3 ms·

Nice of you to leave off the only remaining sentence in that paragraph: > (Some of these features are work in progress) But seriously, there's nothing inconsi

Nice of you to leave off the only remaining sentence in that paragraph: > (Some of these features are work in progress) But seriously, there's nothing inconsistent here. All the major headings on that page are about distro-agnostic app distribution, build environments, and portability. The fact that flatpak has mechanisms for sandboxing that go largely unused on flathub doesn't mean that flatpak misrepresented itself as secure. In an alternative universe, on a private flatpak repository, flatpak (as a technology) facilitates secure sandboxed desktop applications. It just didn't turn out that way in our universe, or at least, not yet.

jcelerier 6y ago
> Nice of you to leave off the only remaining sentence in that paragraph: > (Some of these features are work in progress) I left it off because it doesn't change anything when talking about the announced goals ? > But seriously, there's nothing inconsistent here. All the major headings on that page are about distro-agnostic app distribution, build environments, and portability. The fact that flatpak has mechanisms for sandboxing that go largely unused on flathub doesn't mean that flatpak misrepresented itself as secure. https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html > One of Flatpak’s main goals is to increase the security of desktop systems by isolating applications from one another. This is achieved using sandboxing and means that, by default, applications that are run with Flatpak have extremely limited access to the host environment. how can it be written more clearly ? hell, the first press release has "security first" as headline: https://flatpak.org/press/2016-06-21-flatpak-released/ https://flatpak.org/press/2016-06-21-flatpak-released/
- nickysielicki 6y ago
  And under that "Security first" headline reads the following: > "Initial Flatpak releases have concentrated on application building, distribution and installation, and while the foundations of sandboxing are in place, there are still missing pieces."
  - jcelerier 6y ago
    I don't understand how you can say "flatpak has never claimed to be a security panacea. They didn't invent flatpak for the sake of security." and read that while keeping a straight face. Even if it takes 3 decades, it's still a goal that was there (and advertised as such) from the very inception of the project, 5-6 years ago.
    - nickysielicki 6y ago
      What I wrote is, > flatpak has never claimed to be a security panacea. > They didn't invent flatpak for the sake of security. > Flatpak is fundamentally a distro-agnostic packaging mechanism. > [Security] wasn't ever billed as the main idea. and we keep digging up old posts from the flatpak folks that say their main focus isn't security, and that security isn't ready, and that the primary usage is as an environment for desktop apps to be built, packaged, and distributed. Are they not allowed to think about security and sandboxing without making it their primary focus on day one?
      - jcelerier 6y ago
        > Are they not allowed to think about security and sandboxing without making it their primary focus on day one? a headline that titles "security first" is incompatible with security not being one of their main focus. They had to think better about it (or issue a rectification press release later).

jcelerier 6y ago

> Nice of you to leave off the only remaining sentence in that paragraph: > (Some of these features are work in progress) I left it off because it doesn't change anything when talking about the announced goals ? > But seriously, there's nothing inconsistent here. All the major headings on that page are about distro-agnostic app distribution, build environments, and portability. The fact that flatpak has mechanisms for sandboxing that go largely unused on flathub doesn't mean that flatpak misrepresented itself as secure. https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html > One of Flatpak’s main goals is to increase the security of desktop systems by isolating applications from one another. This is achieved using sandboxing and means that, by default, applications that are run with Flatpak have extremely limited access to the host environment. how can it be written more clearly ? hell, the first press release has "security first" as headline: https://flatpak.org/press/2016-06-21-flatpak-released/ https://flatpak.org/press/2016-06-21-flatpak-released/

nickysielicki 6y ago
And under that "Security first" headline reads the following: > "Initial Flatpak releases have concentrated on application building, distribution and installation, and while the foundations of sandboxing are in place, there are still missing pieces."
- jcelerier 6y ago
  I don't understand how you can say "flatpak has never claimed to be a security panacea. They didn't invent flatpak for the sake of security." and read that while keeping a straight face. Even if it takes 3 decades, it's still a goal that was there (and advertised as such) from the very inception of the project, 5-6 years ago.
  - nickysielicki 6y ago
    What I wrote is, > flatpak has never claimed to be a security panacea. > They didn't invent flatpak for the sake of security. > Flatpak is fundamentally a distro-agnostic packaging mechanism. > [Security] wasn't ever billed as the main idea. and we keep digging up old posts from the flatpak folks that say their main focus isn't security, and that security isn't ready, and that the primary usage is as an environment for desktop apps to be built, packaged, and distributed. Are they not allowed to think about security and sandboxing without making it their primary focus on day one?
    - jcelerier 6y ago
      > Are they not allowed to think about security and sandboxing without making it their primary focus on day one? a headline that titles "security first" is incompatible with security not being one of their main focus. They had to think better about it (or issue a rectification press release later).