Hacker News Reader

Comment by mixedCase | Hacker News Reader

As far as security goes, couldn't this be solved by a separate tool, in the good ol' Unix style?

And it would be up to downstream to handle AppImage files with it for sandboxing, or not.

The whole point of flatpak is to standardize better security cross-platforms. Allowing "some other tool" to do that for you, just means most apps and most users will not take advantage of that security.

Why do we need to standardize sandboxing if that means having to install an application to install applications that are supposed to not need external dependency handling?

If Flatpak's main selling point is security, then it would be better served as as a sandboxing tool for AppImage rather than falling for NIH syndroming as is unfortunately too common in Red Hat's world.

Because as the old name indicated, xdg-app is/was a Freedesktop project (though much of the docs are at Gnome, making one ponder porous project boundaries). And Freedesktop is all about defining that one canonical (heh) distro (making "free" something of a misnomer at best).

Observe flatpak becoming part of Fedora shortly, and then Poettering style "nudging" implemented to get Debian and the rest to adopt it.

No need to nudge, `xdg-app` for Debian has already been in the works for quite some time[1].

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813308

Actually the sandbox used for Flatpak can also be used to run AppImages already now:

https://github.com/probonopd/AppImageKit/issues/152

Now i wonder if the likes of Firejail works with Appimage.

As in yes, i see nothing that prevents you from applying existing sandboxing techniques around Appimage distributed software.

bubblewrap works for sandboxing AppImages:

https://github.com/probonopd/AppImageKit/issues/152

Reply on news.ycombinator.com