7 ms·

I agree with all of this and... I just don't care. I download a Flatpak from the Pop OS store and it works. It installs only in my profile, so another user on

by edent 5y ago

I agree with all of this and... I just don't care. I download a Flatpak from the Pop OS store and it works. It installs only in my profile, so another user on the same machine doesn't have access. You can't do that with a .deb! I've never got into dependency hell where I need to apt-get a specific version of a library from a dodgy PPA. If I uninstall it, Flatpak doesn't leave acres of cruft strewn around my disk. I don't see how randomly installing a Flatpak is any worse for security than compiling the source myself. The permission model on Linux is far worse than Android - so I just hope for the best anyway. Snaps never worked right for me - and seemed to frequently break. But all my Flatpaks have run fine and at full speed. Does it take up more disk space? Sure. But that's a trade-off I'm willing to make in order to just download and run with no extra work. Sure, there are some efficiency and security gains to be made. But I'm much happier with a Flatpak world than the alternative.

capableweb 5y ago
> You can't do that with a .deb! Pretty sure you can by doing "dpkg --root=$HOME -i mypackage.deb" or something like that, long time ago I used dpkg, but it should be possible with some flag. Otherwise I agree, Flatpak is a breath of fresh air!
- johnchristopher 5y ago
  Where does that put the Deb files ? edit: should have written "where does dpkg put the files of the package ?" or "where does that put the Deb's files ?", sorry.
  - capableweb 5y ago
    The .deb file should remain where it was when you downloaded it, dpkg just installs the contents of the .deb file.
    - johnchristopher 5y ago
      Where is the contents of the .deb files put?
      - adwn 5y ago
        Is there a point you're trying to make, or are you asking for technical information which would be better answered by man dpkg or a quick Internet search?
        johnchristopher 5y ago
        I am not trying to make any point, I am genuinely curious where dpkg is going to put those files since its the first time I read you can dot `dpkg --root=$HOME -i mypackage.deb`. For instance I always do `python3 -m pip install --user wormhole` or `pip install --user wormhole` instead of sudoing my way to permissions hell. Python apps get installed in $HOME/.local/bin, so no cruft for other users. But stuff installed with deb packages often have hard coded pathways and assumptions of where and how their files are run. So I think it's fair to ask in reply to someone implying that `dpkg --root=$HOME -i mypackage.deb` is as clean/same as a flatpack behaviour "It installs only in my profile, so another user on the same machine doesn't have access. You can't do that with a .deb!"... It's fair to ask "where do those files in the deb package go ?" because if it works as implied (no pollution of the OS) I am certainly going to start testing installing things that way.
      - foxfluff 5y ago
        --root=dir Set the root directory to directory, which sets the installation directory to «dir» and the administrative directory to «dir/usr/local/var/lib/dpkg».
- kirbyfan64sos 5y ago
  This often doesn't really work in practice on its own at least, since packages tend to hardcode their in installation directories. (You could try using an overlayfs, but at that point it's becoming pretty cumbersome.)
  - goohle 5y ago
    You can recompile package from source to support installation into `~/.local` (see `man 7 file-hierarchy`), but burden to support this will be on you, including updates, protection from malware and viruses, firewalling, and so on. For example, rust's cargo can compile and install applications into `~/.local`, but it's pain to keep them up to date, so I prefer to use same tools from my OS (Fedora) distribution repo instead.
- jasode 5y ago
  >Pretty sure you can by doing "dpkg --root=$HOME -i mypackage.deb" or something like that, As a sibling comment already noted, using "--root" doesn't always work and a q&a mentions the problems: https://askubuntu.com/questions/28619/how-do-i-install-an-application-by-deb-file-for-a-single-user-only https://askubuntu.com/questions/28619/how-do-i-install-an-ap... https://serverfault.com/questions/23734/is-there-any-way-to-get-apt-to-install-packages-to-my-home-directory https://serverfault.com/questions/23734/is-there-any-way-to-...
enriquto 5y ago
> it works No. It doesn't. You still need to trust the people who package the thing. A working packaging system would give the user ultimate power to manage access to resources by each app. Overriding or mocking, if the user so decides, whatever access does the app believe to need. Flatpack does not give you such power, it removes this power from you and assigns it to the packagers. Thus, not only it doesn't work: it works against you! EDIT: The "dependency hell" issue is separate, and is solved more easily by distributing static binaries.
- AnonCoward4 5y ago
  You can override permissions (there is even a GUI called Flatseal for that). You are also not able to do any of that with distro package managers like apt or dnf. Ultimately you need to trust either.
  - enriquto 5y ago
    What I mean is that permissions and accesses concern the operating system, not the software packaging. I don't understand why flatpack needs to deal with those, providing a false (and pernicious) aura of protection. I already run third-party software inside containers or virtual machines. No need for a GUI nor a flatpack-only solution like flatseal. It just looks pointless.
- alkonaut 5y ago
  Is there any difference in trust between package maintainers and flatpack packagers? If anything, isn't the flatpack situation better in that regard because the end user is more likely to have a sandbox?
  - enriquto 5y ago
    > Is there any difference in trust between package maintainers and flatpack packagers? You shouldn't need to trust either. Just the sandboxing system of your OS.
    - 5y ago
akkartik 5y ago
"I don't see how randomly installing a Flatpak is any worse for security than compiling the source myself." It's worse because you're likely to install more packages using something like Flatpak than you would by downloading random binaries or building from source. That wantonness isn't justified given the current state of security on Linux. (I'm just regurgitating OP: "Flatpak and Snap apologists claim that some security is better than nothing. This is not true. From a purely technical perspective, for apps with filesystem access the security is exactly equal to nothing. In reality it’s actually worse than nothing because it leads people to place more trust than they should in random apps they find on the internet.")
- jcelerier 5y ago
  > It's worse because you're likely to install more packages using something like Flatpak than you would by downloading random binaries or building from source. ... what makes you say that ? if I want to run something, it'll run one way or another no matter how hard the "system" wants to prevent that. Even if it's patch.exe downloaded from a 2004 russian website.

