Comment by ndiddy | Hacker News Reader

Comment by ndiddy | Hacker News Reader

Parent Full thread

I think it depends on what distro you're talking about. Corporate distros like RHEL and SLES are absolutely going that way. It takes a lot of effort to backport fixes, and the money's not there in desktop Linux to make it worth their while if containerization is a viable alternative. Red Hat's gotten rid of a bunch of graphical applications for RHEL 10 and stated that users can get them from Flathub as an alternative. I believe there was some consternation when CentOS Stream 10 launched without even a packaged web browser and the advice was to install Firefox from Flathub (there's a lot of use cases where that breaks stuff), but it appears they've walked that back and started providing Firefox as a traditional package.

However, less corporate distros that mostly just ship built upstream software as-is since they don't have to support it for long periods (think Arch, Fedora, Void, etc) don't have that problem, so I expect we'll continue seeing them use traditional packages.

> I believe there was some consternation when CentOS Stream 10 launched without even a packaged web browser and the advice was to install Firefox from Flathub

Ubuntu does the exact same thing with their snap repository, the Firefox apt package from Ubuntu is fake. At least Flatpak is a community-led project unlike snap.

My advice is to add Mozilla's apt repo for Firefox by following the handy guide on their website. It's pretty short and easy (copy and paste).

My advice for web browsers is to use Flatpak.

You can limit the file system permissions of the app, like giving only access to downloads, so that if/when there’s a sandbox leak you’re fine. You can also disable various things, like webcam or mic, this way.

In addition, you can get perpetual updates to the latest version of your browser even on old, stable distros like Debian.

Running a new browser on an old distro would be a strong reason for me (if I somehow couldn't update the distro - but I can and I do.) Regarding security, the added work and complication outweighs the added security for me. I can't really disagree with having a different preference. More security on this wild internet is better, right?

IMO it's not much added work. In KDE you can navigate to settings and edit flatpak permissions, and flatpaks are available to download via discover. I haven't noticed any weirdness for firefox or chrome.

Reply on news.ycombinator.com