4 ms·

I disagree with this post. I wouldn’t be surprised if the author of the help article was under the impression that the package was Microsoft’s. Just look at the

I disagree with this post. I wouldn’t be surprised if the author of the help article was under the impression that the package was Microsoft’s. Just look at the metadata, which is used in the UI: <id>com.microsoft.Edge</id> <name>Microsoft Edge</name> <developer_name>Microsoft Corporation</developer_name> You can’t go round claiming to be Microsoft and then add a disclaimer in the notes field that you’re not actually Microsoft, which they do, after four paragraphs of other text: > NOTE: This wrapper is not verified by, affiliated with, or supported by Microsoft. I don’t think this is an adequate way to surface such an important piece of information, one which arguably contradicts the package metadata. Flathub needs to figure this out.

deleted 5y ago
[deleted]
charcircuit 5y ago
>You can’t go round claiming to be Microsoft and then add a disclaimer in the notes field that you’re not actually Microsoft The developer_name element is for the developer of the application that is being packaged. It is not the name of the maintainer of the flatpak. >The <developer_name/> tag is designed to represent the developers or project responsible for development of the project described in the metadata. https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-developer_name https://www.freedesktop.org/software/appstream/docs/chap-Met...
- jahewson 5y ago
  It may be designed that way but in practice it’s misleading, especially the way it appears in the UI. It looks like a designation of origin of the package. These are trademarks and can’t just be thrown around casually. Why is there not at least a packager or maintainer field?
  - charcircuit 5y ago
    >Why is there not at least a packager or maintainer field? On flathub the developer is the developer of the software being published and the publisher is the people who packaged it.
    - jahewson 5y ago
      Interesting. Where can I find the publisher field?
      - charcircuit 5y ago
        Click on an application on https://flathub.org/home https://flathub.org/home and ctrl + f
        JaggedJax 5y ago
        This does not help much without doing further digging. I checked the "Steam" package and for me in Flathub I see a link to "See Details" for the publisher. Clicking on that takes me to the contributors page of their Flathub GitHub repo. Am I supposed to know if these are employees of the company or not? I am on mobile, so maybe there's more info on desktop? I see nothing indicating if this is official or not, other than a note at the bottom of the flathub description telling me it is not official, which seems strange for that to be the only place indicating that.
3np 5y ago
From TFA: > Needless to say, this most likely an oversight so I have not concluded that this was intentional, yet I don't see a point of disagreement. Developer != flatpak maintainer. Putting themselves there would rightly have them called out for misappropriation.
- jahewson 5y ago
  Indeed. I think this reveals a deeper problem with flatpack packaging conventions. The package maintainer is a vital piece of missing metadata.
  - iotku 5y ago
    This is one of my bigger issues with Flathub that still keeps me uncomfortable. I've been adopting flatpaks a fair bit lately but something doesn't sit right that there's not an obvious way (At least in most front ends) to know: 1) Who the packager is. 2) Is the flatpak officially sanctioned by the developer of the software? 2.5) If not, how do I know that it was packaged correctly? Was the build from a clean source? 3) Is it really the latest version? (or is the potential non-official packager perhaps lagging behind the official release) Perhaps you can dig further into GitHub and get the information, but it's not blatantly obvious at a glance.

deleted 5y ago

[deleted]

charcircuit 5y ago

>You can’t go round claiming to be Microsoft and then add a disclaimer in the notes field that you’re not actually Microsoft The developer_name element is for the developer of the application that is being packaged. It is not the name of the maintainer of the flatpak. >The <developer_name/> tag is designed to represent the developers or project responsible for development of the project described in the metadata. https://www.freedesktop.org/software/appstream/docs/chap-Metadata.html#tag-developer_name https://www.freedesktop.org/software/appstream/docs/chap-Met...

jahewson 5y ago
It may be designed that way but in practice it’s misleading, especially the way it appears in the UI. It looks like a designation of origin of the package. These are trademarks and can’t just be thrown around casually. Why is there not at least a packager or maintainer field?
- charcircuit 5y ago
  >Why is there not at least a packager or maintainer field? On flathub the developer is the developer of the software being published and the publisher is the people who packaged it.
  - jahewson 5y ago
    Interesting. Where can I find the publisher field?
    - charcircuit 5y ago
      Click on an application on https://flathub.org/home https://flathub.org/home and ctrl + f
      - JaggedJax 5y ago
        This does not help much without doing further digging. I checked the "Steam" package and for me in Flathub I see a link to "See Details" for the publisher. Clicking on that takes me to the contributors page of their Flathub GitHub repo. Am I supposed to know if these are employees of the company or not? I am on mobile, so maybe there's more info on desktop? I see nothing indicating if this is official or not, other than a note at the bottom of the flathub description telling me it is not official, which seems strange for that to be the only place indicating that.

3np 5y ago

From TFA: > Needless to say, this most likely an oversight so I have not concluded that this was intentional, yet I don't see a point of disagreement. Developer != flatpak maintainer. Putting themselves there would rightly have them called out for misappropriation.

jahewson 5y ago
Indeed. I think this reveals a deeper problem with flatpack packaging conventions. The package maintainer is a vital piece of missing metadata.
- iotku 5y ago
  This is one of my bigger issues with Flathub that still keeps me uncomfortable. I've been adopting flatpaks a fair bit lately but something doesn't sit right that there's not an obvious way (At least in most front ends) to know: 1) Who the packager is. 2) Is the flatpak officially sanctioned by the developer of the software? 2.5) If not, how do I know that it was packaged correctly? Was the build from a clean source? 3) Is it really the latest version? (or is the potential non-official packager perhaps lagging behind the official release) Perhaps you can dig further into GitHub and get the information, but it's not blatantly obvious at a glance.