by edent 5y ago

capableweb 5y ago

> You can't do that with a .deb! Pretty sure you can by doing "dpkg --root=$HOME -i mypackage.deb" or something like that, long time ago I used dpkg, but it should be possible with some flag. Otherwise I agree, Flatpak is a breath of fresh air!

johnchristopher 5y ago
Where does that put the Deb files ? edit: should have written "where does dpkg put the files of the package ?" or "where does that put the Deb's files ?", sorry.
- capableweb 5y ago
  The .deb file should remain where it was when you downloaded it, dpkg just installs the contents of the .deb file.
  - johnchristopher 5y ago
    Where is the contents of the .deb files put?
    - adwn 5y ago
      Is there a point you're trying to make, or are you asking for technical information which would be better answered by man dpkg or a quick Internet search?
      - johnchristopher 5y ago
        I am not trying to make any point, I am genuinely curious where dpkg is going to put those files since its the first time I read you can dot `dpkg --root=$HOME -i mypackage.deb`. For instance I always do `python3 -m pip install --user wormhole` or `pip install --user wormhole` instead of sudoing my way to permissions hell. Python apps get installed in $HOME/.local/bin, so no cruft for other users. But stuff installed with deb packages often have hard coded pathways and assumptions of where and how their files are run. So I think it's fair to ask in reply to someone implying that `dpkg --root=$HOME -i mypackage.deb` is as clean/same as a flatpack behaviour "It installs only in my profile, so another user on the same machine doesn't have access. You can't do that with a .deb!"... It's fair to ask "where do those files in the deb package go ?" because if it works as implied (no pollution of the OS) I am certainly going to start testing installing things that way.
    - foxfluff 5y ago
      --root=dir Set the root directory to directory, which sets the installation directory to «dir» and the administrative directory to «dir/usr/local/var/lib/dpkg».
kirbyfan64sos 5y ago
This often doesn't really work in practice on its own at least, since packages tend to hardcode their in installation directories. (You could try using an overlayfs, but at that point it's becoming pretty cumbersome.)
- goohle 5y ago
  You can recompile package from source to support installation into `~/.local` (see `man 7 file-hierarchy`), but burden to support this will be on you, including updates, protection from malware and viruses, firewalling, and so on. For example, rust's cargo can compile and install applications into `~/.local`, but it's pain to keep them up to date, so I prefer to use same tools from my OS (Fedora) distribution repo instead.
jasode 5y ago
>Pretty sure you can by doing "dpkg --root=$HOME -i mypackage.deb" or something like that, As a sibling comment already noted, using "--root" doesn't always work and a q&a mentions the problems: https://askubuntu.com/questions/28619/how-do-i-install-an-application-by-deb-file-for-a-single-user-only https://askubuntu.com/questions/28619/how-do-i-install-an-ap... https://serverfault.com/questions/23734/is-there-any-way-to-get-apt-to-install-packages-to-my-home-directory https://serverfault.com/questions/23734/is-there-any-way-to-...

enriquto 5y ago

> it works No. It doesn't. You still need to trust the people who package the thing. A working packaging system would give the user ultimate power to manage access to resources by each app. Overriding or mocking, if the user so decides, whatever access does the app believe to need. Flatpack does not give you such power, it removes this power from you and assigns it to the packagers. Thus, not only it doesn't work: it works against you! EDIT: The "dependency hell" issue is separate, and is solved more easily by distributing static binaries.

AnonCoward4 5y ago
You can override permissions (there is even a GUI called Flatseal for that). You are also not able to do any of that with distro package managers like apt or dnf. Ultimately you need to trust either.
- enriquto 5y ago
  What I mean is that permissions and accesses concern the operating system, not the software packaging. I don't understand why flatpack needs to deal with those, providing a false (and pernicious) aura of protection. I already run third-party software inside containers or virtual machines. No need for a GUI nor a flatpack-only solution like flatseal. It just looks pointless.
alkonaut 5y ago
Is there any difference in trust between package maintainers and flatpack packagers? If anything, isn't the flatpack situation better in that regard because the end user is more likely to have a sandbox?
- enriquto 5y ago
  > Is there any difference in trust between package maintainers and flatpack packagers? You shouldn't need to trust either. Just the sandboxing system of your OS.
  - 5y ago

akkartik 5y ago

"I don't see how randomly installing a Flatpak is any worse for security than compiling the source myself." It's worse because you're likely to install more packages using something like Flatpak than you would by downloading random binaries or building from source. That wantonness isn't justified given the current state of security on Linux. (I'm just regurgitating OP: "Flatpak and Snap apologists claim that some security is better than nothing. This is not true. From a purely technical perspective, for apps with filesystem access the security is exactly equal to nothing. In reality it’s actually worse than nothing because it leads people to place more trust than they should in random apps they find on the internet.")

jcelerier 5y ago
> It's worse because you're likely to install more packages using something like Flatpak than you would by downloading random binaries or building from source. ... what makes you say that ? if I want to run something, it'll run one way or another no matter how hard the "system" wants to prevent that. Even if it's patch.exe downloaded from a 2004 russian website.