I think the ideal situation would be that only "recommended" plugins were visible by default, with a checkbox that allows viewing the rest but labelled advising the users that they haven't been checked for quality and may not get future maintenance.
I think the maintenance part of this is as important to consider as e.g security. Whilst we want the plugins to be secure, you'd also not want the plugin ecosystem to rot overtime, where people might refuse to upgrade Joplin because an essential plugin for their workflow doesn't work with newer releases. Or where a plugin might begin to actively interfere with the core app and might not be ever updated; harming the opinion of the core app when people attribute blame to the core app and not the plugin.
But this is coming from the perspective of someone who absolutely tries minimise how many programs/tools/plugins I install regardless of what they relate to, not opinions about Joplin itself specifically since I don't use Joplin plugins anyway.
Asking plugin authors to promise a best effort going forward as a requirement to becoming recommended is probably as important as the security review side of things.
1 Like
