Future of this project, project maintenance & scaling to a broader plugin ecosystem

[fearoffish]

There haven't been any commits of significance in at least 3 months. Is this just a project that now exists so you can put it in marketing?

I'm seriously disappointed in myself, maybe that's my frustration. I've convinced companies and individuals to use 1Password and shell-plugins was one of the selling points. Now I have egg on my face, because I've had to tell many of them they have to fork the repository themselves and do any changes they need.

[SimonBarendse]

Apologies @fearoffish. You're right, we haven't been able to give this project the attention it deserves recently. We're starting some internal discussions on best path forward.

[sterlinm]

Thanks @SimonBarendse, that's good to hear! I've had a PR that's been limping along for a while (it hasn't been a huge priority for me either) and I'd love to know whether I should just throw in the towel. Thanks!

#511

[NeckBeardPrince]

Two months later and still nothing.

[SimonBarendse]

Hi folks, want to let you know that this is still on our radar. We're currently exploring to support plugins without them needing to be merged into this repo so that we're no longer blocking new plugins as a gatekeeper and the plugin ecosystem can further scale.

Curious for your feedback on a workflow that would look something like this for a first version:

1. Clone the repo (e.g. https://github.com/sterlinm/1password-plugin-duckdb)
2. Thoroughly review the code - since 1Password team isn't reviewing each plugin
3. Build the code and move to plugin directory (~/.op/plugins/local)
4. Plugin is now detected by and can be used with 1Password CLI

[SimonBarendse]

Thoroughly review the code - since 1Password team isn't reviewing each plugin

Just like with GitHub Actions, Terraform providers and libraries you use other signals will develop that will help determine what plugins you trust, and everyone can make their own evaluation depending on your risk profile (e.g. if a plugin received lots of endorsements and reviews from the community or if that same plugin lives under https://github.com/duckdb).

[NeckBeardPrince]

Can I suggest pinning this issue so it's more visible to the community? Maybe changing the title to something that invites more of a community discussion.

[SimonBarendse]

Thanks for the suggestion @NeckBeardPrince ! Done ✅

[SimonBarendse]

Main two questions I'd love input from the community on:

1. For folks creating new plugins: Would you be open to hosting this under a namespace you own?
2. For folks using plugins: Would you feel comfortable using plugins outside of the 1Password namespace and being responsible for the security review of plugins you use?

[NeckBeardPrince]

Hi folks, want to let you know that this is still on our radar. We're currently exploring to support plugins without them needing to be merged into this repo so that we're no longer blocking new plugins as a gatekeeper and the plugin ecosystem can further scale.

Curious for your feedback on a workflow that would look something like this for a first version:

1. Clone the repo (e.g. https://github.com/sterlinm/1password-plugin-duckdb)
2. Thoroughly review the code - since 1Password team isn't reviewing each plugin
3. Build the code and move to plugin directory (~/.op/plugins/local)
4. Plugin is now detected by and can be used with 1Password CLI

For folks using plugins: Would you feel comfortable using plugins outside of the 1Password namespace and being responsible for the security review of plugins you use?

I would be really, really hesitant to use a 1P plugin from a random user's GitHub; I think others would feel the same way. The backbone of 1Password is trust in the platform to secure our data. I have concerns about using plugins that aren't reviewed or approved by 1Password.

Just like with GitHub Actions, Terraform providers etc. other signals will develop that will help determine what plugins you trust.

Those ecosystems have been around for much longer than 1P shell plugins and aren't as niche as a CLI for a password manager.

[fearoffish]

Main two questions I'd love input from the community on:

1. For folks creating new plugins: Would you be open to hosting this under a namespace you own?

I'd be happy to host a plugin under my own GitHub account...but

2. For folks using plugins: Would you feel comfortable using plugins outside of the 1Password namespace and being responsible for the security review of plugins you use?

...as @NeckBeardPrince said, I'd be very hesitant as a user of that repository. My trust is with 1Password, not random users. I say "hesitant" not "against" because personally I would read it anyway.

If what you're implying is that the 1Password team don't want to manage this anymore and the feature could potentially go away, then I'd be happy with the "clone, review code, put in my local directory and use it" method. As long as we can get rid of the annoying warning.

[arayaryoma]

@SimonBarendse Thank you for asking for feedback from the community.

I'm using 1Password for both family and business accounts.

As others have mentioned, it's quite difficult to fully trust community plugins even those with several stars or contributions on GitHub.
We must exercise caution in deciding which plugins are safe to use.

The existing 1Password plugins are reliable because they have gone through 1Password's official review process.

I strongly agree with @fearoffish:

My trust is with 1Password, not random users.