4 ms·

Package managers work well for the large proportion of software on Linux that is open-source, and has enough users to warrant the effort of packaging it separat

Package managers work well for the large proportion of software on Linux that is open-source, and has enough users to warrant the effort of packaging it separately for each distro, and doesn't require you to have the latest version (or specific older version) all the time. However, there is still a large amount of software out there for which the above does not hold. That software is not currently being installed with a package manager - it is the curl | bash scripts you see all the time, as well as a whole bunch of other more manual methods of downloading and installing. It is this software that solutions like flatpack and snap are for, and it is improving both the security and usability in these cases.

v_lisivka 8y ago
It improves usability only. It also creates false perception of security. Malware already found in NPM packages, AUR packages, and other packaging systems without maintainers.
- detaro 8y ago
  Is the sandboxing in Flatpack completely useless then? Any details on this?
  - deadbunny 8y ago
    Not the person you're replying to by you're intentionally being obtuse to try and prove a point he never argued. v_lisivka never mentioned sandboxing as an issue. They were clearly talking about the fact it's a free for all user submitted repo which have a provable history of people adding malware.
    - scrollaway 8y ago
      You're overly aggressive in your reply, GP just asked a legitimate question.
    - detaro 8y ago
      The comparison above was vendor-provided install scripts. From my understanding, Flatpak provides sandboxing and asks the user to confirm exceptions, which if it works reliably does seem like I win something security-wise going from "go to vendor website, use their installation script" to "go to vendor website, get their flatpak thing, know that it can't totally screw my system without me granting it exceptions". Parent claims it's only a usability benefit, so I'd like to know details about the problems with its sandboxing (totally willing to accept that they exist, sandboxing is tricky and not a cure-all)
  - TingPing 8y ago
    It is a work in progress. A few packages are very secure but many have lax permissions for now. There are big improvements coming like PipeWire, DConf sandboxing, etc but it will not happen over night.
  - v_lisivka 8y ago
    It depends. Historically, sandboxing used to protect from takeovers, because computer time and network bandwidth was costly. But today, user information is much more valuable than computer time. Flatpack partially protects from both attacks on system and on user data, but this protection is not perfect. We should expect that Flatpack protection is (or will be) on par with Android anit-malware protection.
- Vinnl 8y ago
  Do you not think Flatpaks (and Snaps) are more secure than curl | bash scripts?
  - lugg 8y ago
    I suspect they provide a far more consistent attack surface for exploitation. One that likely won't change for many months in the case of some proprietary vendors. So no. I don't, but that doesn't make curlbash good either.
lugg 8y ago
> That software is not currently being installed with a package manager - it is the curl | bash scripts you see all the time, On Mac. This is mostly a sovled problem on Linux. Hell even slackware has this mostly solved. I will concede there is a lot of Linux users out there either misinformed or simply don't mind the hassle of upgrading via random curl scripts if at all. Maybe it will help them? Maybe it will just increase the target size making exploitation more worthwhile / likely? Who knows. For me, if it's not in the Arch repos (or aur) I'm incredibly unlikely to install it, to the point I don't actually have any software installed out of band other than stuff I specifically work on.

v_lisivka 8y ago

It improves usability only. It also creates false perception of security. Malware already found in NPM packages, AUR packages, and other packaging systems without maintainers.

detaro 8y ago
Is the sandboxing in Flatpack completely useless then? Any details on this?
- deadbunny 8y ago
  Not the person you're replying to by you're intentionally being obtuse to try and prove a point he never argued. v_lisivka never mentioned sandboxing as an issue. They were clearly talking about the fact it's a free for all user submitted repo which have a provable history of people adding malware.
  - scrollaway 8y ago
    You're overly aggressive in your reply, GP just asked a legitimate question.
  - detaro 8y ago
    The comparison above was vendor-provided install scripts. From my understanding, Flatpak provides sandboxing and asks the user to confirm exceptions, which if it works reliably does seem like I win something security-wise going from "go to vendor website, use their installation script" to "go to vendor website, get their flatpak thing, know that it can't totally screw my system without me granting it exceptions". Parent claims it's only a usability benefit, so I'd like to know details about the problems with its sandboxing (totally willing to accept that they exist, sandboxing is tricky and not a cure-all)
- TingPing 8y ago
  It is a work in progress. A few packages are very secure but many have lax permissions for now. There are big improvements coming like PipeWire, DConf sandboxing, etc but it will not happen over night.
- v_lisivka 8y ago
  It depends. Historically, sandboxing used to protect from takeovers, because computer time and network bandwidth was costly. But today, user information is much more valuable than computer time. Flatpack partially protects from both attacks on system and on user data, but this protection is not perfect. We should expect that Flatpack protection is (or will be) on par with Android anit-malware protection.
Vinnl 8y ago
Do you not think Flatpaks (and Snaps) are more secure than curl | bash scripts?
- lugg 8y ago
  I suspect they provide a far more consistent attack surface for exploitation. One that likely won't change for many months in the case of some proprietary vendors. So no. I don't, but that doesn't make curlbash good either.

lugg 8y ago

> That software is not currently being installed with a package manager - it is the curl | bash scripts you see all the time, On Mac. This is mostly a sovled problem on Linux. Hell even slackware has this mostly solved. I will concede there is a lot of Linux users out there either misinformed or simply don't mind the hassle of upgrading via random curl scripts if at all. Maybe it will help them? Maybe it will just increase the target size making exploitation more worthwhile / likely? Who knows. For me, if it's not in the Arch repos (or aur) I'm incredibly unlikely to install it, to the point I don't actually have any software installed out of band other than stuff I specifically work on.