Extension Permissions
Extensions in Standard Notes use an offline messaging system to communicate. As of version 2.1, there are two kinds of delivery methods for extensions:
- Local (desktop only)
- Hosted (desktop and web)
When using the desktop app, extensions that support local installation (such as editors, themes, and components) will default to installing and running directly from your computer.
When using the web app, local installation is not available, so extensions resort to using a hosted model. Hosted simply means the extension is downloaded from a remote URL every time you want to use it.
Trust
Extensions such as editors are simply self-contained applications that are displayed within Standard Notes. When a change is made to a note using an editor, the editor communicates back with Standard Notes via the offline "bridge" that changes were made, and Standard Notes takes care of syncing those changes.
Security
The distinction between a local and hosted extension is as follows:
- A local extension is downloaded to your computer and run directly without any intervening server.
- A hosted extension is downloaded from a remote server every time you wish to use it.
Local extensions are by definition more secure, since you don't depend on loading an asset from an external server every time. However, hosted extensions also use the same offline messaging system, and are completely offline after the initial load from the server.
With local extensions, you don't have to worry about whether our extensions server, for example, is compromised.
Permissions
All user-facing extensions require explicit permissions to interact with your data, and can gain no access without your explicit consent.
Any time you set up or use an extension for the first time, you will see a permissions dialogue appear outlining the permissions the extension wishes to make use of. Editors typically only require access to your "working note", which is the note that is currently opened.
To learn more about extensions, visit the extensions directory.
If you have any questions, please don't hesitate to reach out.
