5 ms·

But that doesn't really work for proprietary software. I use Flatpak/Snap for Spotify, IntelliJ, Slack etc. Audited packages are not really an alternative here,

But that doesn't really work for proprietary software. I use Flatpak/Snap for Spotify, IntelliJ, Slack etc. Audited packages are not really an alternative here, and (partially) sandboxed, distro-agnostic containers are the next best thing.

deadbunny 8y ago
Sure it does. I add that companies repo to my sources and install their packages. I'm trusting their keys to install their software. I'm not trusting them to install software they have zero control over.
- TingPing 8y ago
  Flatpak repos are GPG signed, nothing changes.
  - deadbunny 8y ago
    Yes it does. I go from trusting one vendor (with one key) to install one package (and dependencies) to one 3rd party repo (with one key) to install N packages, and the owners of the 3rd part repo don't verify the uploaders to their repo. That's going from trusting 1 person to trusting thousands.
    - TingPing 8y ago
      There is nothing stopping one repo containing one app+runtime.
      - deadbunny 8y ago
        Sure, just like there is nothing stopping them doing the same with apt/yum/etc... the things is that they don't. SO if they stop publishing their native packages and push to a handful of central repos I'm forced into a 1:N trust situation rather than the 1:1 it should be.
        TingPing 8y ago
        But they do? VSCode, Spotify, Chrome, etc are all custom repos just for their software.
        deadbunny 8y ago
        Are they? I can't find the existence of a flatpack repo for any of those apps, all are just in global flathub/snapcraft repos. I'm happy to be wrong but I can't see anything that backs up your claim. Spotify: https://www.spotify.com/uk/download/linux/ https://www.spotify.com/uk/download/linux/ Chrome: https://www.google.com/linuxrepositories/ https://www.google.com/linuxrepositories/ VSCode: https://code.visualstudio.com/download https://code.visualstudio.com/download

5 ms·

But that doesn't really work for proprietary software. I use Flatpak/Snap for Spotify, IntelliJ, Slack etc. Audited packages are not really an alternative here,

by gurkendoktor 8y ago

deadbunny 8y ago
Sure it does. I add that companies repo to my sources and install their packages. I'm trusting their keys to install their software. I'm not trusting them to install software they have zero control over.
- TingPing 8y ago
  Flatpak repos are GPG signed, nothing changes.
  - deadbunny 8y ago
    Yes it does. I go from trusting one vendor (with one key) to install one package (and dependencies) to one 3rd party repo (with one key) to install N packages, and the owners of the 3rd part repo don't verify the uploaders to their repo. That's going from trusting 1 person to trusting thousands.
    - TingPing 8y ago
      There is nothing stopping one repo containing one app+runtime.
      - deadbunny 8y ago
        Sure, just like there is nothing stopping them doing the same with apt/yum/etc... the things is that they don't. SO if they stop publishing their native packages and push to a handful of central repos I'm forced into a 1:N trust situation rather than the 1:1 it should be.
        TingPing 8y ago
        But they do? VSCode, Spotify, Chrome, etc are all custom repos just for their software.
        deadbunny 8y ago
        Are they? I can't find the existence of a flatpack repo for any of those apps, all are just in global flathub/snapcraft repos. I'm happy to be wrong but I can't see anything that backs up your claim. Spotify: https://www.spotify.com/uk/download/linux/ https://www.spotify.com/uk/download/linux/ Chrome: https://www.google.com/linuxrepositories/ https://www.google.com/linuxrepositories/ VSCode: https://code.visualstudio.com/download https://code.visualstudio.com/download