What's new in Joplin 3.0

humz · 2024-07-03T21:45:28.957Z

Thanks! The trash and columns are awesome features.

chairmanbrando · 2024-07-03T23:36:58.136Z

Note list columns is pretty neat. With notebook title being an option, it looks like we're "just" one step away from the notes list being recursive and showing all the notes under a given notebook -- including those slotted away in nested notebooks.

joochlee · 2024-07-04T04:58:36.221Z

awesome!, great works!

I have one more question though.
Is "cursor jumping to the top of note" issue fixed?
It seems that it was fixed according to the version history, but someone said it was not fixed yet.
What is correct current situation ?

ibyprivat · 2024-07-04T12:08:03.554Z

thx for the great work. The trash folder is an essential and great addition.

Unfortunately, the manual download of attachments no longer works in Sync. If you set it to "automatic", it works again.

isdnfan · 2024-07-05T21:46:29.284Z

laurent:

if you self-host it can be assumed that nobody knows your server URL

I'm sorry this is not true. Every website using TLS certificate from public CA (e.g. letsencrypt) must be listed in a certificate transparency log so server fqdn is not a secret but publicly known - try yourself crt.sh | discourse.joplinapp.org. and even if it would remain private "security by obscurity" doesn't work and MFA is a must for every internet facing service.. even better is support for SSO (openidconnect is welcome as requested here

t0dd · 2024-07-05T22:06:03.162Z

isdnfan:

I'm sorry this is not true. Every website using TLS certificate from public CA (e.g. letsencrypt) must be listed in a certificate transparency log

You are correct. If you use a public CA. But, if you are self hosting, I would not recommend using a public CA. Mind you, being your own CA is a bit daunting to a lot of casual folks, but that's how you are supposed to run private networks.

Jaimie · 2024-07-05T22:35:34.272Z

Hi. I love Joplin, I am a heavy user and I have been using it for many years. I currently use Joplin server in a Docker container on Unraid, with a reverse proxy running from Pfsense and use the Joplin Android app on my Samsung Galaxy S23 Ultra and also the Joplin Win app on a few Win 11 desktops / laptops. Since the upgrade to version 3 a few days ago, the android version has become so slow it is unusable. Can you please help? What shall I do to fix this? Shall I wait for the next update of the Joplin Android app on the playstore? Thanks

personalizedrefriger · 2024-07-05T23:09:23.718Z

Jaimie:

the android version has become so slow it is unusable.

Are there a large number of nested notebooks on the Android device? If so, this might be related to Upgrading from last version 2.x Joplin to latest 3.x facing folder expanding slowness issue. · Issue #10674 · laurent22/joplin · GitHub, which might be fixed in the near future by this commit.

Jaimie · 2024-07-06T03:09:12.750Z

Thanks heaps. Yes, I have a lot of nested notebooks. I will be keeping a close eye on this commit

laurent · 2024-07-06T09:50:19.758Z

The threat model is different between a small private instance, where you only have one or two users, and a large public one with many users. The ROI for hackers is very different - we need MFA for Joplin Cloud but it's not as essential for Joplin Server, because it's only for personal use.

You can also put your private instance behind a VPN which many users who self-host do. Personally I don't self-host anything anymore because it's too much work to secure everything properly, but if I did I would definitely put everything behind a VPN.

personalizedrefriger · 2024-07-06T17:24:25.446Z

Joplin Server should support LDAP authentication. From a brief web search, some services (e.g. CISCO DUO) claim to support enabling MFA for apps that support LDAP authentication. Maybe it's possible to enable Joplin Server MFA with this?

laurent · 2024-07-06T17:48:35.002Z

Not sure that would work actually because there's no UI to input the MFA code. So even if the LDAP implementation supports MFA it won't be possible to pass it the code.

Or maybe with some trick, like appending the code to the password for example, provided the LDAP implementation can be scripted to handle this.

isdnfan · 2024-07-06T21:28:24.139Z

I'm fully agree the threat model is different for small vs huge system.but it is different from the "service" point of view..

laurent:

we need MFA for Joplin Cloud but it's not as essential for Joplin Server, because it's only for personal use.

this is not true because attacks on centralized application with a goal to access the data of all users will focus on on generic issues rather single accounts (e.g. brute force attack).. such attacks are more frequent on centralized services and less common on small instances.

