), it's very secure.

The problem with supply chain attacks is specifically related to npm, and not related to JS. npm as an organization needs to be taking more responsibility for the recent attacks and essentially forcing everyone to use more strict security controls when publishing their dependencies.

▲

asgraham 6 hours ago | parent [-]

Doesn’t this mean browser sandboxing is secure, not JS? Or are you referring to some specific aspect of JS I’m not aware of? (I’m not aware of a lot of JS)

It’s maybe a nit-pick, since most JS is run sandboxed, so it’s sort of equivalent. But it was explicitly what GP asked for. Would it be more accurate to say Electron is secure, not JS?

▲

dalmo3 6 hours ago | parent [-]

I'm really curious about this comment. What would it mean for a programming language to be secure?

Any two Turing-complete programming languages are equally secure, no?

Surely the security can only ever come from whatever compiles/interprets it? You can run JavaScript on a piece of paper.

	▲	chowells 4 hours ago \| parent \| next [-]
		Turing completeness is irrelevant, as it only addresses computation. Security has to do with system access, not computational capacity. Brainfuck is Turing complete, but lacks any primitives to do more than read from a single input stream and write to a single output stream. Unless someone hooks those streams up to critical files, you can't use it to attack a system. Language design actually has a lot of impact on security, because it defines what primitives you have available for interacting with the system. Do you have an arbitrary syscall primitive? Then the language is not going to help you write secure software. Is your only ability to interact with the system via capability objects that must be provided externally to authorize your access? Then you're probably using a language that put a lot of thought into security and will help out quite a lot.
	▲	zdragnar 5 hours ago \| parent \| prev [-]
		A number of operating system security features, such as ASLR, exist because low level languages allow reading and writing memory that they didn't create. Conversely, barring a bug in the runtime or compiler, higher level languages don't enable those kinds of shenanigans. See for example the heart bleed bug, where openssl would read memory it didn't own when given a properly malformed request.

▲

da_chicken 6 hours ago | parent | prev | next [-]

No, it's not really an issue. GitHub and VS Code are also Electron apps. So are Slack and Discord. Postman is, as well.

I'd also be forced to ask... what exactly are you doing with a markdown note-taking application such that performance is a legitimate concern?

But, I mean, maybe you're reading this in a Lynx session on your ThinkPad 701C.

	▲	eviks an hour ago \| parent [-]
		> what exactly are you doing with a markdown note-taking application such that performance is a legitimate concern? Launching it and expecting a fast startup.

▲

dghlsakjg 6 hours ago | parent | prev | next [-]

Javascript is probably one of the most used, depending on how you measure it, languages on earth.

It runs on a majority of computers and basically all phones. There will be many security issues that get discovered b y virtue of these facts.

What makes you think that "native" apps are any more secure?

▲

SilverSlash 2 hours ago | parent | prev | next [-]

Javascript is a lot more secure than C++, since it's a memory managed language.

▲

tester457 6 hours ago | parent | prev | next [-]

It is resource intensive.

It's not a problem on pc, but an obsidian vault with thousands of notes can have a laggy startup on mobile, even if you disable plugins.

Users sidestep this issue with quick capture plugins and apps, but I wish there was a native stripped-down version of obsidian.

▲

CuriouslyC 6 hours ago | parent | prev | next [-]

Not a huge electron fan (thank god for tauri), but Obsidian is a fantastic app and you shouldn't let the electron put you off of it. You can even hook a MCP up to it and an agent can use it as a personal knowledge base, it's quite handy.

▲

codazoda 6 hours ago | parent [-]

> Thank god for tauri

I’d love to try it, but speaking of security, this was the first thing I saw:

sh <(curl https://create.tauri.app/sh)

	▲	edoceo 3 hours ago \| parent [-]
		Right. But you know how to fetch and inspect (yea?) so, I with you that piping random crap to sh is bad. Maybe these snips encourage that behavior. Tauri is trustable (for some loose definition) and the pipe to shell is just a well known happy-path. All that to say it's a low value smell test. Also, I'm in the camp that would rather git clone and then docker up. My understanding is it gives me a littl more sandbox.

▲

GabeIsko 6 hours ago | parent | prev [-]

If you have to render html, which is what markdown ultimately becomes, you might as well use a web broswer.