Hacker News Reader

Comment by 1_player | Hacker News Reader

The flatpak hate gang strikes again. Seriously, more bugs than Wine? For the first time we have a cross-distro packaging system, and I still hear people complaining that the olden days were better. Are you kidding me?

Honestly, I don't even care to entertain this discussion, as for the FIRST TIME in Linux history there is people packaging an application and it works exactly the same everywhere, and some can only meet this achievement by unpaid volunteers with _snark_ because it's not "perfect".

It's tiring to see any effort to make the Linux desktop a reality met with unconstructive opposition from daily Linux desktop users.

/rant

View on HN

no-one here said the olden days were better. it is possible for something to be generally in the right direction, but still in great need of improvements. dismissing anything not as positive as you'd like as unconstructive is itself unconstructive.

Ah, because saying that flatpak has more issues than Wine _is_ constructive. It is not even close to being true. Yes, I flew off the handle a bit there, but I'm quite done with the useless snark from some commenters, especially since it's pretty common on this forum regarding certain technologies, and in my eyes, completely unwarranted.

Nowhere in my comment I said Flatpak is perfect and doesn't need more work to be really good, and I certainly didn't resort to hyperbole to discredit the work of other people, that's for sure.

I should probably take a walk and not angrily comment on the Internet, I agree...

I think you're looking for this behaviour? Try using * instead of _ and that's what you'll get. Use two for bold, if you want.

Thanks, I didn't know that. But using underscores as emphasis is very common on plain text communications (Linus Torvalds uses them often)

Flatpak is only exciting Redhat who wants to easily provide up to date software on a very old stable base and to be the Google of linux software distribution and to prospective developers who don't at present already have a method of getting debs and rpms to end users easily. This is a small group.

For end users its meant slower startup, apps that ignore user themes, concern that a rogue developer will poison the well with outright malware, concern that a legit developer will get hacked and instantly disseminate malware to all users with their flatpak installed, flatpak only bugs, permissions issues, and additional complexity in managing software.

For developers who already have their software widely available via traditional packaging its something else they have to do in addition to traditional packaging not an alternative because its not universal. In fact last year only a single digit percentage said they used it.

If your prospective users aren't excited about your product perhaps one needs to reconsider if its the users fault for not being excited.

I am excited about flatpak for multiple reasons, which boils down to sandboxing:

1. Proprietary software: most proprietary software authors do not play well with packagers. Moreover, I want any proprietary software properly sandboxed

2. Software that you need sandboxed for various reasons: I've been running flatpak nightlies of stuff I otherwise have installed on my system

3. Installing a program without installing a whole bunch of dependencies, hard to clean up after

4. Cleaning up my home directory

Sandboxing (I know most flathub packages have leaky sandboxes, but that's a start) limits the effect of compromising one flatpak. To be clear: I treat any piece of proprietary software as a possible RCE by the author.

User themes issues are probably fixable.

Slower startup as well, to an extent.

Unfortunately, developers are pretty bad at packaging generally, and don't have distro maintainers watching over their CVEs and upgrading dependencies with the flatpak model... Although users could still dig in and fix these by themselves, and sandboxing still gives a few protections.

The protection offered by sandboxing is like using a garbage bag as a bulletproof vest.

You will have to elaborate instead of throwing easy accusations like these. Linux namespaces are pretty tight, and I make sure that flatpaks that need sandboxing have the right sandboxing mechanisms in place.

In order:

1. Filesystem access is one of the most critical pieces (to me). Flatpaks on flathub often restricts this by default, except for a few packages. Portal mechanisms offer on-demand access to external files and folders.

2. X11 access: I use wayland, and make sure the program I'm launching does too. There is a X11-fallback scheme that blocks access to X11 if wayland is being used.

3. Network access: I usually leave it enabled when needed, there is not much to exfiltrate if filesystem isn't accessible, and that's the main threat I'm concerned about.

I am not very concerned with Pulseaudio, pipewire socket or access to select D-Bus paths.

Sure, it is not an air-gapped computer, nor a virtual machine. The attack surface is bigger, but not that much.

I'm going to go ahead and presume that anyone intending to release a malicious app or compromised update to a non-malicious application has access to a similarly configured system.

They are thereby incentivized to attack via a method that is successful on their test systems. In particular applications set their own initial permissions (can they also update themselves and acquire greater permissions without user input?) and often contain old outdated and potentially insecure known insecure versions of software already patched or updated in distro repos.

If you put up $1000 and offered to install any malicious app on a current fedora gnome default install VM and see if someone could pwn it your money would be gone in a few hours. You could do this once a month between now and 2025 and I would be surprised if you were ever able to retain your money.

Reply on news.ycombinator.com