Excalidraw Plugin Developer The Future of Obsidian Plugins

Excalidraw Plugin Developer: The Future of Obsidian Plugins ![rw-book-cover](https://img.youtube.com/vi/wedHXARs6n4/maxresdefault.jpg) 🔗 **Source:** [Excalidraw Plugin Developer: The Future of Obsidian Plugins](https://www.youtube.com/watch?v=wedHXARs6n4&t=35s) > [!note]+ Document Notes > tags: #obsidian #plugin-development #open-source #sustainability #security #community-governance > author: Jalt > source: YouTube > reference: https://www.youtube.com/watch?v=wedHXARs6n4 > date created: 2024-12-19 10:30 > > # 🏷️ Title: Excalidraw Plugin Developer: The Future of Obsidian Plugins >  ## 🧰 Action Inbox - [H1] Address funding imbalance for volunteer plugin maintainers — sustainability crisis #plugin-development - [H2] Implement developer-friendly API capabilities in Obsidian — missing functionality forcing workarounds #platform-governance - [H3] Create transparent plugin review process with developer input — trust and communication #security ## 🧭 Table of Contents - [[#📝 Summary]] - [[#📖 Main Content]] - [[#🗒️ Notes]] - [[#📚 References]] - [[#🗣️ Paraphrase]] - [[#📰 Newsletter]] - [[#✅ Action Items]] - [[#🧪 Hypotheses]] - [[#📊 Methodology]] - [[#❓ Questions]] - [[#🔮 Future Research]] - [[#💡 Implications]] - [[#🧠 Learning Styles Assessment]] - [[#📊 Accessibility Assessment]] - [[#🌍 DEIB Assessment]] - [[#✅ Logical Validity]] - [[#🛡️ DARVO Analysis]] - [[#🎯 Conclusion]] ### 🔗 References - [Obsidian Community Site](https://obsidian.md) - [Excalidraw Plugin](https://github.com/zsviczian/obsidian-excalidraw-plugin) ## 📝 Summary - What happened: Obsidian launched a community plugin review site that gave low security scores to popular plugins, including Excalidraw (6M+ downloads) - Why it matters: Exposes fundamental sustainability crisis in volunteer-maintained plugin ecosystem with commercial expectations but no funding framework - Key stakeholders: Plugin developers, Obsidian users, platform maintainers, open source ecosystem - Risks and tradeoffs: Security vs. innovation, sustainability vs. quality expectations, transparency vs. developer burnout - Bottom line: Need sustainable funding and API support for plugin ecosystem or risk losing valuable community contributions ## 📖 Main Content The developer of Obsidian's most popular plugin (Excalidraw, 6M+ downloads) raises critical concerns about the sustainability of volunteer-maintained plugins facing commercial-grade expectations. Obsidian's new community review site highlighted security issues in plugins, but the developer argues this creates unfair pressure on hobby projects lacking financial support or adequate APIs. Key tensions include platform limitations forcing workarounds that appear as security risks, lack of developer communication about review processes, and fundamental mismatch between quality expectations and volunteer capacity. The developer spent four days addressing review findings, improving from 38% to 78% quality score, but questions whether this model is sustainable. The broader ecosystem challenge involves 4,000 plugins with 120M downloads maintained largely as hobby projects, with only ~2% user financial support rate despite heavy usage. This creates potential for developer burnout, reduced innovation, or shift toward closed-source development. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/wedHXARs6n4?t=0) — [H1] Obsidian launches plugin review site - Key idea: New community site reviews plugin quality and security after third-party sites highlighted issues - Evidence: "4,000 plugins and 120 million downloads... third-party plugin review sites started to mushroom" #### ⏱️ [02:15](https://youtu.be/wedHXARs6n4?t=135) — [H2] Developer reaction to poor plugin scores - Key idea: Excalidraw developer felt blindsided by public security review without prior communication - Evidence: "I thought I'm going to blow up... they publish this crappy report that undermines user trust" #### ⏱️ [04:30](https://youtu.be/wedHXARs6n4?t=270) — [H1] Plugin ecosystem economics crisis - Key idea: Hobby projects receiving commercial expectations without funding framework - Evidence: "single person hobby developer... 0.1 person who works on a plugin... pushing commercial set of expectations" #### ⏱️ [07:45](https://youtu.be/wedHXARs6n4?t=465) — [H2] Platform API limitations force workarounds - Key idea: Missing Obsidian APIs require creative solutions that appear as security risks - Evidence: "Obsidian does not provide a means for plugins to deploy multiple assets... I'm forced into all sorts of workarounds" #### ⏱️ [10:20](https://youtu.be/wedHXARs6n4?t=620) — [H3] Building bridge between moving platforms - Key idea: Plugin developers must adapt to constant changes in both Obsidian and integrated tools - Evidence: "like building a bridge between two moving continents... completely in the dark in terms of what's going to happen" #### ⏱️ [12:10](https://youtu.be/wedHXARs6n4?t=730) — [H2] Open source transparency vs closed source protection - Key idea: Open plugins face public scrutiny while closed platforms control their review timing - Evidence: "Obsidian is closed source... they had time to fix issues behind curtains, but plugins expected to be open source" #### ⏱️ [14:45](https://youtu.be/wedHXARs6n4?t=885) — [H3] Risk of incentivizing closed