• Are you using Flatpaks?
  • Are you trusting Flathub?
  • Do you bother about the sandboxing and security?
  • Kata1yst@kbin.social
    link
    fedilink
    arrow-up
    25
    arrow-down
    1
    ·
    edit-2
    1 year ago

    YES. I don't understand this delusion people keep perpetuating. Flatpak has a MILD form of container sandboxing. For a real security sandbox we have Firejails or Bubble wrap.

    Flatpak is, at it's core, a software development and distribution packaging format. NOT a security implementation.

      • hornedfiend@sopuli.xyz
        link
        fedilink
        arrow-up
        2
        ·
        edit-2
        1 year ago

        I always check my flatpak settings post install before running the app and adjust permissions according to need. I mean it does offer more security to me since it's user installed, I can granularly update permissions and control more or less where and what is can touch.

        Alternatives to this are SELinux,AppArmour and firejails which are slightly more inconvenient to use.

        To me that is mostly secure,or secure enough.

        Well and then there's some immutable distros which might help overall.

        Edit: paragraphs

    • michaelmrose@lemmy.world
      link
      fedilink
      English
      arrow-up
      4
      ·
      1 year ago

      If we admit that then an app store where anyone can create an account and upload software becomes extremely problematic. This is especially true wherein clients autoupgrade very quickly.

      Step one. Legit package a popular app Step two. Wait for substantial uptake Step three. Mix in some ad or malware and watch a tens of thousands get instantly owned.

        • michaelmrose@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          Anyone can't become a packager in 30 seconds in an automated process that they can' t repeat the 47th time they transmit malware.

          • AProfessional@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            The process is identical.

            You show up with a package. It gets a basic review. You are granted commit access to your package. You can push changes.

            There is slightly more oversight in that another mentor often also has commit access but they can’t and don’t review everything.