6 ms·

Distro packages get full access to your system (install scripts get root) so if your issue is trusting the software vendor they are strictly worse.

by kanox 6y ago

trasz 6y ago
How is it any worse than flatpaks having full access to your home directory?
- Xylakant 6y ago
  How is it any better than flatpaks having full access to your home directory? Yet, one of the points of criticism against flatpak is that it doesn't protect the users home directory. Now, it's certainly debatable if flatpak could or should push more in that direction, like apple did when they introduced the sandbox for app store applications, but flatpak certainly does not have leverage to the same extend as apple has. So it's up to the app to opt in to a suitable sandbox set. It's a sad state of affairs, but I don't see a viable path for the flatpak folks to change that.
  - trasz 6y ago
    It’s better by not depending on yet another component or layer of abstraction. If you had a distribution which would use flatpaks for everything (ie no other packaging system involved), then sure, usual packages probably wouldn’t be any better than flatpaks.
    - Xylakant 6y ago
      But that’s not the point that is made against flatpaks - the point made in the article is “it allows access to the home directory, so it’s worse.” Whether flatpaks is better or worse than packages depends on many other factors. Flatpaks allow software providers to package for multiple operating systems in one package, for example. This makes software available that otherwise wouldn’t be. Whether that’s worth it or not is debatable, but raising clearly invalid points to attack flatpaks is disingenuous.
      - trasz 6y ago
        Does it? Which operating system other than Linux uses flatpaks?
        Xylakant 6y ago
        Let’s count the various Linux flavors as different operating systems for this purpose, because they use wildly different package formats. And yes, I’ve installed software for fedora via flatpak that did not have packages for fedora at all or depended on versions of dependencies that the host system did not provide. (Specific python versions and dependencies IIRC)
        trasz 6y ago
        Package format does not make an os. Codebase does.
        the_why_of_y 6y ago
        Indeed. If you're an ISV packaging an application that uses OpenSSL, $DISTRO version N and $DISTRO version N+1 can easily be different OSes because they ship different incompatible OpenSSL versions, so what you do is provide a .deb/.rpm/.tar.gz that bundles a statically linked OpenSSL.
  - sergeykish 6y ago
    Package managers do not claim sandbox. No claim - no false claim - no accusation. And it is easy to fix - publish capabilities in the gallery. Apple iOS "request location" shows that people care if they know. Sandbox certainly is a good thing. Without it Flatpak is just another package manager.
    - Xylakant 6y ago
      Flatpak does not claim sandbox either. It’s gnome’s installer that claims it. But flatpak provides capabilities for sandboxing, afair.
      - sergeykish 6y ago
        Clearly something went wrong > It is advertised as offering a sandbox environment in which users can run application software in isolation from the rest of the system. https://en.wikipedia.org/wiki/Flatpak https://en.wikipedia.org/wiki/Flatpak > flatpak(1): > ... isolated from the host system ('sandboxed') to some degree, at runtime. http://manpages.org/flatpak http://manpages.org/flatpak > One of Flatpak’s main goals is to increase the security of desktop systems by isolating applications from one another. This is achieved using sandboxing and means that, by default, applications that are run with Flatpak have extremely limited access to the host environment. https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html And a lot more https://www.google.com/search?q=flatpak+sandbox https://www.google.com/search?q=flatpak+sandbox
- dx87 6y ago
  You don't understand how something running as root with full access to your entire filesystem is worse than something that has access to your home directory?
  - trasz 6y ago
    In most cases it’s not worse in any way - all the important stuff is owned by me, in my home directory.
AnIdiotOnTheNet 6y ago
Not just the software vendor, but also the third party package maintainer, often an unpaid volunteer.
- sergeykish 6y ago
  It is not that simple [1], one need to earn trust. Distribution maintainers have much better record than browser addons authors. Maybe we can trust big names, just like on Android — Google, Amazon. We may think that it is safer with paid software — they have something to loose. But free - I'd bet on maintainers. [1] https://wiki.archlinux.org/index.php/Trusted_Users https://wiki.archlinux.org/index.php/Trusted_Users
dredmorbius 6y ago
Dedicated accounts, sandboxing, jails, Docker, and VMs exist. The old thinking was that software was a user agent, serving the user's needs and interests. Some OSes (Debian comes to mind) explicitly acknowledge this. Increasingly it's simply a naive and unjustified belief. Applications must be considered as untrusted necessary evils. Allocating them a minimum level of access is prudent. Flatpak promises this, but fails to deliver. Package managers offer this by convention, but rely on users (and security researchers) discovering and reporting malicious behaviour. Mitigation is retroactive: fixed behaviours or packages removed from the distro's repository, but the damage is done and existing deployments remain. The underlying issue is one of packaging, updating, and distributing sandboxed apps. And in recognising that packaging systems serve users, not developers.
phkahler 6y ago
If a library has a vulnerability, the distro often updates it and then every package that uses it has been patched. With these sandboxes things that include their own versions of dependencies, each one of them needs to be updated.