development - Key idea: Public security reviews may push developers toward less transparent approaches - Evidence: "incentivize towards closed plugins because that's the easiest to avoid this spotlight" #### ⏱️ [16:30](https://youtu.be/wedHXARs6n4?t=990) — [H2] User responsibility vs platform control - Key idea: Security should balance user education with developer support rather than pure restriction - Evidence: "if you're using Obsidian... you need to understand what you're doing... it is your responsibility" #### ⏱️ [18:15](https://youtu.be/wedHXARs6n4?t=1095) — [H3] Developer trust through community engagement - Key idea: Long-term support and transparency more valuable than automated security scores - Evidence: "over 300 videos about Excel... I respond to issues... that should count not the security reviews" #### ⏱️ [20:00](https://youtu.be/wedHXARs6n4?t=1200) — [H2] Local-first security context - Key idea: Security concerns mismatched to Obsidian's local-first architecture - Evidence: "focusing on security issues... feels like you're super concerned about locking windows while your garage, back door, front door everything is wide open" #### ⏱️ [22:30](https://youtu.be/wedHXARs6n4?t=1350) — [H3] Plugin compatibility and user behavior - Key idea: Users installing too many untested plugins creates more risk than individual plugin security - Evidence: "I've seen lists of close to 100 plugins. That's not going to work... not tested for compatibility with each other" #### ⏱️ [25:45](https://youtu.be/wedHXARs6n4?t=1545) — [H1] Sustainability and burnout risk - Key idea: Increased scrutiny without support framework threatens plugin ecosystem viability - Evidence: "putting magnifying glass on plugin source codes... is going to cause burnout" #### ⏱️ [28:10](https://youtu.be/wedHXARs6n4?t=1690) — [H1] Financial support gap - Key idea: Massive usage with minimal financial contribution threatens sustainability - Evidence: "110,000 regular users... roughly 2% ever felt need to drop coin in my coffee mug" #### ⏱️ [30:45](https://youtu.be/wedHXARs6n4?t=1845) — [H1] Need for sustainable plugin framework - Key idea: Platform lacks mechanisms for paid plugin features or developer support - Evidence: "Obsidian doesn't provide framework... we need community that really steps up to support plugins" ## 📚 References - [Obsidian MD](https://obsidian.md/) - [Excalidraw Plugin Repository](https://github.com/zsviczian/obsidian-excalidraw-plugin) - [Sketch Your Mind Community](https://sketchyourmind.net/) ## 🗣️ Paraphrase - Obsidian's plugin security review system creates unfair pressure on volunteer developers who lack resources to meet commercial-grade expectations - Platform API limitations force creative workarounds that automated security tools flag as risks, penalizing innovation needed to serve users - The fundamental economics don't work: millions of users benefit from plugins while only 2% provide financial support to maintainers ## 📰 Newsletter **Plugin Sustainability Crisis: Lessons for WordPress Developers** The Obsidian plugin ecosystem faces a critical challenge that WordPress developers should watch closely. With 4,000 plugins and 120M downloads maintained largely by volunteers, new security review requirements are exposing fundamental sustainability issues. Key takeaway: Automated security scanning without developer context can unfairly penalize innovative solutions to platform limitations. When volunteer maintainers face commercial expectations without funding frameworks, entire ecosystems risk losing valuable contributors. For WordPress: Consider how plugin review processes balance security with developer sustainability, ensure adequate APIs exist to prevent risky workarounds, and explore funding mechanisms for critical ecosystem contributions. Resources: [Learn WordPress Plugin Development](https://learn.wordpress.org/), [Plugin Security Guidelines](https://developer.wordpress.org/plugins/security/), [Sustainability Research](https://sustainoss.org/) ## ✅ Action Items #### DevRel - Developer advocacy: Research plugin monetization models, present sustainability frameworks at WordCamps - Education: Create workshops on secure plugin development without limiting innovation - Developer experience: Audit WordPress APIs for gaps forcing security workarounds - Developer marketing: Highlight sustainable plugin development success stories - Community management: Facilitate discussions between plugin developers and security reviewers #### OSPO - Policy & Governance: Develop balanced security review processes with developer input - License Compliance: Study open source sustainability funding models - Security Management: Create context-aware security scanning that understands platform constraints - Software Inventory: Map critical ecosystem dependencies maintained by volunteers - Developer Support: Establish mentorship programs for security best practices - Community Engagement: Fund critical plugin maintenance through grants or stipends #### Community - Maintainers: Create sustainability assessment tools and funding guidance - Contributors: Develop plugin security contribution pathways beyond code - Sponsors: Transparent impact reporting for plugin ecosystem investments - Ecosystem: Cross-platform coordination on sustainable development practices #### WordPress - Core: API gap analysis to reduce plugin workaround requirements - Core Performance: Security scanning that understands WordPress architecture context - Community: Plugin developer sustainability survey and support programs - Training: Security-focused development courses with practical examples - Marketing: Campaigns highlighting plugin developer contributions and support options - Support: Escalation paths for plugin developers facing unfair security assessments - Documentation: Security best practices that work within WordPress constraints - Plugins: Review process improvements incorporating developer feedback and platform context #### The WPCC - Programs: Plugin developer sustainability fellowships - Projects: Security scanning tool development with WordPress-specific context - Funding: Matched grants for critical plugin maintenance and security improvements #### FAIR - Technical independence: Study vendor lock-in risks in plugin security tooling - Policies: Transparent plugin review criteria with appeal processes - Governance artifacts: Plugin ecosystem sustainability frameworks ## 🧪 Hypotheses - Plugin security reviews without developer consultation reduce ecosystem trust and participation - Automated security scanning produces false positives when unaware of platform architectural constraints - Volunteer-maintained plugins cannot sustainably meet commercial security expectations without funding - Open source plugins face unfair scrutiny compared to closed source platform components ### 📊 Methodology - Survey plugin developers about security review impact on development practices - Analyze correlation between security review scores and actual security incidents - Compare security review processes across platforms (WordPress, Obsidian, VSCode) - Study funding model effectiveness for plugin sustainability ### ❓ Questions - How can security reviews provide value without creating unsustainable burdens for volunteer developers? - What funding mechanisms could bridge the gap between user expectations and developer capacity? - How should platforms balance innovation-enabling APIs with security constraints? ### 🔮 Future Research - Cross-platform plugin sustainability study comparing WordPress, Obsidian, and other ecosystems - Security scanning tool development incorporating platform-specific architectural knowledge - Plugin monetization and funding framework experimentation ### 💡 Implications - Practice: Security reviews must include developer consultation and platform context - Policy: Need balanced frameworks supporting both security and developer sustainability - Security: Automated tools require architectural awareness to avoid false positive penalties - Education: Developer training on secure practices within platform constraints - Funding: Ecosystem sustainability requires user contribution culture and platform support mechanisms ### 🧠 Learning Styles Assessment Reading level estimate: 12th Grade #### 👀 Visual learners - Present: Plugin download statistics, user engagement metrics - Improve: Security review process flowcharts, ecosystem dependency maps #### 🔊 Aural learners - Present: Video format with developer testimonial - Improve: Podcast discussion with multiple plugin developer perspectives #### 🗣️ Verbal learners - Present: Clear definitions of technical terms, analogies for complex concepts - Improve: Glossary of plugin development and security terminology #### 🧩 Kinesthetic learners - Present: Step-by-step security improvement process described - Improve: Interactive security assessment checklist, hands-on workshops #### 🧠 Logical learners - Present: Statistics on downloads vs support, timeline of events - Improve: Decision trees for security vs innovation tradeoffs, cost-benefit analysis #### 🧑‍🤝‍🧑 Social learners - Present: Community discussion prompts, developer experience sharing - Improve: Facilitated discussions between developers and platform teams #### 🧘‍♀️ Solitary learners - Present: Individual developer reflection and decision-making process - Improve: Self-assessment tools for plugin sustainability, personal action planning #### 🌿 Naturalistic learners - Present: Ecosystem health metaphors, sustainability language - Improve: Environmental impact of digital labor, community ecosystem health indicators ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, descriptive video content - Improve: Detailed video transcript formatting, timeline landmarks #### Keyboard navigation - Present: Standard video controls accessible - Improve: Timestamped section navigation, keyboard shortcuts #### Contrast and readability - Present: Standard text meets contrast requirements - Improve: High contrast video player options #### Text resizing and reflow - Present: Responsive text layout - Improve: Variable font size video subtitles #### Media and captions - Present: Full transcript provided - Improve: Professional captions with speaker identification, audio descriptions #### Forms and interactions - Present: Basic video interaction controls - Improve: Accessible feedback forms for community discussion ### 🌍 DEIB Assessment #### Cultural breadth - Present: Single developer perspective from plugin ecosystem - Improve: Multiple cultural perspectives on open source sustainability #### Inclusive language - Present: Generally accessible technical