What are you trying to do?
The evaluation features of the plugin default to on, which is right for the user experience, but it does open an avenue for denial of service when opening an untrusted note by causing numbat evaluation to take up significant amounts of compute.
What would you like to happen?
We should harden the runtime bridge so that we provide a default wall-clock/CPU-time timeout for evaluations and show an error in their place. This could be accompanied by moving the WASM to a web worker—platform support allowing—which would give us even more control over the resource usage of the WASM blob.
Controlling resource usage will be more and more important as we build in heavier functionality like plotting, and the later CAS functionality.
What have you tried?
N/A
Is this really about Numbat rather than Symbat?
No — it is about how Obsidian presents Numbat
What are you trying to do?
The evaluation features of the plugin default to on, which is right for the user experience, but it does open an avenue for denial of service when opening an untrusted note by causing numbat evaluation to take up significant amounts of compute.
What would you like to happen?
We should harden the runtime bridge so that we provide a default wall-clock/CPU-time timeout for evaluations and show an error in their place. This could be accompanied by moving the WASM to a web worker—platform support allowing—which would give us even more control over the resource usage of the WASM blob.
Controlling resource usage will be more and more important as we build in heavier functionality like plotting, and the later CAS functionality.
What have you tried?
N/A
Is this really about Numbat rather than Symbat?
No — it is about how Obsidian presents Numbat