5 ms·

The point of picking a Linux distribution is buying into a package management scheme. If you want to pick the “flatpak” distro fine, but I’m sticking with apt o

The point of picking a Linux distribution is buying into a package management scheme. If you want to pick the “flatpak” distro fine, but I’m sticking with apt or nix

Spivak 5y ago
This purposely ignores that Flatpak is designed to be hosted on existing distros like pip, gem, docker, nix, guix, snap, etc. etc.
johnny22 5y ago
that's "one point" of picking a distribution. Another is cadence, and trust in the people who make it. There are also the organization considerations. Debian has both the Debian Constitution and the Debian Social Contract. Those aren't things every distro has. (These aren't the only other points, just ones off the top of my head)
lokedhs 5y ago
Flatpak is the only packaging system that takes even a tiny step towards trying to give you some kind of security. When installing software using any other packaging system you have no isolation what so ever. The software is able to help to do anything on the system as root (because the installer script runs as root). Not even Nix, which is supposed to give you some kind of reproducibility helps. I personally don't trust every single software developer with the integrity of my entire computing environment. I want the code I run to be isolated and only be able to access the things they are supposed to be able to access. Now, there are valid concerns that Flatpak doesn't provide enough isolation, and that it's never really clear what rights a given package actually has, forcing you to use Flatseal to manually configure the rights for packages. However, no other packaging system does anything to address the terrible security situation on Linux, so there is really no other alternative. Well, there is one alternative which I generally recommend people to use which is Qubes OS, but it takes quite a bit of discipline to use it correctly, so it's not practical for all users.
- mindwok 5y ago
  It’s more nuanced than that. Most of the major distributions provide the packages and hence the install scripts (the part which runs as root) and if you don’t trust them then you shouldn’t be running their Linux distribution. Once most software is installed it will run unprivileged, and in most cases will be even further restricted by selinux, app armour, and/or systemd.
  - lokedhs 5y ago
    Unprivileged doesn't really mean anything. Since pretty much everything sensitive is running as a single user, having root doesn't really give much much that you couldn't already do as the user. You're right that apparmour can help, but getting good profiles for the software you use is not easy, and I'd say less available than Flatpak.
- sofixa 5y ago
  > Flatpak is the only packaging system that takes even a tiny step towards trying to give you some kind of security. Is it anything more than a false pretense at security? Having a "sandbox" which most apps don't use ( usually for good reason), and not giving the users an easy way to check if the app they're installing uses the sandbox.. what's the point of that sandbox then? It's just security theater. https://flatkill.org/2020/ https://flatkill.org/2020/
  - lokedhs 5y ago
    That site always tends to come up when people want to complain about Flatpak, and it's been mentioned multiple times on this site. Check the previous posts to see well formed responses to the nonsensical claims made on that site. I (nor anyone else that I've seen supporting Flatpak) has ever claimed it's a perfect solution. If you want something closer to being perfect, you need to use Qubes OS. However, no other solution even seem to try to provide a solution for isolation on Linux. If I want to run a program without habing to trust it with access to my $HOME/.ssh directory, what is my alternative?
    - 5y ago
Barrin92 5y ago
>The point of picking a Linux distribution Given that there's no mutual exclusivity to running flatpaks and running distro based software I don't see why there's a need to stick to anything. You're not losing anything by also adopting flatpaks. Do you also not compile your own software as to not incur the wrath of the package maintainers? It's Linux, you can install software however you want
grey_earthling 5y ago
-- the Flathub distro. Distros can and do have their own flatpak repositories, notably Fedora and elementaryOS. There are also third party apt repositories, maintained by someone other than a distro. In this respect, apt and flatpak work exactly the same way.

The point of picking a Linux distribution is buying into a package management scheme. If you want to pick the “flatpak” distro fine, but I’m sticking with apt or nix

Spivak 5y ago

This purposely ignores that Flatpak is designed to be hosted on existing distros like pip, gem, docker, nix, guix, snap, etc. etc.

johnny22 5y ago

that's "one point" of picking a distribution. Another is cadence, and trust in the people who make it. There are also the organization considerations. Debian has both the Debian Constitution and the Debian Social Contract. Those aren't things every distro has. (These aren't the only other points, just ones off the top of my head)

lokedhs 5y ago

Flatpak is the only packaging system that takes even a tiny step towards trying to give you some kind of security. When installing software using any other packaging system you have no isolation what so ever. The software is able to help to do anything on the system as root (because the installer script runs as root). Not even Nix, which is supposed to give you some kind of reproducibility helps. I personally don't trust every single software developer with the integrity of my entire computing environment. I want the code I run to be isolated and only be able to access the things they are supposed to be able to access. Now, there are valid concerns that Flatpak doesn't provide enough isolation, and that it's never really clear what rights a given package actually has, forcing you to use Flatseal to manually configure the rights for packages. However, no other packaging system does anything to address the terrible security situation on Linux, so there is really no other alternative. Well, there is one alternative which I generally recommend people to use which is Qubes OS, but it takes quite a bit of discipline to use it correctly, so it's not practical for all users.

mindwok 5y ago
It’s more nuanced than that. Most of the major distributions provide the packages and hence the install scripts (the part which runs as root) and if you don’t trust them then you shouldn’t be running their Linux distribution. Once most software is installed it will run unprivileged, and in most cases will be even further restricted by selinux, app armour, and/or systemd.
- lokedhs 5y ago
  Unprivileged doesn't really mean anything. Since pretty much everything sensitive is running as a single user, having root doesn't really give much much that you couldn't already do as the user. You're right that apparmour can help, but getting good profiles for the software you use is not easy, and I'd say less available than Flatpak.
sofixa 5y ago
> Flatpak is the only packaging system that takes even a tiny step towards trying to give you some kind of security. Is it anything more than a false pretense at security? Having a "sandbox" which most apps don't use ( usually for good reason), and not giving the users an easy way to check if the app they're installing uses the sandbox.. what's the point of that sandbox then? It's just security theater. https://flatkill.org/2020/ https://flatkill.org/2020/
- lokedhs 5y ago
  That site always tends to come up when people want to complain about Flatpak, and it's been mentioned multiple times on this site. Check the previous posts to see well formed responses to the nonsensical claims made on that site. I (nor anyone else that I've seen supporting Flatpak) has ever claimed it's a perfect solution. If you want something closer to being perfect, you need to use Qubes OS. However, no other solution even seem to try to provide a solution for isolation on Linux. If I want to run a program without habing to trust it with access to my $HOME/.ssh directory, what is my alternative?
  - 5y ago

Barrin92 5y ago

>The point of picking a Linux distribution Given that there's no mutual exclusivity to running flatpaks and running distro based software I don't see why there's a need to stick to anything. You're not losing anything by also adopting flatpaks. Do you also not compile your own software as to not incur the wrath of the package maintainers? It's Linux, you can install software however you want

grey_earthling 5y ago

-- the Flathub distro. Distros can and do have their own flatpak repositories, notably Fedora and elementaryOS. There are also third party apt repositories, maintained by someone other than a distro. In this respect, apt and flatpak work exactly the same way.