discussion - Improve: Define more technical jargon, avoid assumptions about financial capacity #### Neurodiversity support - Present: Clear structure with timestamped sections - Improve: Content warnings for frustration/anger, visual stress indicators #### Representation - Present: Individual male developer perspective - Improve: Include diverse developer voices, different project scales and contexts #### Psychological safety - Present: Honest emotional expression, constructive criticism - Improve: Community guidelines for developer support discussions ### ✅ Logical Validity #### Strong reasoning - Deductive strength: Clear cause-effect from security reviews to developer pressure - Inductive strength: Good evidence from personal experience and ecosystem statistics - Causal reasoning: Convincing link between funding gaps and sustainability issues - Analogical strength: Effective comparisons to closed vs open development models #### Fallacies - Appeal to emotion: Uses anger and frustration to drive points, but backed by data - False dilemma: Occasionally presents binary choices where nuance exists - Ad hominem: Some criticism of Obsidian process but focused on behavior not character #### Tone of voice - Overall tone: Frustrated but constructive, passionate advocate for developer sustainability ### 🛡️ DARVO Analysis - Deny: No denial patterns observed - developer acknowledges actual security issues found - Attack: Criticizes process not individuals, focused on systemic issues - Reverse victim/offender: No reversal - clearly positions self as affected party seeking systemic solutions - Emotional cues: Legitimate frustration about process fairness and sustainability concerns --- ## Full Transcript [00:00] Hey everyone, it's Jalt here. Today I [00:04] want to talk about a topic that is [00:08] highly personal, [00:10] somewhat sensitive, [00:12] maybe even controversial, [00:14] but I think we need to have an honest [00:17] conversation. [00:20] For me, it all started with Steph's post [00:23] on Axe last week. And those of you who [00:26] don't know who Steph is, he's the CEO of [00:29] Obsidian MD. And Obsidian MD is a [00:33] privacy first markdown note-taking tool [00:37] that has been gaining increasing [00:39] popularity over the last couple of [00:41] years. [00:43] Steph announced the new community site [00:46] for Obsidian. [00:48] The new community site essentially gives [00:50] users access to plug-in reviews both [00:55] quality in terms of is it maintained is [00:58] the owner active and security and code [01:02] quality reviews in terms of are there [01:05] any suspicious behaviors? Are there [01:08] heightened privileges? What is under the [01:11] hood? So why is this important? Because [01:14] Obsidian has close to 4,000 plugins [01:19] and over the lifetime of the Obsidian [01:21] ecosystem, the number of plug-in [01:24] downloads has now reached 120 million, [01:28] which is a huge number. Now, mind you, [01:31] Obsidian [01:32] was obliged to take a step. They were [01:35] not acting on their own timeline because [01:39] third-party plug-in review sites started [01:42] to mushroom [01:44] and these sites conveyed a picture about [01:48] the plugins [01:50] that was not very good. They highlighted [01:52] lots of security issues and I think [01:55] overall the concern was that here's a [01:58] markdown editor that's local first [02:02] privacy centric [02:04] and it has tons of plugins with glaring [02:08] holes and essentially plugins make [02:12] obsidian really useful. So there is no [02:15] two ways about it. Something had to be [02:18] done. Now, where do I come to the [02:20] picture? [02:22] I'm the developer of the Obsidian [02:24] Excolid plugin, [02:27] which is or has been for the last two to [02:30] three years the most downloaded plugin [02:34] in the Obsidian plug-in store or [02:37] community plugins. I recently crossed [02:41] the 6 million download mark and now I'm [02:44] at 6.1 million. So I take up roughly 5% [02:48] of the total downloads. [02:51] Now in the last [02:54] two months my focus was elsewhere. I was [02:57] starting up the Sketch Your Mind [02:59] community. I was building the site. I [03:02] was planning the content. I was focused [03:05] on creating a community around visual [03:08] thinking, excellited. [03:17] I didn't know about the third party [03:19] review sites. There was some discussion [03:22] on the alpha tester channel. So, this is [03:26] the internal channel between the key [03:29] plug-in developers and the Obsidian [03:31] devs. There was already some [03:34] conversation about the community site, [03:37] but I missed those conversations because [03:40] my attention was elsewhere. And when I [03:43] looked at the community site and I [03:45] looked at the score for Excel, [03:49] I thought I'm going to blow up. I was so [03:53] upset, so angry. How come Obsidian [04:00] does not let me know that they're [04:02] launching this site that paints Excolid [04:05] Raw [04:08] in a completely dirty and I think [04:11] incorrect light [04:13] because over the past four to five years [04:17] I poured my heart into this tool. I [04:21] built the capability that I dreamed of [04:25] my entire life. A visual thinking power [04:28] tool that does everything I ever wanted. [04:33] And I was