Hacker News Reader

Comment by lokedhs | Hacker News Reader

Flatpak is the only practical approach to achieve some degree of isolation on Linux today, unless you are willing to go with Qubes OS.

And yes, I know Flatpak has some way to go before it actually reaches that goal, but I don't see any other solution to this problem that Linux users in general seem to be happy just pretending doesn't exist.

If not Flatpak, do you have an alternative approach to propose to regular users who just want to be able to run a random application without worrying that it has access to all your information?

View on HN

> Flatpak is the only practical approach to achieve some degree of isolation on Linux today, unless you are willing to go with Qubes OS.

Flatpak tries to solve a problem I don't have. I use the packages from the distro (and you trust the distribution, isn't it?), and it provides any software I need.

So I guess it all depends on your requirements.

I trust the distribution, I have to because they are they ones delivering the kernel.

But I absolutely do not trust any of the software I install from the distribution's repositories. The packager doesn't analyse the code for all the software they add to the distribution, so it cannot be trusted.

Personally, I use Qubes OS, but people who's don't still deserve a secure operating system.

If you are not trusting the packages provided by you distribution, you should switch to a different one.

I'm very happy with the packages I get from Debian.

https://www.debian.org/doc/debian-policy/

Add a bit of common sense, and it is enough for me (and I assume for most people, but hey!).

There are no distributions that do security testing of all packages. And even if they did, it wouldn't be a guarantee that all software are actually free of security bugs.

The solution is to simply not trust the software at all. This is the approach Qubes OS takes, and works really well. Most regular users don't really need to go as far as Qubes OS does though, and application level isolation that Flatpak is trying to achieve is enough.

I don't see how anyone can accept that any random piece of software is allowed to access all your personal files is acceptable. We certainly don't accept it on mobile platforms (how many posts do we see here about applications that scrape user's contacts?) so why should we accept it on the desktops?

https://www.flatkill.org/2020/

Isolation that with gaping holes in it isn't isolation. Most flathub apps have "access to all your information" one way or another.

It's a pain to work with too, and it's dependency management result in outdated and handicapped dependencies (like when upstream base images decided to disable vaapi support in gstreamer).

The slapped on app store is feature creep of an extreme degree, and I suspect that's the biggest part of the agenda: side-stepping distro repos.

If you want to make a good sandboxing solution, make it standalone and don't mix distribution into things. Say, AppImage + bubblewrap.

> Most flathub apps have "access to all your information" one way or another.

I went thought some of the Flatpak applications I commonly use, and none of them had access to all my information. I'm not going to go through all of them, but this suggests that the quoted statement isn't true.

I stand by my original statement that Flatpak is the only system that tries to address this. The fact that you're suggesting two separate technologies in combination confirms this, in my opinion.

Examples of popular apps that can write to the host filesystem (and remember kids, the ability to write to $HOME always means full account takeover, followed shortly by root access if your account can sudo):

- vs code (https://github.com/flathub/com.visualstudio.code/blob/91e589...)

- chromium (https://github.com/flathub/org.chromium.Chromium/blob/1edd4a...)

- sublime text (https://github.com/flathub/com.sublimetext.three/blob/d1f617...)

- obs studio (https://github.com/flathub/com.obsproject.Studio/blob/051f6f...)

The applications above also provide other dangerous privileges, but they pale in the presence of filesystem access.

Examples of applications that have full device access (which is considered insecure and called "not ideal" in the flatpak docs), as well as sharing a bunch of namespaces like network and IPC (meaning these parts are not sandboxed):

- discord (https://github.com/flathub/com.discordapp.Discord/blob/maste...)

- steam (https://github.com/flathub/com.valvesoftware.Steam/blob/beta...)

- telegram (https://github.com/flathub/org.telegram.desktop/blob/beta/or...)

- lutris (https://github.com/flathub/net.lutris.Lutris/blob/beta/net.l...)

Of all the applications I sampled (some by popularity, some random I knew), all gave full device access and disabled network/ipc sandboxing. A significant chunk gave filesystem=host access (not even home, host!).

(I am however happy to see that the number of filesystem=home/filesystem=host manifests seem to have dropped.)

> The fact that you're suggesting two separate technologies in combination confirms this, in my opinion.

Whenever independent tasks need to be accomplished, independent solutions is the superior choice. The alternative are monoliths and semi-closed gardens.

> Examples of popular apps that can write to the host filesystem (and remember kids, the ability to write to $HOME always means full account takeover, followed shortly by root access if your account can sudo):

I actually use exactly zero of the applications you mentioned. The ones I looked at was:

Spotify - Only access to music and pictures

Element - Keyring and download. It does get all-devices though which could be a problem

Signal - Gets access to a bunch of directories such as desktop and documents. This is a bit excessive.

Tor browser - No access (I wouldn't expect anything less)

Climaxima - No access, but I wrote that application so perhaps that's a bit unfair

Those as the applications I most commonly use. However, now that I look through the list of applications I have installed, I see some that I'm really disappointed are requesting full filesystem access, including GIMP and Kdelive.

> Whenever independent tasks need to be accomplished, independent solutions is the superior choice. The alternative are monoliths and semi-closed gardens.

I don't disagree with this. It's most definitely possible that your proposed approach is better, but as of right now, no one is making that easy (i.e. you need to know what you're doing to benefit from the security benefits).

Reply on news.ycombinator.com