10 ms·

> The FAQ page states "We are explicitly using many features of the linux kernel (bind mounts, namespaces, seccomp, etc) to create the sandbox that Flatpak apps

> The FAQ page states "We are explicitly using many features of the linux kernel (bind mounts, namespaces, seccomp, etc) to create the sandbox that Flatpak apps are running in." ... and then it turns out that they aren't, or at least they aren't enforcing it They are using those features. flatpak has network namespaces for applications that don't need access to the network and bindmounts for applications that use very limited parts of the filesystem. Sure, in reality many desktop apps have more far-reaching permissions, but all they're saying is that flatpak can make use of those features in some cases. > This is flat out lying to try and get mindshare Usually that's just called marketing. I don't think any of the above statements are actually lies in any way though. Can you point to what's actually a lie, or what lie is implied in your mind?

jessaustin 8y ago
The part where they say it's a sandbox, and it doesn't even attempt to be a sandbox. That's a lie.
- viraptor 8y ago
  The system is configured to run apps in a sandbox though - that's completely true. It's the app's part that declares: it needs full access to your home directory to work. If that wasn't possible, we'd get people complaining about apps not working as expected instead. The balance may not be currently on the right side, but they don't lie about what's provided. It's like standard Linux permissions. If you install an app which creates its directories with mode 0777, or install a package which has a suid binary, you don't complain that Linux offers no file access control. That's the author's or packager's fault.
  - yzmtf2008 8y ago
    “Sandbox” and “full access to your home directory” doesn’t compute. That’s literally one of the biggest reasons to sandbox applications.
    - untog 8y ago
      It's true, but I'm not sure how e.g. VS Code would even work on a truly sandboxes environment. There'd be no file browser.
      - yzmtf2008 8y ago
        macOS does this via the open dialog — opening a directory gives an application full access to that directory
        m45t3r 8y ago
        And you can have the same issue the author said in the article by requesting access to home directory and running the exactly the same command as the author wrote.
        int_19h 8y ago
        You'd need to open your entire home dir for that. In VSCode, you normally open the specific directory that contains the source for one particular project you're working on, so in that model, it would only be granted permission to that directory.
      - voltagex_ 8y ago
        Virtualised paths with specific access - i.e. VS Code would only see one path.
      - pcwalton 8y ago
        Same way it works on the web: Use a broker process that grants access via a file select dialog.
        vetinari 8y ago
        The point is, that for vscode picking a file is not enough. It would cause lot of fun opening multi-root workspaces you just checked out... There are many more applications, not just IDEs, where picking a file or folder is not sufficient: for example, apps like Rapid Photo Downloader or Darktable would be significantly crippled.
- derefr 8y ago
  It's a sandbox like Android has a sandbox: each app lists a set of capabilities; the user gets a dialogue on installation where they have to grant those capabilities (or else cancel the install); and then for anything the app tries to do that's not in that set of capabilities, it fails. A sandbox doesn't mean "you can never do [foo]." A sandbox means "you can never doo [foo] unless the user lets you." Even web browsers (the classical "true sandboxes") have an API that gets you access to the user's microphone, and another for access to their GPS data. There's just a dialogue in between that the user can say "No" to; and, having said no, the content of the tab can't ask again, and just gets denied automatically. That's what makes it a sandbox.
  - jonstewart 8y ago
    Is it also like Android's "sandbox" in that every application asks for every permission and the only choice is between "no security" and "can't install anything useful" and inures the user to just click "accept" on everything?
    - Ndymium 8y ago
      Android's permission system was overhauled in version 6 so that permissions are now generally asked when they are needed, for a specific type of operation, instead of the big dialog when installing. I personally use several apps where I have granted one set of permissions and denied another (because it was for a feature I don't use). It has gotten a lot better than what it used to be.
    - MayeulC 8y ago
      For now, the GUIs are as far as I know, but there is a `flatpak override` command that seems promising for changing an installed application's permissions.
- TheDong 8y ago
  "sandbox" is an ill defined term, but what flatpak provides fits it perfectly well. A sandbox is an environment where capabilities can be restricted in a set of ways. The javascript sandbox lets you manipulate the website and make network requests, but not access arbitrary files. The flatpak sandbox is configured per-app and can prevent all fs access, all file io (with seccomp), all networking, etc. The article is simply pointing out that most popular applications do not use the sandbox features well. That doesn't mean flatpak does not have the sandbox they claim to, merely that it does not mesh well with many popular apps currently. I still see nothing that merits the word "lie".

