7 ms·

Perhaps the messaging has changed or I came at it from a different angle, but my memory is that when I first investigated flatpak they promoted the security asp

Perhaps the messaging has changed or I came at it from a different angle, but my memory is that when I first investigated flatpak they promoted the security aspect of the sandbox, and that I was later genuinely confused when I found out that the apps could specify their own sandbox setting without specifically asking me on install.

vetinari 6y ago
There is security aspect of the sandbox, but that does not mean it is turned up to the 11 for every single package since day 1. Especially if the result is, that it would break or make unusable the package. No, the intent is to have evolution: provide a mechanism for some scenarios, update apps where possible, provide for more scenarios, update additional apps, and improve continuously, till you achieve the securing aspect. Treating it as if it was a flip of the switch, and then badmouthing it when it turns out it is not, is not a good faith contribution.
- sthnblllII 6y ago
  Flatpak sandboxes are security theater. The goal of the sandbox is fantastic. But until apps are actually sandboxed they shouldn't call it a sandbox. "Trivially bypass-able security is better than no security" is just a bad thing to have to say to defend something.
  - vetinari 6y ago
    Again, it is not something that can be done with a flip of a switch, across the entire ecosystem. Rome wasn't built in a day either.
    - sthnblllII 6y ago
      I agree. Now why is it called a sandbox if it isnt one?
      - vetinari 6y ago
        Why is iptables called firewall, when you can put in rule to accept all the traffic? It is a tool. It is configured into such a way, where it provides most value to most users. If you want to use in another way, you are free to do so.
        sthnblllII 6y ago
        Sandboxes are not the same thing as firewalls. iOS apps and web apps have a real sandbox. Those apps can never take over your system without a zeroday. Flatpaks apps can get and a huge percentage actually have gotten permissions to do that, so it isn't a sandbox. So they shouldn't call it a sandbox. I will celebrate the day 0% of flatpak apps can trivially escape their "sandbox". Until then I will call out flatpak for misusing language, overselling their product and misleading users.
        vetinari 6y ago
        iOS and web apps were designed and developed with the limitations given by the sandbox from scratch; there are exactly zero iOS applications in existence that didn'assume sandbox limits. Flatpak applications are retrofits; they were originally developed with the assumption of the full access to the system (as permitted by permissions); so in order to remain useful, there has to be a transitional mechanism. No user would install an app, that is perfectly sandboxed, but no longer fit for purpose. The same thing applies to MacOS, MacOS sandbox and MAS (MacOS App Store), it is the same store. You can also see apps that are being offered outside MAS exclusively, or the MAS version having limited features compared to versions that you can obtain outside MAS. This also highlights difference between mobile and desktop apps: mobile apps are silos, that silo user data and only that one given application operates on them. Desktop apps on the other hand are built on cooperating; the user has a set of files that he organizes and then miscellaneous app operate on them. For this to work, the apps need to be provided access; thus they cannot silo user data for themselves.

vetinari 6y ago

There is security aspect of the sandbox, but that does not mean it is turned up to the 11 for every single package since day 1. Especially if the result is, that it would break or make unusable the package. No, the intent is to have evolution: provide a mechanism for some scenarios, update apps where possible, provide for more scenarios, update additional apps, and improve continuously, till you achieve the securing aspect. Treating it as if it was a flip of the switch, and then badmouthing it when it turns out it is not, is not a good faith contribution.

sthnblllII 6y ago
Flatpak sandboxes are security theater. The goal of the sandbox is fantastic. But until apps are actually sandboxed they shouldn't call it a sandbox. "Trivially bypass-able security is better than no security" is just a bad thing to have to say to defend something.
- vetinari 6y ago
  Again, it is not something that can be done with a flip of a switch, across the entire ecosystem. Rome wasn't built in a day either.
  - sthnblllII 6y ago
    I agree. Now why is it called a sandbox if it isnt one?
    - vetinari 6y ago
      Why is iptables called firewall, when you can put in rule to accept all the traffic? It is a tool. It is configured into such a way, where it provides most value to most users. If you want to use in another way, you are free to do so.
      - sthnblllII 6y ago
        Sandboxes are not the same thing as firewalls. iOS apps and web apps have a real sandbox. Those apps can never take over your system without a zeroday. Flatpaks apps can get and a huge percentage actually have gotten permissions to do that, so it isn't a sandbox. So they shouldn't call it a sandbox. I will celebrate the day 0% of flatpak apps can trivially escape their "sandbox". Until then I will call out flatpak for misusing language, overselling their product and misleading users.
        vetinari 6y ago
        iOS and web apps were designed and developed with the limitations given by the sandbox from scratch; there are exactly zero iOS applications in existence that didn'assume sandbox limits. Flatpak applications are retrofits; they were originally developed with the assumption of the full access to the system (as permitted by permissions); so in order to remain useful, there has to be a transitional mechanism. No user would install an app, that is perfectly sandboxed, but no longer fit for purpose. The same thing applies to MacOS, MacOS sandbox and MAS (MacOS App Store), it is the same store. You can also see apps that are being offered outside MAS exclusively, or the MAS version having limited features compared to versions that you can obtain outside MAS. This also highlights difference between mobile and desktop apps: mobile apps are silos, that silo user data and only that one given application operates on them. Desktop apps on the other hand are built on cooperating; the user has a set of files that he organizes and then miscellaneous app operate on them. For this to work, the apps need to be provided access; thus they cannot silo user data for themselves.