heavily working on creating [04:37] trust, transparency to be authentic with [04:41] my user community. That's why I started [04:44] the YouTube channel. That's why I was [04:46] working actually on the community side. [04:49] And here comes Obsidian. They publish [04:52] this crappy report that undermines user [04:56] trust. And I was already starting to [04:59] receive questions from the user [05:00] community that, oh, they understand, but [05:03] they're scared. What am I going to do? [05:05] What's going to happen? [05:07] I felt that Obsidian put me on the spot. [05:12] Now later on I learned that it was [05:14] actually already the third party sites [05:17] putting me on this spot but but I was [05:20] extremely upset. [05:24] I wanted to create a video then but I [05:27] thought better of that. Maybe you would [05:30] have enjoyed that more because I would [05:32] have been raging in that video. Now I'm [05:35] more calm and probably more boring. [05:39] But yeah, I want to tell you the [05:42] developer side of the story [05:46] because I think there is a perception [05:49] gap. I think there are the scanner [05:52] scores versus the reality. There's of [05:56] course the issue of the damage to trust [06:00] which I care a lot about because [06:04] I have only the best intent with the [06:07] tool that I created and if it shows if [06:10] the report shows that the tool is high [06:13] risk because of all sorts of scanning [06:17] results I think that does not show a [06:21] proper picture. Now, don't get me wrong, [06:26] I understand and agree with the intent [06:30] because especially since the AI code [06:33] generators are available, [06:37] anyone with zero technical skills can [06:41] start to build plugins. And [06:44] unfortunately, the world is full of [06:47] people who have malicious intent. So [06:51] essentially that opens a great risk of [06:54] how well the plugins are reviewed and [06:57] what risk it creates. But I think [07:01] without the technical context, without [07:04] the broader context of plugins, the [07:08] results can be super misleading. [07:12] Now I think there's also and this is the [07:14] more important discussion. I think there [07:18] is a hidden question about plug-in [07:21] economics because excol and I think [07:26] pretty much all of the other plugins in [07:28] the community plug-in store are hobby [07:32] projects. These are typically oneperson [07:36] maintenance projects [07:38] and right now these hobby projects are [07:42] suddenly receiving commercial [07:44] expectations. they are put on the spot [07:47] and there's an expectation that they [07:49] meet certain quality guidelines and [07:52] again I have no issue with the code [07:54] reviews with all of the material [07:58] but the reality is a single person [08:03] hobby de developer [08:06] is in a an extremely hard situation [08:09] because the single person might still [08:11] sound like a lot but think of this. So [08:15] you do this next to your day job. You [08:18] come home. You might do it in the [08:20] evening. You might do it over the [08:22] weekend. So this is really 0.1 person [08:26] who works on a plug-in if the person [08:29] works on it frequently like I did. I [08:32] think many other people don't sacrifice [08:35] this much time [08:37] and pushing this commercial set of [08:40] expectations on these hobby projects. [08:44] I think is unfair or at least it raises [08:48] some important questions that we need to [08:50] talk about. I spent the last four days [08:54] working on the gaps and by now I managed [08:58] to move the needle from I think 40% or [09:02] 38% was the first value I saw to now 78% [09:07] quality. And I think in both sectors, [09:11] the plug-in is right now considered good [09:16] by these tools. And yes, I have found a [09:20] few hidden bugs, albeit they were [09:24] very low risk bugs, but okay, by doing [09:28] some of these actions, I found bugs. I [09:31] did implement a GitHub release workflow, [09:33] which is going to help me going forward [09:36] as well. So, I'm happy about it. [09:39] And I did update the plug-in readme to [09:42] be much more transparent. So I think [09:44] that's a win as well because [09:46] transparency and honesty are super [09:50] important for me. [09:53] But I think we also need to understand [09:55] the architectural constraints [09:58] because many of the solutions and mind [10:01] you excolitra I think is probably [10:05] without exaggeration the most complex [10:09] plug-in in the plug-in store but I [10:12] struggle with lots of things that [10:15] Obsidian didn't provide. So you know now [10:18] I suddenly receive this set of [10:21] requirements without a financial [10:23] framework [10:25] without the supporting APIs and [10:28] capabilities. So what am I talking [10:30] about? For example, Obsidian does not [10:33] provide a means for plugins to deploy [10:37] multiple assets. I'm talking about [10:40] fonts. I'm talking about different [10:42] packages. In my case, for example, for [10:46] latte, I need to deploy the mathjacks [10:50] library because the one in Obsidian does [10:54] not support SVG exports and for Excel, [10:57] that's what I need. I'm for forced into [11:00] all sorts of workarounds. For example, I [11:02] wanted to implement proper PDF