Thread by @roamhacker

This requires a few tweets to answer. I do trust cloud services. You can use @Tresorit which is zero trust e2e encryption. @obsdmd also has a service called “Obsidian Sync” which allows for cloud based zero trust (you provide your own encryption key).

https://twitter.com/cortexfutura/status/1397135062047629312

Of course using any program on a local computer requires a level of trust with the vendor. This is true just using Windows, or Mac OS. So I trust @obsdmd, especially on the foundation of their openness and approachability.

Plugins are not necessary to use. But I do use a few. Of course as a JS dev, I can audit the code myself, but not everyone can do that. however the obsidian model currently is “safer” (not guaranteed safe). Why do I say that?

All plugins served by Obsidian are hosted as open-source projects on GitHub. All plugins go through a formal code review. Plugins are reviewed and monitored by the community. So while no guarantee, there is a strong vetting process in place.

It comes down to “who and why do you trust someone? How have they established trust with you?”

Also: how do they respond to reported security vulnerabilities?

It is ok to make mistakes, its not ok to not admit to your mistakes. This is the fundamental building block for trust.