Comment by alpaca128 | Hacker News Reader

Comment by alpaca128 | Hacker News Reader

Parent Full thread

From my perspective as a Flatpak user I can say I hate how the current file access restrictions are implemented, it's confusing and annoying.

I use a messenger installed via Flatpak. So whenever I receive a file in it I cannot save it anywhere outside my Downloads folder. So every single time I then have to open a file manager and manually move the file somewhere else. Similar for the other way around - I have to copy any file I want to send into either ~/Downloads or ~/Pictures. Not a single other path is visible or accessible, if I click on "Desktop" in the list of favorites nothing happens. This is confusing and annoying for me, this would be super confusing for a user who doesn't know and care about file permissions.

I like flatpak as it can nicely fill gaps in official repositories whitout being bound to a single distro family once again. But honestly I understand why apps would just go "allow all", because anything else drives the user insane the way it is implemented now.

You can use flatseal[0] to allow apps access to extra folders in the filesystem. It's a GUI app that makes it much easier than learning how to do the same thing from the command line.

[0]: https://flathub.org/apps/details/com.github.tchx84.Flatseal

Took me a while to figure out that Signal can't save outside of Downloads as well, especially since its not the default dir it opens when trying to save an file. There's no feedback of any kind.

I see flatpak more as a distro independent package format than a way to secure my system.

Exactly, the lack of feedback is the worst part of this. The way it's done right now it looks like the file picker is completely broken and riddled with bugs; the user goes in expecting it to behave normally(given that it looks exactly the same) but it won't show files in the home dir, refuses to even show user-created directories etc.

Even a horrible and annoying pop-up dialog saying something like "file access error" would be better, at least it would be easier to google.

More confusing one is that flatpaks can't access mount points inside your home directory even with the correct flatpak permissions set.

Assume that you are running Steam as a flatpak and you want to add an extra drive to store your Steam library on and you have your extra drive already automounted inside your home directory and the correct flatpak permissions set, Steam will not find it anyway.

You have to use a mount point outside of your home directory to get that to work.

If that can make you feel better, it is exactly as annoying for mac os apps on the mac app store. I don't know anyone using Mac professionally (for e.g. design, etc...) who uses AppStore apps because of that

If you need excess permissions, then why use a package format that promises sandboxing?

This way of dealing with file-access is also not secure: if all your files eventually end up in a Downloads folder which is readable by all Flatpak apps, then what advantage does this have over sharing your entire home folder?

Reply on news.ycombinator.com