Be Careful with Obsidian
106 comments
·October 23, 2025moooo99
jamesbelchamber
> I think the increasingly widespread attitude that only open source software is good and trustworthy increasingly annoying and problematic.
Software being open source almost always makes it more trustworthy, and I'm glad that more people are picking up on this over time.
> I generally like people being able to out food on the table
Completely agreed, and this makes for a frustrating paradox.
I don't use Obsidian because it's closed source, but I don't think it's evil or anything. Conversely, I pay for Immich, and I hope their model is sustainable.
pjmlp
In theory, in practice it is obvious that too many eyes to the source keep missing CVEs.
coldtea
Closed source also keeps missing CVEs, only most of them you never know because they aren't even making it to an officially released CVE. You usually don't even know what libs it uses and at what versions, never mind the proprietary code.
And then there's the closed source's Cloud part and its holes as well, which is a whole other can of worms.
exe34
for me it's about running it locally/inside a wireguard network, and not having the rug pulled. not everything needs to be exposed to the internet.
perching_aix
> Software being open source almost always makes it more trustworthy, and I'm glad that more people are picking up on this over time.
What do people get out of replying like this?
oniony
They get to counter a point they think is wrong in an open forum on the internet. I guess they get the satisfaction of providing a second viewpoint to a claim, so that the claim, alone, is not the only viewpoint that others coming to this thread see.
What did you get out of calling out their counterclaim?
coldtea
The satisfaction that they told the objective truth.
coldtea
>I think the increasingly widespread attitude that only open source software is good and trustworthy increasingly annoying and problematic.
If people put their notes in, only open source software is good.
At best, one can tolerate a very big closed source company, who is unlikely to just do whatever with the data and has some track record for privacy, like Apple.
But trusting all your notes to a closed source app from a small peanuts company?
theshrike79
In this case the "closed source app" is using a very open and easy to parse format.
If Obsidian enshittified tonight so badly I had to stop using it, the only thing I'd kind of miss is dataview and bases.
And of those dataview is "just" parsing a bunch of markdown with javascript. Bases is a yaml format for displaying more markdown.
I'm pretty sure I could vibe-code some scripts over a weekend that cover most of my Obsidian use-cases and use any markdown-capable editor for writing.
That's why I use Obsidian (and stopped using Joplin, because - at the time - all my notes were in one obscure blob)
geistlos
I think they could easily make Obsidian open source without losing out on profits. The app itself is free anyway. They could keep the sync backend closed source and make people pay to use the sync feature.
Lots of apps have open-source clients (for trust/auditability) but backends that are closed/locked somehow, e.g., Logseq.
danielspace23
The PKM I've been using lately, SiYuan, does exactly that, and I think their business model isn't bad: the client is fully FOSS, there are some client-side paid features with a one-time subscription (WebDAV/S3 sync "bring your own server") and some server-side paid features with a more expensive recurring subscription (cloud space provided by them).
I don't particularly like client-side paid features, but:
- The client is fully FOSS, you can just patch the license check out. In fact, there are some forks on GitHub that do just that and provide binaries, and the authors don't seem to care, they even acknowledged them on Twitter (https://x.com/b3logos/status/1928366043094724937).
- There are plugins to sync without a paid plan
This works out quite well for them: if you choose a fork or a sync plugin, you don't get the same support that paying users do, so many users still end up buying a license. But you don't need to, which makes the whole thing not user-hostile.
I have bought a one-time license myself, and I'm very happy that I'm supporting the development of a FOSS project.
slightwinder
Obsidian is using electron, so the source is already somewhat available anyway. I understand them not making it open source, and risking someone forking it and harming their business. But considering the situation, I would think making it at least source available on a popular forge, where people can make issues and open merge-requests, might be a beneficial thing.
There are a bunch of small problems people encounter here and there, which usually will never be solved by the company. Giving the community a route to improve their tool, would be good.
pcthrowaway
Does anyone know if it's possible to have a core which is unsandboxed, but load plugins which are sandboxed? This seems like a great solution if so.
DanielHB
This is one of the main use cases for Webassembly outside of the browser.
I think we will soon see the ability to write plugins that can even run server-side of SaaS solutions.
null
tetha
Obsidian also has affordable commercial pricing. By now I very much try to pay support contracts or give back to projects in other ways at work.
The problem is that quite a few open core companies immediately go from $0 / year to low to medium 6-digit-figures per year. This escalates the entire project sky-high in levels of internal scrutiny with a high chance of it not happening.
On the other hand, it was simple to argue why this is easily providing us with $50 in value per year. Now it is integrated with our normal license handling and it's actually slowly and steadily growing internally. We're up another 4-5 users from the last time I looked.
slightwinder
The article is about security and trust. Open Source is in that context by definition the only good solution. Though, doesn't mean that a closed app has to be bad, but you have to blindly trust them, and hope that this will never change. With Open Source, you don't have to be blind, you can trust them educated (or at least trust that other will check what's going on).
Of course this always a bit of case by case, but obsidian is a very exposed and worthful target.
rightbyte
> I generally like people being able to out food on the table, and if that means I have to pay for their software to use it or get updates, then I am happy to do so if that software is of value for me.
Paying money to Obsidian for writing yet another text editor seems like digging and filling holes to increase GDP to me.
N-Krause
While I agree with you, i feel like that was not the point the author was making.
It more so was a warning that the combination of little reviewed community plugins and a not sandboxed macos binary is a potential risk. And with that sentiment I can also agree.
dsissitka
If you're a Linux user you might like Firejail for this.
firejail --appimage --net=none --private=~/path/to/jail ~/path/to/Obsidian.AppImage
elric
Note that if you already have an Obsidian vault, suddenly jailing it might break things. Obsidian stores a bunch of state in ~/.config/obsidian which will no longer be valid. And amusingly/frustratingly, the GTK file picker doesn't take the jail into account and seems to produce invalid paths.
