Plugin Safety

[Agama]

Are there any safeguards in place for using calibre plugins?

I have seen the warning on adding a plugin which says that a plugin could be malware, and we can choose to trust the developer or not. But many of us do not have enough Python knowledge to check the plugin code for malicious behaviour.

Now I'm not suggesting that any of the plugin developers are rogues, but it would only take one bad apple to cause havoc to an unsuspecting user.

So in terms of safeguards, I wondered if the calibre team do any peer reviews of code submitted for plugins? Is there a list of 'certified' plugins?

[kovidgoyal]

I certainly don't review plugin code. I have my hand full reviewing code submitted for inclusion into calibre as it is

I suggest you stick to plugins you get from the plugins forum here. Look at the thread for the plugin. If it has many comments indicating several users, or is developed by a long term member of this board, then it is likely to be OK.

[user_none]

Plugins that are not distributed as part of calibre are not vetted, tested or guarenteed to work. Hence the warning message when adding 3rd party plugins. If they're not a part of calibre they're 3rd party.

You are as safe with plugins from respected and long term members of this community, like Kiwidude, as you are with plugins that come as part of caibre.

What it really comes down to is the source (not code) of the plugin. Is it some randome site on the internet or a MobileRead member with thousands of posts and tens of thousands of karma points? Ask yourself do I trust giving the plugin and by extension the person who wrote it to run it on my computer?

[Agama]

Thanks for the replies. I have been trying one of Kiwidude's plugins, (currently in beta), as it looks useful and I've seen him posting quite a bit to this forum so I can see that he's got a good reputation. (I didn't know that sites other than MR even had calibre plugins, but it certainly sounds safer to stay away from them).

Do plugins from members ever become part of calibre itself?

[user_none]

Originally Posted by Agama

Do plugins from members ever become part of calibre itself?

Yes. However, it's up to the plugin author if they want to go this route. Some like having their plugins separate. Some use plugins as a beta test before having it included directly in calibre.

[Manichean]

Moderator Notice
Moved out of the development subforum. Please read the sticky before posting there.

[CRussel]

Originally Posted by user_none

Plugins that are not distributed as part of calibre are not vetted, tested or guarenteed to work. Hence the warning message when adding 3rd party plugins. If they're not a part of calibre they're 3rd party.

You are as safe with plugins from respected and long term members of this community, like Kiwidude, as you are with plugins that come as part of caibre.

What it really comes down to is the source (not code) of the plugin. Is it some randome site on the internet or a MobileRead member with thousands of posts and tens of thousands of karma points? Ask yourself do I trust giving the plugin and by extension the person who wrote it to run it on my computer?

While I agree in principle, I think it's also important to realize that at least one significant plugin that is used by thousands of Calibre users is not available on this board. That plug in has stood the test of time for safety, but won't ever be here on MobileRead because of forum policy.