4 ms·

The answers are good, with the exception of one point that I disagree with. In the article, the author states that IDE's obviously need to have full file system

The answers are good, with the exception of one point that I disagree with. In the article, the author states that IDE's obviously need to have full file system access in order to work. This is papering over the fact that development tools are some of the most critical pieces of software in an organisation, and if it becomes compromised the entire production chain may be compromised. It doesn't help that a lot of development tools happily downloads random code from various repositories during build, so not only are the applications sensitive, they also are more vulnerable than anything else. The solution here is of course to isolate the development environments and give them private structures that contains everything the tools need. I'm not sure if Flatpak has the ability to provde a "virtual home" or some such, it should be available.

zxzax 5y ago
It's not papering over it if you look at the rest of the paragraph. The problem is that the IDEs just aren't made to work with this kind of sandboxing and need to be changed significantly. I agree it would be cool if someone eventually made an IDE that could operate like that.
- lokedhs 5y ago
  My point is that I work like that with current IDE's when using Qubes OS. What I suggest is that Flatpak could provide something similar, by having a completely separate filesystem used by the tool.
  - zxzax 5y ago
    That would need UI similar to Qubes that would have to be built and integrated probably on the IDE side. Purposefully, flatpaks don't typically ship a whole OS like Qubes VMs do, so the gap has to be filled somewhere.
    - lokedhs 5y ago
      Most VMs in Qubes does not come with a full OS. They're based on templates, which isn't too different from the system packages of Flatpak. Also, Python developers seems to be dealing with this stuff on a daily basis with virtualenv, so this isn't something new.

zxzax 5y ago

It's not papering over it if you look at the rest of the paragraph. The problem is that the IDEs just aren't made to work with this kind of sandboxing and need to be changed significantly. I agree it would be cool if someone eventually made an IDE that could operate like that.

lokedhs 5y ago
My point is that I work like that with current IDE's when using Qubes OS. What I suggest is that Flatpak could provide something similar, by having a completely separate filesystem used by the tool.
- zxzax 5y ago
  That would need UI similar to Qubes that would have to be built and integrated probably on the IDE side. Purposefully, flatpaks don't typically ship a whole OS like Qubes VMs do, so the gap has to be filled somewhere.
  - lokedhs 5y ago
    Most VMs in Qubes does not come with a full OS. They're based on templates, which isn't too different from the system packages of Flatpak. Also, Python developers seems to be dealing with this stuff on a daily basis with virtualenv, so this isn't something new.