And because --private mounts some bits as temporary filesystems, you might end up losing state. Try before you buy.
terespuwash
There are many good reasons to trust Obsidian team (they are not VC backed, they clearly state they don’t own your data, you are not locked in). If you don’t trust them because they are not open-source then If you want to be a purist about it, then just use an open-source markdown editor instead.
miggol
The author dedicates an entire paragraph to how much they trust the Obsidian team. It isn't open source purism, they are warning users that good intentions don't prevent a developer from writing software containing vulnerabilities.
Usage of user-created plugins and access to cloud accounts aggravates the risk posed by a vulnerability.
Open source reduces vulnerabilities over time, so those who want to heed the author's warning may indeed want to switch to an open-source Markdown editor. Just not because the Obsidian team is Evil.
kgwgk
> they clearly state
seems a low bar for trusting (that part especifically)
k8sToGo
Is this a Mac thing?
On Windows this is how most applications are distributed.
Same with Spotify etc.
Also even if it is open source, who really verifies the binary is built from the source published?
joshvm
> Also even if it is open source, who really verifies the binary is built from the source published?
Apple notarization is usually the way for non Store downloads. Non-notarized apps present a warning and require overriding security settings to run (with admin privilege). There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub, only that some sanity checks have been performed and the binary is not a known threat (or has been modified).
https://developer.apple.com/documentation/security/notarizin...
bobertdowney
> There's nothing inherently stopping someone from notarizing code A and putting code B on GitHub
Sorry what if the open source project made their CI/CD pipeline public? So users could exercise it, produce their own build, and then compare that to the notarized one? Would I then be able to verify that what I downloaded from the developer’s website is identical to what is built with the open source code? Just curious.
warpspin
In theory, yes, you could compare it. In practice, the build would need to be reproducible which is non-trivial depending on the size the of the project and the external dependencies the project itself has.
justincormack
Mac app store distribution is not that common. Some apps are available in the store or as direct downloads. The store adds the sandboxing restrictions, which dont work for many apps, eg its not very easy to install a cli.
imputation
I had to do some gap analysis between note-taking apps with a graph view functionality to allow me to visualise my knowledge-base.
Obsidian was my initial choice but I had grievances with it. I ended up going with Logseq for many reasons - yes it appears to be less mature however that doesn't mean that it is inferior by any measure (and open-source)
Lapel2742
> I ended up going with Logseq for many reasons - yes it appears to be less mature however that doesn't mean that it is inferior by any measure (and open-source)
If I remember correctly it was inferior to Obsidian because Logseq used a proprietary format. Yes, it was/is officially markdown but not in a format that is easily transferred. I don't know if it changed but Logseq documents where literally just a big Markdown list if I remember correctly.
Personally I do see the problem with closed source solutions but the real problem with Obsidian are AFAIk the plugins and not the App itself. I mean: They have a long way to go to be even remotely as evil as people at Google or Microsoft. But if that ever happens I simply walk away with my .md documents.
null
Havoc
Don’t really see much of a reason to single out obsidian in this
reassess_blind
You should always be careful with closed source software. You should also be careful with open source software, unless you're building from source and manually checking the source in each update isn't malicious, which let's be real, nobody does.
warpspin
Plus, in theory you'd also need reproducible builds for everything because who knows what your compiler did to the source ;-)
Reality is, as you already implied: in practice you cannot "be careful" except avoiding obvious malware.
At SOME point you have to trust SOMEONE, unless you use TempleOS in which case you can trust whatever god you have.
null
thomascountz
The set of open source code and verifiable code overlap, but one doesn't always imply the other. In either case, provenance needs to be established. I think it would be reasonable for Obsidian to ship signed checksums and a public transparency log (e.g., Sigstore) for builds (plugins authors could do the same?). A more granular plugin permissions system would be great too, even though most plugins are OSS.
ugur2nd
Obsidian is a startup that's been on my radar. It inspires me. They're able to go so far as to challenge Notion with their small team, which I appreciate. By the way, I'm not saying Notion is bad. I think it's revitalizing the industry.
On the other hand, I was unaware of the vulnerabilities in the Apple ecosystem. Or rather, I didn't think there would be. The article raised my awareness.
agsnu
I wouldn’t hold not being on the Mac App Store against it. The MAS is sort of a failed ecosystem with very low usage/engagement, and all the downsides of the iOS store like potentially lengthy review times (can be a lot longer than the iOS store since it seems to play second fiddle) and arbitrary capricious rejections when you’re just trying to ship innocuous bug fixes to users.
eviks
Plugin sandboxing is the answer to such community extension concerns, but then that's unfortunately only part of the bright future ahead...
I think the increasingly widespread attitude that only open source software is good and trustworthy increasingly annoying and problematic.
Building software takes time and resources. Experienced show that most open source projects do not make enough money to make the resource investment worthwhile, much less the time investment.
I generally like people being able to out food on the table, and if that means I have to pay for their software to use it or get updates, then I am happy to do so if that software is of value for me.
That of course doesn‘t mean I appreciate unnecessary vendor lock in, hostile subscription models, etc. All of these things are common with proprietary software, but they are not inherent to it.
Obsidian is a great example. Easy to takeout open formats, generous licensing model and no aggressive licensing implementation that makes it impossible to use the software offline. The team behind it seems to be able to make a living and people can still feel safe about the access to their notes.
Even if its not open source, it would be great progress if we‘ve had more software like obsidian