Distro packages get full access to your system (install scripts get root) so if your issue is trusting the software vendor they are strictly worse.

by kanox 6y ago

Distro packages get full access to your system (install scripts get root) so if your issue is trusting the software vendor they are strictly worse.

trasz 6y ago

How is it any worse than flatpaks having full access to your home directory?

Xylakant 6y ago
How is it any better than flatpaks having full access to your home directory? Yet, one of the points of criticism against flatpak is that it doesn't protect the users home directory. Now, it's certainly debatable if flatpak could or should push more in that direction, like apple did when they introduced the sandbox for app store applications, but flatpak certainly does not have leverage to the same extend as apple has. So it's up to the app to opt in to a suitable sandbox set. It's a sad state of affairs, but I don't see a viable path for the flatpak folks to change that.
- trasz 6y ago
  It’s better by not depending on yet another component or layer of abstraction. If you had a distribution which would use flatpaks for everything (ie no other packaging system involved), then sure, usual packages probably wouldn’t be any better than flatpaks.
  - Xylakant 6y ago
    But that’s not the point that is made against flatpaks - the point made in the article is “it allows access to the home directory, so it’s worse.” Whether flatpaks is better or worse than packages depends on many other factors. Flatpaks allow software providers to package for multiple operating systems in one package, for example. This makes software available that otherwise wouldn’t be. Whether that’s worth it or not is debatable, but raising clearly invalid points to attack flatpaks is disingenuous.
    - trasz 6y ago
      Does it? Which operating system other than Linux uses flatpaks?
      - Xylakant 6y ago
        Let’s count the various Linux flavors as different operating systems for this purpose, because they use wildly different package formats. And yes, I’ve installed software for fedora via flatpak that did not have packages for fedora at all or depended on versions of dependencies that the host system did not provide. (Specific python versions and dependencies IIRC)
        trasz 6y ago
        Package format does not make an os. Codebase does.
        the_why_of_y 6y ago
        Indeed. If you're an ISV packaging an application that uses OpenSSL, $DISTRO version N and $DISTRO version N+1 can easily be different OSes because they ship different incompatible OpenSSL versions, so what you do is provide a .deb/.rpm/.tar.gz that bundles a statically linked OpenSSL.
- sergeykish 6y ago
  Package managers do not claim sandbox. No claim - no false claim - no accusation. And it is easy to fix - publish capabilities in the gallery. Apple iOS "request location" shows that people care if they know. Sandbox certainly is a good thing. Without it Flatpak is just another package manager.
  - Xylakant 6y ago
    Flatpak does not claim sandbox either. It’s gnome’s installer that claims it. But flatpak provides capabilities for sandboxing, afair.
    - sergeykish 6y ago
      Clearly something went wrong > It is advertised as offering a sandbox environment in which users can run application software in isolation from the rest of the system. https://en.wikipedia.org/wiki/Flatpak https://en.wikipedia.org/wiki/Flatpak > flatpak(1): > ... isolated from the host system ('sandboxed') to some degree, at runtime. http://manpages.org/flatpak http://manpages.org/flatpak > One of Flatpak’s main goals is to increase the security of desktop systems by isolating applications from one another. This is achieved using sandboxing and means that, by default, applications that are run with Flatpak have extremely limited access to the host environment. https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html And a lot more https://www.google.com/search?q=flatpak+sandbox https://www.google.com/search?q=flatpak+sandbox
dx87 6y ago
You don't understand how something running as root with full access to your entire filesystem is worse than something that has access to your home directory?
- trasz 6y ago
  In most cases it’s not worse in any way - all the important stuff is owned by me, in my home directory.

AnIdiotOnTheNet 6y ago

Not just the software vendor, but also the third party package maintainer, often an unpaid volunteer.

sergeykish 6y ago
It is not that simple [1], one need to earn trust. Distribution maintainers have much better record than browser addons authors. Maybe we can trust big names, just like on Android — Google, Amazon. We may think that it is safer with paid software — they have something to loose. But free - I'd bet on maintainers. [1] https://wiki.archlinux.org/index.php/Trusted_Users https://wiki.archlinux.org/index.php/Trusted_Users

dredmorbius 6y ago

Dedicated accounts, sandboxing, jails, Docker, and VMs exist. The old thinking was that software was a user agent, serving the user's needs and interests. Some OSes (Debian comes to mind) explicitly acknowledge this. Increasingly it's simply a naive and unjustified belief. Applications must be considered as untrusted necessary evils. Allocating them a minimum level of access is prudent. Flatpak promises this, but fails to deliver. Package managers offer this by convention, but rely on users (and security researchers) discovering and reporting malicious behaviour. Mitigation is retroactive: fixed behaviours or packages removed from the distro's repository, but the damage is done and existing deployments remain. The underlying issue is one of packaging, updating, and distributing sandboxed apps. And in recognising that packaging systems serve users, not developers.

phkahler 6y ago

If a library has a vulnerability, the distro often updates it and then every package that uses it has been patched. With these sandboxes things that include their own versions of dependencies, each one of them needs to be updated.