"[GNU/]Linux being secure is a common misconception in the security and privacy realm."

https://madaidans-insecurities.github.io/linux.html

"[GNU/]Linux is thought to be secure primarily because of its source model, popular usage in servers, small userbase and confusion about its security features. This article is intended to debunk these misunderstandings".

Based on this, one should try to do as much as possible on a GrapheneOS device

@privacy

  • wreckage@lemmy.worldEnglish
    4·
    1 year ago

    Even if a flatpak app has full access to host, they can't read the private data of other flatpak apps (~/.var).

      • wreckage@lemmy.worldEnglish
        6·
        1 year ago

        As far as I know, the only possible way to escape the sandbox is to use flatpak-spawn --host and add --talk-name=org.freedesktop.Flatpak but I only ever seen that on apps like vscode.

        Imo, the point of flatpak's sandbox is to give an extra layer of protection in case of security vulnerabilities. Permissions exist so apps can still work as they're supposed to. It's not a virtual machine isolated from the rest of the system where you can or should install malware.

        Besides, the manifest is public and needs to be approved to be on the default repository.