[Question] Trilim desktop version has constant network activity.

[N3tFX]

I just found out about Trilium Notes. And trying the desktop version, I've noticed that it always have network activity. Every little thing I do in it, I see a network spike in a widget monitoring network activity. Why does the desktop version requires network activity?

By the way is it Trilium with one L or with two?

[dosubot[bot]]

Hi @N3tFX! I'm Dosu and I’m helping the Trilium team.

The constant network activity you see in Trilium Notes desktop is mostly due to its architecture: the app runs a local server and the UI connects to it over your computer’s network interface (localhost/127.0.0.1), which shows up as network usage in monitoring tools. This is common for Electron-based apps and doesn’t mean your data is leaving your machine—Trilium doesn’t send any analytics or telemetry anywhere "Privacy Policy".

Other sources of network activity include periodic checks for new stable releases and automatic downloads of spelling dictionaries based on your language settings "Privacy Policy".

If you use the Web Clipper, it scans a range of ports to find the desktop server, which can cause noticeable spikes. There’s currently no way to disable or configure this scanning behavior, so it may appear as constant activity "Web Clipper Port Scanning".

And yes, the correct spelling is Trilium (with one “L”) "Privacy Policy".

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[eliandoran]

Dosu is spot on here, the desktop version works by spinning up a server. Some of the requests are intercepted, but some are still served over the network.

There should be no other network activity than that, apart from really small stuff such as checking whether there is a new version available.

[N3tFX]

Uh, that explains it. But still, seeing network activity from a desktop note taking app that people want to write sensitive data in it, does not look good for people who value privacy. Most people don't know how things work under the hood, and suddenly seeing this much network activity is scary.

[AlexanderTheGrey]

If your data security requirements are that extreme, you should be using an air-gapped environment and not connect to the internet at all (but I'm sure there is room for improvement in Trilium).

[N3tFX]

I can't believe that we've reached to a point where valuing your privacy is considered extreme. You don't have to leave under a totalitarian regime, fearing for your life, to be mindful of your info. Would you want to leave in a glass house, with literal glass walls, where anyone can see what you do 24/7?

[eliandoran]

Let's not steer off course. Indeed, an air-gapped environment is the maximum amount of safety you could have if your threat model includes any network activity.

Since we've already mentioned what communication Trilium has, the only thing left is either to trust the answer or make your analysis on the network requests that are made.

[N3tFX]

Developers seem to forget that the users of their software are not developers themselves, nor network engineers to know how to check what an application is doing in the background. All they would think is that this application has network activity that other applications don't, therefore assume that it's a keylogger or something, discard the thought of using the app and use something else instead. Not a good thing for Trilium. I just provided the view point of a simple user.

[AlexanderTheGrey]

@N3tFX I agree with your sentiment, but this is FOSS with auditable code. Trilium sends no analytics, only localhost traffic and supports encryption. Many apps use localhost servers, such as Plex, Jellyfin, Open WebUI, etc. If someone is technical enough to monitor network traffic, they should recognize that Trilium runs a local server, not just a desktop app.​ However, you're right that most users can't audit code or verify traffic. The desktop versions of Obsidian and Logseq avoid local servers entirely. Of course, Obsidian is closed source and there is no guarantee of any security/privacy. For non-technical users, constant network activity may cause suspicion, but so does a lot of other innocuous things.

[N3tFX]

Both Obsidian and Logseq (which are Electron based if I am not mistaken) do not show network activity except if the user uses a feature that requires internet access.