printing [11:05] of drawings, which was a heavy user [11:08] requirement, but there is no API for [11:12] that. So, I'm using Electron, that's the [11:16] browser under Obsidian, Electron API [11:20] calls, and now that's highlighted as a [11:23] high-risk item. I was pushed by the [11:27] community to create features. Indeed, [11:29] just today I received another feature [11:31] request to expand this set of feature [11:35] set in Excalibraw to allow external [11:39] files. So files that are on your file [11:41] system but not in your Obsidian vault to [11:44] be featured on Excelro drawings. And for [11:48] a long time I pushed back but finally I [11:50] gave in. And of course that is a [11:53] security finding that Excelro has file [11:56] system access. But I could go on about [12:00] the API missing for Obsidian Publish and [12:04] so on with Mermaid with with pretty much [12:08] everything I do. I run into blockers or [12:14] run into missing capability in Obsidian [12:18] and I solve it. But now those solutions [12:21] suddenly get in the spotlight and they [12:24] are shown as weaknesses. they are shown [12:28] as security risks. I don't think that [12:31] that is okay. And on top of this, you [12:34] need to understand that Excel is like [12:38] building a bridge between two moving [12:41] continents because obsidian has been [12:45] constantly developing. And unfortunately [12:48] even the alpha channel in testing and we [12:53] are I think the closest to the Obsidian [12:56] developers from all the Obsidian [12:59] community [13:01] even we are completely in the dark in [13:03] terms of what's going to happen in half [13:05] year time. So it's always reacting to [13:09] whatever Obsidian did. And I'm in the [13:12] same situation with Excelro. Excolit is [13:15] also a rapidly growing tool component [13:18] and my integration the excolro plugin [13:22] tries to bridge this gap tries to be the [13:25] rubber that connects these two such that [13:28] everything moves but it still works. I [13:31] think it's an amazing product, [13:34] but now with the code reviews, I'm [13:37] getting punished for this flexibility, [13:41] for this capability. [13:44] And I think there is a fundamental [13:47] imbalance. You know, Obsidian is closed [13:50] source. They have published security [13:54] reviews and that's great. Kudos. I am [13:57] really happy to see the Obsidian [13:59] security reviews published, but they did [14:03] it on their own clock. I don't know how [14:05] many attempts they did until they got [14:08] the right audit. They had the time to [14:11] fix the issues behind the curtains, but [14:14] plugins they are expected to be open [14:17] source. And now if they're open source [14:20] then suddenly everyone can scan it and [14:24] without technical expertise without [14:26] understanding of the context [14:30] you get reviews and I think one of the [14:32] real risks here is this is going to [14:37] incentivize towards closed plugins [14:40] because that's the easiest to avoid [14:43] this. Now of course you cannot hide [14:45] everything. So in the end, the code that [14:50] you publish is going to be visible, but [14:53] you can hide lots of things that this or [14:56] these reviews highlight. So if you want [15:00] to avoid the spotlight, I'm afraid the [15:02] incentive is going to be towards closed [15:05] plugins. Now, I don't plan to do that. I [15:08] believe in open sharing. I believe in [15:12] collaboration and I believe in giving [15:15] everyone an opportunity to learn and to [15:18] develop. But I see this risk as a real [15:22] huge risk. [15:24] And I think there is this [15:28] issue about freedom versus control [15:32] because there are some tradeoffs and be [15:36] careful what you ask for because you [15:38] might actually get it. [15:41] I love Obsidian [15:43] because it's open, it's powerful, and [15:47] because there are no limitations. [15:50] It's not like I'm not going to name [15:53] other tools. I have my turf with lots of [15:55] other tools that are closed and cannot [15:57] be really extended. But maybe one [16:00] example, for a long time, for roughly 20 [16:04] years, I was using an application called [16:06] the brain. [16:08] And the reason, the only reason I left [16:11] the brain was because it does not [16:13] provide [16:15] custom developments. Yes, you could do [16:17] it and I found ways to do it, but it was [16:21] really a closed system and it always [16:24] frustrated me. Obsidian is flexible. [16:29] It's innovative. It's powerful because [16:32] it's open and flexible. [16:35] And I think putting the code scanners, [16:39] putting security in the forefront, of [16:41] course you cannot not do that, but it [16:45] has the risk of closing down an open [16:49] ecosystem and that way damaging the [16:53] value that Obsidian creates. And I think [16:56] it also puts the user responsibility [17:01] in the wrong place because if you're [17:04] using Obsidian, if you're opening a [17:07] plug-in, you need to understand what [17:09] you're doing. Plugins and Obsidian has [17:13] an optin to turn on plugins. And of [17:16] course, I guess most people never read [17:18] that optin, but it is your [17:22] responsibility to understand what you're [17:26] doing. And I think beyond security [17:29] reviews, I think what's maybe more [17:32] relevant in terms of trusting plugins is [17:35] their lifetime, their level of support, [17:39] and the connection you might have with [17:41] the developer. I think in that regard, [17:44] Excel stands out. I have over 300 videos [17:49] about Excel. [17:51] I'm available. I respond to issues. I [17:55] don't solve every issue, but pretty much [17:57] every issue I respond to at least with a [18:00] comment. If someone contacts me, I [18:03] support the person. I think that should [18:06] count and not the security reviews. And [18:10] I think also these security reviews miss [18:14] an important point that Obsidian is a [18:19] local first application. What does it [18:22] mean? It provides a fully transparent [18:26] local environment [18:28] and focusing on the security issues [18:31] highlighted in the different reviews [18:34] to a large extent feels like that you're [18:37] super concerned about locking the [18:40] windows on your house. I mean, while [18:44] your garage, your back door, your front [18:46] door, everything is wide open. Obsidian [18:50] is powerful. It's a free environment, [18:55] but you need to use it with the right [18:59] level of caution and the right level of [19:02] skill. If you don't have that, then I [19:05] think it's better not to have plugins [19:08] installed or at least not many plugins [19:11] installed. And also, I think the issue [19:15] is the number of plugins you install. I [19:18] actually install only a few plugins, [19:21] roughly 10 plugins, and I sometimes get [19:26] reports by users that they find a [19:29] compatibility issue with Excalator, etc. [19:31] I ask them to send me their list of [19:33] plugins, and I've seen lists of close to [19:38] a 100 plugins. That's not going to work. [19:41] A, I don't believe that you can [19:43] effectively use 100 plugins in your [19:46] workflow. And B, that is super high [19:49] risk. Not because someone wants to fraud [19:51] you, but let's be honest, these plugins [19:55] are hobby projects. [19:57] They are not tested for compatibility [20:01] with each other. And I have even a list [20:04] of all the plugins that are not really [20:07] compatible with Excelro. If you have [20:09] this plugin and Excalibro, then Obsidian [20:12] slows down. Not because Excaladro is [20:15] poorly written or the other plugin is [20:18] poorly written, but they are not [20:21] designed, they are not tested together. [20:25] And I think there's also an issue about [20:28] sustainability because if you expect [20:33] plugins to be open-source hobby projects [20:37] by volunteers, [20:39] then I think increasing the quality bar [20:43] on what you expect plugins to do, [20:46] putting the magnifying glass on the [20:50] plug-in source codes and starting to [20:52] call out things like why are you [20:55] handling your stylesheets like that or [20:58] why do you have that web address in your [21:01] source code or etc. I think that is [21:06] going to cause burnout. For example, the [21:10] review identified I think originally [21:13] close to 100 web links in my plug-in and [21:18] it was highlighted as high risk. So what [21:21] are those? They are all opt-in features [21:23] for various AI engines that you can use [21:27] for OCR services. They are support links [21:31] to videos and websites in the help in [21:36] the plug in the script store all over [21:39] the place that help users get [21:42] information and learn about the plug-in. [21:45] There's zero link that would lead to any [21:50] malicious intent in indeed Xfoli doesn't [21:53] even initiate calls without the optin [21:58] consent of the users. But how does this [22:00] show up in the reviews? It shows up as a [22:03] huge security risk because the plug-in [22:07] is full of links. I don't think that's [22:10] okay. But I think from a sustainability [22:12] perspective that's not okay because this [22:16] is drastically raising the maintenance [22:20] burden. And you know Obsidian frequently [22:24] boasts that it's a communityf funed [22:29] ecosystem that they don't have venture [22:32] capital that everything is built by a [22:35] small engineering team of four people. [22:38] And I think that's great. [22:40] Plugins don't have a financial [22:43] framework. There is the coffee option. [22:47] Now you know what I have based on this [22:50] new report I can see I have roughly [22:53] 110,000 [22:55] regular users. Out of the 110,000 [22:58] people, roughly 2% of that community [23:03] ever felt the need to drop a coin into [23:08] my coffee mug. [23:11] And I have roughly a hundred regular [23:15] supporters. If you're one of them, huge [23:18] thank you. If you're one of the once off [23:21] supporters, huge thank you. But I think [23:24] there's a major imbalance here. The [23:27] amount of work put in by the plug-in [23:30] developers, [23:32] the lack of recognition, financial [23:36] support from the community, the lack of [23:40] capability by Obsidian to support the [23:43] plug-in ecosystem for complex plugins [23:45] like Xcolid. [23:48] Obsidian misses the entire feature set [23:52] to build paid plugins or to create a [23:56] framework where I could create plug-in [23:59] features that are for money. That [24:02] doesn't work. Obsidian doesn't