Hacker News Reader

There is more to them than sandboxes though. They also package everything, if there is a security problem in a common library you are vulnerable in each sandbox until it is updated so updates become a much larger hole.

Sure the problem cannot escape the sandbox, but in the end i'm more concerned with my data in the sandbox.

View on HN

It’s not necessary to include every library inside the package. Flatpak packages use runtime packages like Gnome, Freedesktop and KDE. Those runtime packages already include libraries like OpenSSL,libpng, libjpeg, gtk, qt and are updated very frequently to fix the bugs in those libraries.

Yeah, but that's because Linux doesn't have a stable ABI, and really everyone does that these days.

Both Mac and Windows just dump a whole bunch of libraries into the install directory.

I think on Flatpak you can update the base platform package and have the applications use that automatically, so there's that.

Linux has a stable ABI for user land programs. For drivers the ABI is not stable, but drivers are not sandboxed in linux.

I didn't mean just the kernel, but the userspace libraries as well. So GNU/Linux or whatever you want to call that.

So it's either AppImage/Flatpak/etc or it's building a package per distro.

Reply on news.ycombinator.com