4 ms·

Flatpak is the only practical approach to achieve some degree of isolation on Linux today, unless you are willing to go with Qubes OS. And yes, I know Flatpak

Flatpak is the only practical approach to achieve some degree of isolation on Linux today, unless you are willing to go with Qubes OS. And yes, I know Flatpak has some way to go before it actually reaches that goal, but I don't see any other solution to this problem that Linux users in general seem to be happy just pretending doesn't exist. If not Flatpak, do you have an alternative approach to propose to regular users who just want to be able to run a random application without worrying that it has access to all your information?

reidrac 6y ago
> Flatpak is the only practical approach to achieve some degree of isolation on Linux today, unless you are willing to go with Qubes OS. Flatpak tries to solve a problem I don't have. I use the packages from the distro (and you trust the distribution, isn't it?), and it provides any software I need. So I guess it all depends on your requirements.
- lokedhs 6y ago
  I trust the distribution, I have to because they are they ones delivering the kernel. But I absolutely do not trust any of the software I install from the distribution's repositories. The packager doesn't analyse the code for all the software they add to the distribution, so it cannot be trusted. Personally, I use Qubes OS, but people who's don't still deserve a secure operating system.
  - reidrac 6y ago
    If you are not trusting the packages provided by you distribution, you should switch to a different one. I'm very happy with the packages I get from Debian. https://www.debian.org/doc/debian-policy/ https://www.debian.org/doc/debian-policy/ Add a bit of common sense, and it is enough for me (and I assume for most people, but hey!).
    - lokedhs 6y ago
      There are no distributions that do security testing of all packages. And even if they did, it wouldn't be a guarantee that all software are actually free of security bugs. The solution is to simply not trust the software at all. This is the approach Qubes OS takes, and works really well. Most regular users don't really need to go as far as Qubes OS does though, and application level isolation that Flatpak is trying to achieve is enough. I don't see how anyone can accept that any random piece of software is allowed to access all your personal files is acceptable. We certainly don't accept it on mobile platforms (how many posts do we see here about applications that scrape user's contacts?) so why should we accept it on the desktops?
arghwhat 6y ago
https://www.flatkill.org/2020/ https://www.flatkill.org/2020/ Isolation that with gaping holes in it isn't isolation. Most flathub apps have "access to all your information" one way or another. It's a pain to work with too, and it's dependency management result in outdated and handicapped dependencies (like when upstream base images decided to disable vaapi support in gstreamer). The slapped on app store is feature creep of an extreme degree, and I suspect that's the biggest part of the agenda: side-stepping distro repos. If you want to make a good sandboxing solution, make it standalone and don't mix distribution into things. Say, AppImage + bubblewrap.
- lokedhs 6y ago
  > Most flathub apps have "access to all your information" one way or another. I went thought some of the Flatpak applications I commonly use, and none of them had access to all my information. I'm not going to go through all of them, but this suggests that the quoted statement isn't true. I stand by my original statement that Flatpak is the only system that tries to address this. The fact that you're suggesting two separate technologies in combination confirms this, in my opinion.
  - arghwhat 6y ago
    Examples of popular apps that can write to the host filesystem (and remember kids, the ability to write to $HOME always means full account takeover, followed shortly by root access if your account can sudo): - vs code (https://github.com/flathub/com.visualstudio.code/blob/91e58979d14d68f09bf557ed301edfdda209dbea/com.visualstudio.code.yaml#L18 https://github.com/flathub/com.visualstudio.code/blob/91e589...) - chromium (https://github.com/flathub/org.chromium.Chromium/blob/1edd4a05fa98094e508ef4f096b121ee847a56ba/org.chromium.Chromium.yaml#L8 https://github.com/flathub/org.chromium.Chromium/blob/1edd4a...) - sublime text (https://github.com/flathub/com.sublimetext.three/blob/d1f617f261c3d118e56ba7e120afb06095669d8d/com.sublimetext.three.yaml#L18 https://github.com/flathub/com.sublimetext.three/blob/d1f617...) - obs studio (https://github.com/flathub/com.obsproject.Studio/blob/051f6fb5d90c8f4cd40d9f4dd56fe0c3d3c12275/com.obsproject.Studio.json#L15 https://github.com/flathub/com.obsproject.Studio/blob/051f6f...) The applications above also provide other dangerous privileges, but they pale in the presence of filesystem access. Examples of applications that have full device access (which is considered insecure and called "not ideal" in the flatpak docs), as well as sharing a bunch of namespaces like network and IPC (meaning these parts are not sandboxed): - discord (https://github.com/flathub/com.discordapp.Discord/blob/master/com.discordapp.Discord.json https://github.com/flathub/com.discordapp.Discord/blob/maste...) - steam (https://github.com/flathub/com.valvesoftware.Steam/blob/beta/com.valvesoftware.Steam.yml https://github.com/flathub/com.valvesoftware.Steam/blob/beta...) - telegram (https://github.com/flathub/org.telegram.desktop/blob/beta/org.telegram.desktop.json https://github.com/flathub/org.telegram.desktop/blob/beta/or...) - lutris (https://github.com/flathub/net.lutris.Lutris/blob/beta/net.lutris.Lutris.yml https://github.com/flathub/net.lutris.Lutris/blob/beta/net.l...) Of all the applications I sampled (some by popularity, some random I knew), all gave full device access and disabled network/ipc sandboxing. A significant chunk gave filesystem=host access (not even home, host!). (I am however happy to see that the number of filesystem=home/filesystem=host manifests seem to have dropped.) > The fact that you're suggesting two separate technologies in combination confirms this, in my opinion. Whenever independent tasks need to be accomplished, independent solutions is the superior choice. The alternative are monoliths and semi-closed gardens.