jessaustin 8y ago

The part where they say it's a sandbox, and it doesn't even attempt to be a sandbox. That's a lie.

viraptor 8y ago
The system is configured to run apps in a sandbox though - that's completely true. It's the app's part that declares: it needs full access to your home directory to work. If that wasn't possible, we'd get people complaining about apps not working as expected instead. The balance may not be currently on the right side, but they don't lie about what's provided. It's like standard Linux permissions. If you install an app which creates its directories with mode 0777, or install a package which has a suid binary, you don't complain that Linux offers no file access control. That's the author's or packager's fault.
- yzmtf2008 8y ago
  “Sandbox” and “full access to your home directory” doesn’t compute. That’s literally one of the biggest reasons to sandbox applications.
  - untog 8y ago
    It's true, but I'm not sure how e.g. VS Code would even work on a truly sandboxes environment. There'd be no file browser.
    - yzmtf2008 8y ago
      macOS does this via the open dialog — opening a directory gives an application full access to that directory
      - m45t3r 8y ago
        And you can have the same issue the author said in the article by requesting access to home directory and running the exactly the same command as the author wrote.
        int_19h 8y ago
        You'd need to open your entire home dir for that. In VSCode, you normally open the specific directory that contains the source for one particular project you're working on, so in that model, it would only be granted permission to that directory.
    - voltagex_ 8y ago
      Virtualised paths with specific access - i.e. VS Code would only see one path.
    - pcwalton 8y ago
      Same way it works on the web: Use a broker process that grants access via a file select dialog.
      - vetinari 8y ago
        The point is, that for vscode picking a file is not enough. It would cause lot of fun opening multi-root workspaces you just checked out... There are many more applications, not just IDEs, where picking a file or folder is not sufficient: for example, apps like Rapid Photo Downloader or Darktable would be significantly crippled.
derefr 8y ago
It's a sandbox like Android has a sandbox: each app lists a set of capabilities; the user gets a dialogue on installation where they have to grant those capabilities (or else cancel the install); and then for anything the app tries to do that's not in that set of capabilities, it fails. A sandbox doesn't mean "you can never do [foo]." A sandbox means "you can never doo [foo] unless the user lets you." Even web browsers (the classical "true sandboxes") have an API that gets you access to the user's microphone, and another for access to their GPS data. There's just a dialogue in between that the user can say "No" to; and, having said no, the content of the tab can't ask again, and just gets denied automatically. That's what makes it a sandbox.
- jonstewart 8y ago
  Is it also like Android's "sandbox" in that every application asks for every permission and the only choice is between "no security" and "can't install anything useful" and inures the user to just click "accept" on everything?
  - Ndymium 8y ago
    Android's permission system was overhauled in version 6 so that permissions are now generally asked when they are needed, for a specific type of operation, instead of the big dialog when installing. I personally use several apps where I have granted one set of permissions and denied another (because it was for a feature I don't use). It has gotten a lot better than what it used to be.
  - MayeulC 8y ago
    For now, the GUIs are as far as I know, but there is a `flatpak override` command that seems promising for changing an installed application's permissions.
TheDong 8y ago
"sandbox" is an ill defined term, but what flatpak provides fits it perfectly well. A sandbox is an environment where capabilities can be restricted in a set of ways. The javascript sandbox lets you manipulate the website and make network requests, but not access arbitrary files. The flatpak sandbox is configured per-app and can prevent all fs access, all file io (with seccomp), all networking, etc. The article is simply pointing out that most popular applications do not use the sandbox features well. That doesn't mean flatpak does not have the sandbox they claim to, merely that it does not mesh well with many popular apps currently. I still see nothing that merits the word "lie".