provide [24:05] that framework. And I think that is not [24:09] okay because now we have such an [24:12] imbalance. There's a request, a [24:14] requirement to increase the plug-in [24:17] quality. There's the magnifying glass on [24:20] it, but we miss the entire framework [24:24] that would make that possible. We need [24:28] to have a community that really steps up [24:32] to support plugins. And now mind you it [24:35] might turn out that lack of community [24:39] support means that actually what I feel [24:42] is important and valuable in this case [24:45] Obsidian XColy draw but of course [24:48] everyone has their own plugins is really [24:51] not that important. It doesn't add [24:53] value. It doesn't create anything for [24:56] the community and then I think it's the [24:59] right step to kill those plugins. But I [25:03] don't think that that's the case. I [25:04] think in reality, everyone thinks [25:07] someone else is going to do the support. [25:09] It's like when, [25:11] and this is going to be a very ugly [25:14] example, when someone is raped and [25:17] everyone in the community is watching [25:20] and no one steps in because no one is [25:24] willing to step forward to take [25:26] responsibility. [25:27] I think plug-in developers are now in [25:30] this situation [25:32] because they lack the support, they lack [25:35] the financial framework and they get the [25:38] challenge to improve and the pressure to [25:41] improve. [25:44] So I think this leads me to this bigger [25:49] ecosystem question of what is the future [25:54] of plugins? How can we make Obsidian [25:57] plugins sustainable? [26:00] Who pays the hidden cost? Because [26:01] there's no such thing as a free lunch. [26:05] Someone pays for it. If it's not you, [26:09] then it's probably the developer paying [26:11] for it and you taking a free ride. And I [26:16] know I'm unfair, but you know what? [26:19] Apart from the extreme cases, I really [26:24] don't buy the point that I'm financially [26:28] not able to give $2, $3 to support the [26:33] plug-in that I'm using. Don't tell me [26:35] that. I don't believe you. I have [26:38] students among the 100 regular [26:40] supporters and I don't think students [26:43] are typically the most financially [26:46] capable. But I think this just takes the [26:49] question of who pays the hidden costs [26:52] and how are we going to [26:55] change the game such that support [26:59] matches the expectations. [27:02] So if you [27:05] have a perspective on this, I'd love to [27:08] see your comments in the discussion [27:11] below. And as well as I want to call [27:14] your attention to the Sketch Your Mind [27:16] community. I'm going to post this video [27:20] of course and a discussion in the [27:22] community as well. So if you're already [27:24] a member of the community, I'd love to [27:27] hear your voice and discussion in this. [27:30] And if you're not a member of the Sketch [27:32] Your Mind community, then check the link [27:35] in the video description and join the [27:38] community. [27:40] I hope you found this discussion [27:44] interesting, eyeopening [27:46] and I think we need to take action. Let [27:50] me know what you think and see you in [27:53] the next  📄 **Full text:** ![[Full Document Contents/Articles/Excalidraw Plugin Developer The Future of Obsidian Plugins.md|Excalidraw Plugin Developer: The Future of Obsidian Plugins by YouTube]] ## Highlights - going to be towards closed plugins. Now I don't plan to do that. I believe in open sharing. I believe in collaboration. And I believe in giving everyone an opportunity to learn and to develop. But I see this risk as a real huge risk. And I think there is this issue about freedom versus control. ([View Highlight](https://read.readwise.io/read/01krzzwxn4zd1bjmf9fbq0mws0)) - Tags: 👻 ai highlighted - I ask them to send me their list of plugins, and I've seen lists of close to 100 plugins. That's not going to work. A, I don't believe that you can effectively use 100 plugins in your workflow. And B, that is super high risk, not because someone wants to fraud you. But let's be honest, these plugins are hobby projects. They are not tested for compatibility with each other. ([View Highlight](https://read.readwise.io/read/01krzzwxpapn4tkw89d871emap)) - Tags: 👻 ai highlighted - really steps up to support plugins. And now mind you, it might turn out that lack of community support means that actually what I feel is important and valuable, in this case, Obsidian Xcolidraw, but of course everyone has their own plugins, it's really not that important. It doesn't add value. It doesn't create anything for the community. And then I think it's the right step to kill those plugins. ([View Highlight](https://read.readwise.io/read/01krzzwxrqdqtn5yp0vj93hya4)) - Tags: 👻 ai highlighted - But I don't think that that's the case. I think in reality, everyone thinks someone else is going to do the support. It's like then, and this is going to be a very ugly example, when someone is raped and everyone in the community is watching and no one steps in because no one is willing to step forward to take responsibility. I think plugin developers are now in this situation because they ([View Highlight](https://read.readwise.io/read/01krzzwxszdtz3zb8p9m0f2wzc)) - Tags: 👻 ai highlighted