4 ms·

What do you mean by 'maintained' automatically? Many flatpaks use their own custom compiled dependencies that are outdated. I took a frequently-used dependency

What do you mean by 'maintained' automatically? Many flatpaks use their own custom compiled dependencies that are outdated. I took a frequently-used dependency used to decode untrusted data (ffmpeg). Many Flatpaks on Flathub use outdated ffmpeg versions. Some examples: - VLC ships with a slightly older version of ffmpeg (4.1.3) with two known CVEs: https://github.com/flathub/org.videolan.VLC/blob/f1b27c13b13b95423813c9ff7b159e88c09caf9b/org.videolan.VLC.json#L608 https://github.com/flathub/org.videolan.VLC/blob/f1b27c13b13... - MakeMKV uses an outdated ffmpeg (4.1.0), which has several known CVEs: https://github.com/flathub/com.makemkv.MakeMKV/blob/3c44c8bc999be61157e822fce3db390728d7c52e/com.makemkv.MakeMKV.json#L81 https://github.com/flathub/com.makemkv.MakeMKV/blob/3c44c8bc... - Openshot uses an outdated ffmpeg (4.0.3) which has several known CVEs: https://github.com/flathub/org.openshot.OpenShot/blob/ec2077f6edee6783db2cef783b7939ad0e1a9b4b/org.openshot.OpenShot.yaml#L234 https://github.com/flathub/org.openshot.OpenShot/blob/ec2077... This is what you get when every application ships custom dependencies, rather than having a consistent package set. (I like the idea of Flatpak, but I think it hasn't found its optimum yet in terms of dependency management.)

Jasper_ 7y ago
Blindly updating ffmpeg without the app being tested for it is a recipe for disaster -- ffmpeg has made API breaks in the past, and that meant that when an ffmpeg system update was required, all projects depending on it would need to upgrade to the new API. So often, a distribution would be held back on an old ffmpeg (perhaps patched with some of the CVE fixes by a distro maintainer who might not be familiar with the codebase) to isolate the churn of upstream. flatpak lets app maintainers update at their leisure, which actually gets them on a faster update cycle.
Yuioup 7y ago
Aren't flatpaks sandboxed? Does that help mitigate the risk somewhat?
- danieldk 7y ago
  Theoretically yes (minus you are only one kernel vulnerability away from elevated access). However, a lot of Flatpaks take blanket access to the home directory or host filesystem: https://github.com/search?q=org%3Aflathub+%22--filesystem%3Dhome%22&type=Code https://github.com/search?q=org%3Aflathub+%22--filesystem%3D... https://github.com/search?q=org%3Aflathub+%22--filesystem%3Dhost%22&type=Code https://github.com/search?q=org%3Aflathub+%22--filesystem%3D... So, many applications use it as a distribution mechanism and not so much for sandboxing. Of course, this is bound to get better over time when applications are modified to support sandboxing better and can use portals. IMO you need both: isolation through e.g. sandboxing and timely security updates of applications and all their dependencies. Flatpak currently provides the former for some applications and the latter is completely dependent on the maintainer of the Flatpak.

Jasper_ 7y ago

Blindly updating ffmpeg without the app being tested for it is a recipe for disaster -- ffmpeg has made API breaks in the past, and that meant that when an ffmpeg system update was required, all projects depending on it would need to upgrade to the new API. So often, a distribution would be held back on an old ffmpeg (perhaps patched with some of the CVE fixes by a distro maintainer who might not be familiar with the codebase) to isolate the churn of upstream. flatpak lets app maintainers update at their leisure, which actually gets them on a faster update cycle.

Yuioup 7y ago

Aren't flatpaks sandboxed? Does that help mitigate the risk somewhat?

danieldk 7y ago
Theoretically yes (minus you are only one kernel vulnerability away from elevated access). However, a lot of Flatpaks take blanket access to the home directory or host filesystem: https://github.com/search?q=org%3Aflathub+%22--filesystem%3Dhome%22&type=Code https://github.com/search?q=org%3Aflathub+%22--filesystem%3D... https://github.com/search?q=org%3Aflathub+%22--filesystem%3Dhost%22&type=Code https://github.com/search?q=org%3Aflathub+%22--filesystem%3D... So, many applications use it as a distribution mechanism and not so much for sandboxing. Of course, this is bound to get better over time when applications are modified to support sandboxing better and can use portals. IMO you need both: isolation through e.g. sandboxing and timely security updates of applications and all their dependencies. Flatpak currently provides the former for some applications and the latter is completely dependent on the maintainer of the Flatpak.