MFA doesn't protect against application issues it only protects against attacks on a single account credentials e.g. "password spraying" or "credential stuffing" and this protection is completely unrelated where you account is hosted at home or on a big cloud instance.

laurent:

You can also put your private instance behind a VPN which many users who self-host do. Personally I don't self-host anything anymore because it's too much work to secure everything properly, but if I did I would definitely put everything behind a VPN.

it works for for some degree.. for Joplin server it might work somewhat but this approach fails for Nextcloud and other services where you want to share data outside of your bubble.. VPN adds more complexity and many operational issues.. it works if you live in good old 20th century but fails in a today always connected world..

I'm self-hosting JoplinServer, Nextcloud, Jellifin, Keycloak, Zitadel and other services because I can.. likely it would cost less effort and maybe less money to use hosted service but I don't like vendor lock-in.. nobody knows how long you are committed to provide your cloud service..despite the fact nobody offers all this services.. and managing multiple hosting providers is complex as well..

There are marketing reasons to limit features like MFA to a paid cloud instance but this reasons are not security or requirements.. the only legitimization for such cut on a OSS application is the desire to sell "premium" features of the hosted service..If this is the reason I can live with it and somewhat understand it.. but please speak clear language - if you are behind the money OK bad for the users but good for the community. If you are a good open source guy - tell us what you need to add this high value feature to self-hosted Joplin Server.

PS:

personalizedrefriger:

oplin Server should support LDAP authentication.

LDAP is is related to SSO but it doesn't address MFA (not part of the protocol) neither it protects against before mentioned attacks.. it makes some things easier but still doesn't provide modern account protection..

laurent · 2024-07-06T22:04:11.945Z

Supporting MFA, or any feature, on Joplin Server means additional work to document, maintain and provide support for the feature. It's not something free as you seem to be saying.

Well it would be free for you, because someone else would be doing all the work.

ragekage · 2024-07-07T03:17:44.099Z

Completely agree here -- if MFA support is added to joplin-server i will enable it IMMEDIATELY

i don't put anything i wouldn't be fine with the world seeing (or me losing) in Joplin because it's one admin page login away from disaster... (actually, i should check to see if the login page has anything about ratelimiting etc)

i didn't configure a mailserver so at least i can control the password complexity of all users...

ragekage · 2024-07-07T03:21:58.946Z

this is understandable of course, always a trade-off. just disagreeing as i said above that it is not a useful/meaningful feature. obviously up to you if it's not possible for the reasons you said.

ragekage · 2024-07-07T03:29:38.008Z

Also, i was curious -- is there a place you prefer to get donations? i won't do paypal, and i don't know what liberapay is, but in general want to know where you get a better cut etc etc

isdnfan · 2024-07-07T20:24:23.706Z

t0dd:

if you are self hosting, I would not recommend using a public CA.

I do disagree but I'm curious what yre the reasons you would prefer self-signed cert over "official" one. I know security is the same from the technical point of view. but the management of a self-signed cert (CA) is a nightmare and I don't see any advantage of this added operation complexity..

isdnfan · 2024-07-07T20:35:18.970Z

laurent:

Supporting MFA, or any feature, on Joplin Server means additional work to document, maintain and provide support for the feature. It's not something free as you seem to be saying.

As I wrote in my post - maybe not clear enough - I understand (somewhat) if you want to keep your cloud offer superior over the free server. this is not totally wrong as everybody needs some source of income.. but please don't tell people they don't need it, there is no value in this feature especially as this is not true... be transparent - show the price tag for such feature and explain if/how people could fund it.. I'm willing to spend some $ on the feature as well (kudos for @ragekage )

t0dd · 2024-07-07T21:31:20.699Z

isdnfan:

what yre the reasons you would prefer self-signed cert over "official" one.

The same reason any company's IT department operates as their own certificate authority. Or, at least they should. Why do they do this? Because it's more secure.

Now, I use Joplin Cloud. I live with the fact that my data, though encrypted, and traveling over an encrypted network, is more exposed. I make a judgement on how exposed I think I am and what data I can risk. Adding MFA to the process is certainly a better step forward regardless.

Is being your own CA a nightmare? No. But it's not for casual folks to tackle, as I mentioned in my comment. It's not rocket science, but it's also not trivial.

The same holds true for managing ssh login permissions, root access, what IPs even have any ability to connect, etc.

I.e. if you self-host a server that hosts data, either the data needs to be non-sensitive or you need to be serious about securing and maintaining that server properly. Or both.

I know how to properly lock down a server, but I still use Joplin Cloud and make appropriate compromises. I'm glad MFA was added.