4 ms·

Does anyone know how it stack against AppImage? I know some applications(i.e. Krita) is already using AppImage.

mixedCase 10y ago
It seems easier to use AppImage applications (as Flatpak requires its binary to be installed and works like a sort of package manager) and it looks easier to create FlatPak apps (create file, point to specific runtime dependencies, create package) than to create AppImage apps (https://github.com/probonopd/AppImageKit/wiki/Creating-AppImages https://github.com/probonopd/AppImageKit/wiki/Creating-AppIm...). This inclines me towards AppImage, as the whole point is to have the easiest experience for the user.
digi_owl 10y ago
appimage seems to be less elaborate in the security department, but appimage do not require anything preinstalled on a distro to function.
- mixedCase 10y ago
  As far as security goes, couldn't this be solved by a separate tool, in the good ol' Unix style? And it would be up to downstream to handle AppImage files with it for sandboxing, or not.
  - digi_owl 10y ago
    Now i wonder if the likes of Firejail works with Appimage. As in yes, i see nothing that prevents you from applying existing sandboxing techniques around Appimage distributed software.
    - probonopd 10y ago
      bubblewrap works for sandboxing AppImages: https://github.com/probonopd/AppImageKit/issues/152 https://github.com/probonopd/AppImageKit/issues/152
  - mtgx 10y ago
    The whole point of flatpak is to standardize better security cross-platforms. Allowing "some other tool" to do that for you, just means most apps and most users will not take advantage of that security.
    - mixedCase 10y ago
      Why do we need to standardize sandboxing if that means having to install an application to install applications that are supposed to not need external dependency handling? If Flatpak's main selling point is security, then it would be better served as as a sandboxing tool for AppImage rather than falling for NIH syndroming as is unfortunately too common in Red Hat's world.
      - digi_owl 10y ago
        Because as the old name indicated, xdg-app is/was a Freedesktop project (though much of the docs are at Gnome, making one ponder porous project boundaries). And Freedesktop is all about defining that one canonical (heh) distro (making "free" something of a misnomer at best). Observe flatpak becoming part of Fedora shortly, and then Poettering style "nudging" implemented to get Debian and the rest to adopt it.
        EmanueleAina 10y ago
        No need to nudge, `xdg-app` for Debian has already been in the works for quite some time[1]. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813308 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813308
      - probonopd 10y ago
        Actually the sandbox used for Flatpak can also be used to run AppImages already now: https://github.com/probonopd/AppImageKit/issues/152 https://github.com/probonopd/AppImageKit/issues/152
mtgx 10y ago
AppImage seems to not be very focused on security and has no sandboxing: https://www.reddit.com/r/linux/comments/4l20yt/ive_been_playing_around_with_flatpak_a_little_and/d3jqpya https://www.reddit.com/r/linux/comments/4l20yt/ive_been_play...

It seems easier to use AppImage applications (as Flatpak requires its binary to be installed and works like a sort of package manager) and it looks easier to create FlatPak apps (create file, point to specific runtime dependencies, create package) than to create AppImage apps (https://github.com/probonopd/AppImageKit/wiki/Creating-AppImages https://github.com/probonopd/AppImageKit/wiki/Creating-AppIm...). This inclines me towards AppImage, as the whole point is to have the easiest experience for the user.

digi_owl 10y ago

appimage seems to be less elaborate in the security department, but appimage do not require anything preinstalled on a distro to function.

mixedCase 10y ago
As far as security goes, couldn't this be solved by a separate tool, in the good ol' Unix style? And it would be up to downstream to handle AppImage files with it for sandboxing, or not.
- digi_owl 10y ago
  Now i wonder if the likes of Firejail works with Appimage. As in yes, i see nothing that prevents you from applying existing sandboxing techniques around Appimage distributed software.
  - probonopd 10y ago
    bubblewrap works for sandboxing AppImages: https://github.com/probonopd/AppImageKit/issues/152 https://github.com/probonopd/AppImageKit/issues/152
- mtgx 10y ago
  The whole point of flatpak is to standardize better security cross-platforms. Allowing "some other tool" to do that for you, just means most apps and most users will not take advantage of that security.
  - mixedCase 10y ago
    Why do we need to standardize sandboxing if that means having to install an application to install applications that are supposed to not need external dependency handling? If Flatpak's main selling point is security, then it would be better served as as a sandboxing tool for AppImage rather than falling for NIH syndroming as is unfortunately too common in Red Hat's world.
    - digi_owl 10y ago
      Because as the old name indicated, xdg-app is/was a Freedesktop project (though much of the docs are at Gnome, making one ponder porous project boundaries). And Freedesktop is all about defining that one canonical (heh) distro (making "free" something of a misnomer at best). Observe flatpak becoming part of Fedora shortly, and then Poettering style "nudging" implemented to get Debian and the rest to adopt it.
      - EmanueleAina 10y ago
        No need to nudge, `xdg-app` for Debian has already been in the works for quite some time[1]. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813308 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=813308
    - probonopd 10y ago
      Actually the sandbox used for Flatpak can also be used to run AppImages already now: https://github.com/probonopd/AppImageKit/issues/152 https://github.com/probonopd/AppImageKit/issues/152

mtgx 10y ago

AppImage seems to not be very focused on security and has no sandboxing: https://www.reddit.com/r/linux/comments/4l20yt/ive_been_playing_around_with_flatpak_a_little_and/d3jqpya https://www.reddit.com/r/linux/comments/4l20yt/ive_been_play...