reidrac 6y ago

> Flatpak is the only practical approach to achieve some degree of isolation on Linux today, unless you are willing to go with Qubes OS. Flatpak tries to solve a problem I don't have. I use the packages from the distro (and you trust the distribution, isn't it?), and it provides any software I need. So I guess it all depends on your requirements.

lokedhs 6y ago
I trust the distribution, I have to because they are they ones delivering the kernel. But I absolutely do not trust any of the software I install from the distribution's repositories. The packager doesn't analyse the code for all the software they add to the distribution, so it cannot be trusted. Personally, I use Qubes OS, but people who's don't still deserve a secure operating system.
- reidrac 6y ago
  If you are not trusting the packages provided by you distribution, you should switch to a different one. I'm very happy with the packages I get from Debian. https://www.debian.org/doc/debian-policy/ https://www.debian.org/doc/debian-policy/ Add a bit of common sense, and it is enough for me (and I assume for most people, but hey!).
  - lokedhs 6y ago
    There are no distributions that do security testing of all packages. And even if they did, it wouldn't be a guarantee that all software are actually free of security bugs. The solution is to simply not trust the software at all. This is the approach Qubes OS takes, and works really well. Most regular users don't really need to go as far as Qubes OS does though, and application level isolation that Flatpak is trying to achieve is enough. I don't see how anyone can accept that any random piece of software is allowed to access all your personal files is acceptable. We certainly don't accept it on mobile platforms (how many posts do we see here about applications that scrape user's contacts?) so why should we accept it on the desktops?

arghwhat 6y ago

https://www.flatkill.org/2020/ https://www.flatkill.org/2020/ Isolation that with gaping holes in it isn't isolation. Most flathub apps have "access to all your information" one way or another. It's a pain to work with too, and it's dependency management result in outdated and handicapped dependencies (like when upstream base images decided to disable vaapi support in gstreamer). The slapped on app store is feature creep of an extreme degree, and I suspect that's the biggest part of the agenda: side-stepping distro repos. If you want to make a good sandboxing solution, make it standalone and don't mix distribution into things. Say, AppImage + bubblewrap.

lokedhs 6y ago
> Most flathub apps have "access to all your information" one way or another. I went thought some of the Flatpak applications I commonly use, and none of them had access to all my information. I'm not going to go through all of them, but this suggests that the quoted statement isn't true. I stand by my original statement that Flatpak is the only system that tries to address this. The fact that you're suggesting two separate technologies in combination confirms this, in my opinion.
- arghwhat 6y ago
  Examples of popular apps that can write to the host filesystem (and remember kids, the ability to write to $HOME always means full account takeover, followed shortly by root access if your account can sudo): - vs code (https://github.com/flathub/com.visualstudio.code/blob/91e58979d14d68f09bf557ed301edfdda209dbea/com.visualstudio.code.yaml#L18 https://github.com/flathub/com.visualstudio.code/blob/91e589...) - chromium (https://github.com/flathub/org.chromium.Chromium/blob/1edd4a05fa98094e508ef4f096b121ee847a56ba/org.chromium.Chromium.yaml#L8 https://github.com/flathub/org.chromium.Chromium/blob/1edd4a...) - sublime text (https://github.com/flathub/com.sublimetext.three/blob/d1f617f261c3d118e56ba7e120afb06095669d8d/com.sublimetext.three.yaml#L18 https://github.com/flathub/com.sublimetext.three/blob/d1f617...) - obs studio (https://github.com/flathub/com.obsproject.Studio/blob/051f6fb5d90c8f4cd40d9f4dd56fe0c3d3c12275/com.obsproject.Studio.json#L15 https://github.com/flathub/com.obsproject.Studio/blob/051f6f...) The applications above also provide other dangerous privileges, but they pale in the presence of filesystem access. Examples of applications that have full device access (which is considered insecure and called "not ideal" in the flatpak docs), as well as sharing a bunch of namespaces like network and IPC (meaning these parts are not sandboxed): - discord (https://github.com/flathub/com.discordapp.Discord/blob/master/com.discordapp.Discord.json https://github.com/flathub/com.discordapp.Discord/blob/maste...) - steam (https://github.com/flathub/com.valvesoftware.Steam/blob/beta/com.valvesoftware.Steam.yml https://github.com/flathub/com.valvesoftware.Steam/blob/beta...) - telegram (https://github.com/flathub/org.telegram.desktop/blob/beta/org.telegram.desktop.json https://github.com/flathub/org.telegram.desktop/blob/beta/or...) - lutris (https://github.com/flathub/net.lutris.Lutris/blob/beta/net.lutris.Lutris.yml https://github.com/flathub/net.lutris.Lutris/blob/beta/net.l...) Of all the applications I sampled (some by popularity, some random I knew), all gave full device access and disabled network/ipc sandboxing. A significant chunk gave filesystem=host access (not even home, host!). (I am however happy to see that the number of filesystem=home/filesystem=host manifests seem to have dropped.) > The fact that you're suggesting two separate technologies in combination confirms this, in my opinion. Whenever independent tasks need to be accomplished, independent solutions is the superior choice. The alternative are monoliths and semi-closed gardens.