8 ms·

Well, as every direct reply said, it is true that these App Store models suffer from possibly outdated libraries with unpatched security bugs. But it's nothing

Well, as every direct reply said, it is true that these App Store models suffer from possibly outdated libraries with unpatched security bugs. But it's nothing new. Everybody knows that. It's case with Docker and all other fat bundle formats. > Sadly, it's obvious Red Hat developers working on flatpak do not care about security Presenting it as a novel privilege escalation with such wording IMO deserves hasty dismissal. These kinds of "hype-ridden disclosures" (i.e. allocating domain name) deserve to be ridiculed because they're meaningless distractions. See [1] for discussion. [1] https://lwn.net/Articles/668695/ https://lwn.net/Articles/668695/

pie_flavor 6y ago
All the other formats talk about how easy they are to use, and when you mention security, they throw up their hands and say "I dunno". Flatpak, on the other hand, its entire shtick is how applications are sandboxed for security.
- inshadows 6y ago
  And flatpak is actually sandboxed for security. So what's your point? The only news the author of this hype website told us is that 1) there was a vulnerability, 2) lots of application have broad privileges and 3) apps have bundled dependencies. -- 1) Bugs happen. Deal with it. 2) Flatpak actually tells you which privileges an app is going to use. What do you suggest as a solution? Is it technical problem or social problem? What is the state of art? I'd say the state of Art is Android in that it asks for permissions individually as they're required. Still, this problem is not fundamental issue in Flatpak. It certainly doesn't deserve "Flatkill" logo and domain. 3) Is Flatpak actually an exception to the rule? - Making Python app? Use pyenv, pipenv, venv or ${popular_venv_of_the_year} and bundle all your dependencies! - Making .NET app? Use NuGet and bundle all your DLLs! - Making Java app? Use Maven, Gradle, SBT and bundle all your JARs! - Making Rust app? Use Cargo and glue everything together. - Etc. Etc. So yeah, for every programming language we're encouraged to treat our dependencies as unique, fix their versions to prevent possible breakages and take the responsibility for monitoring security issues. Developers just like it. I don't like it but it's everywhere. And as other posters said, Flatpak actually have runtimes which carry core dependencies like libc that get updated independently of the app. So what is the novelty here deserving the flatkill domain? Where is that juicy security vulnerability?

pie_flavor 6y ago

All the other formats talk about how easy they are to use, and when you mention security, they throw up their hands and say "I dunno". Flatpak, on the other hand, its entire shtick is how applications are sandboxed for security.

inshadows 6y ago
And flatpak is actually sandboxed for security. So what's your point? The only news the author of this hype website told us is that 1) there was a vulnerability, 2) lots of application have broad privileges and 3) apps have bundled dependencies. -- 1) Bugs happen. Deal with it. 2) Flatpak actually tells you which privileges an app is going to use. What do you suggest as a solution? Is it technical problem or social problem? What is the state of art? I'd say the state of Art is Android in that it asks for permissions individually as they're required. Still, this problem is not fundamental issue in Flatpak. It certainly doesn't deserve "Flatkill" logo and domain. 3) Is Flatpak actually an exception to the rule? - Making Python app? Use pyenv, pipenv, venv or ${popular_venv_of_the_year} and bundle all your dependencies! - Making .NET app? Use NuGet and bundle all your DLLs! - Making Java app? Use Maven, Gradle, SBT and bundle all your JARs! - Making Rust app? Use Cargo and glue everything together. - Etc. Etc. So yeah, for every programming language we're encouraged to treat our dependencies as unique, fix their versions to prevent possible breakages and take the responsibility for monitoring security issues. Developers just like it. I don't like it but it's everywhere. And as other posters said, Flatpak actually have runtimes which carry core dependencies like libc that get updated independently of the app. So what is the novelty here deserving the flatkill domain? Where is that juicy security vulnerability?