3 ms·

Flatpak – still a security nightmare – 2 years later (2020)

23 points by metadat 4y ago

rcarmo 4y ago
I still avoid using flatpak due to the lack of proper integration. Flatseal helps a lot in fixing some of those issues (at least in Fedora) but I would rather go and find an .rpm or .deb than rely on Flathub for anything but a quick test to see if I like an application.
Iolaum 4y ago
(2020) - plus this has been debunked but I haven't saved link for where it is - if someone knows please post.
- Twirrim 4y ago
  https://theevilskeleton.frama.io/2021/02/11/response-to-flatkill-org.html https://theevilskeleton.frama.io/2021/02/11/response-to-flat...
  - hedora 4y ago
    None of that debunks the 2020 article. It sounds like they kind of fixed some of the stuff a year later, but it's still largely broken. Am I missing something?
    - palata 4y ago
      Yeah, they "partially agree" for some point, and "partially disagree" for some other point. Does not sound like they "debunk".
- tardibear 4y ago
  Here's a page (2018) which defends Flatpak wrt security: https://www.omgubuntu.co.uk/2018/10/new-website-claims-flatpak-is-a-security-nightmare https://www.omgubuntu.co.uk/2018/10/new-website-claims-flatp...
deleted 4y ago
[deleted]
Twirrim 4y ago
See also.. https://news.ycombinator.com/item?id=27600511 https://news.ycombinator.com/item?id=27600511 https://news.ycombinator.com/item?id=26528404 https://news.ycombinator.com/item?id=26528404 https://news.ycombinator.com/item?id=23520603 https://news.ycombinator.com/item?id=23520603 https://news.ycombinator.com/item?id=18180017 https://news.ycombinator.com/item?id=18180017
cogman10 4y ago
What's the security profile of flatpak compared to the security profile of deb/yum/nix? That seems to be the only question for me. Like, if firefox can access my user folder, great, but what's the alternative? Running firefox in a vm?
- yjftsjthsd-h 4y ago
  > Like, if firefox can access my user folder, great, but what's the alternative? Running firefox in a vm? Firejail, bubblewrap, docker, VM.
zzo38computer 4y ago
In addition to the problems mentioned there, the sandbox capability is deficient; there does not seem to be any reasonable way to do things such as: - Dealing with non-Unicode text (including file names). - Running external user-specified programs by pipes (popen), and/or user-specified dynamic libraries. - Sandboxed X resource manager access and X toolkit intrinsics. - Because it uses systemd, all of the problems of systemd also apply. The design of D-Bus is also full of problems. I do not use a desktop environment on my computer, and I should not need one. Programs should not need to draw their own window decorations. There are other issues, too (some of which are mentioned on the web page about the security problems). GTK also has many problems. The blue "sandboxed" icon is not very good if it does not elaborate the specifics of the sandboxing (and, ideally, should allow user customization of the sandbox settings). The system should not make it difficult for programs to be used together. Unfortunately, many programs do (although I try to fix this; use of user-specified commands with popen is one thing that should help, but some things will just need much of the existing designs to be corrected or entirely replaced).
- yjftsjthsd-h 4y ago
  > Because it uses systemd, all of the problems of systemd also apply. It works on Void and Alpine, though? Are you saying that the security model is degraded there?
booonpower 4y ago
User repository with no assurance that apps are integrated properly with the framework. Applications that are packaged to just spawn on the host, that is outside the sandbox, are accepted and distributed on flathub. Its all over, but you are naturally checking every runtime and app manifest to ensure otherwise.
Buxato 4y ago
Before Flatpak I had tons also of unaudited repositories too, binaries in my home, appimages (I still have some of this) ... Flatpak have tons of things yet to improve (security ones the more worrisome), but it is a step forward from what we had before (specially if your workflow needs many apps that should be always updated).

23 points by metadat 4y ago

I still avoid using flatpak due to the lack of proper integration. Flatseal helps a lot in fixing some of those issues (at least in Fedora) but I would rather go and find an .rpm or .deb than rely on Flathub for anything but a quick test to see if I like an application.

Iolaum 4y ago

(2020) - plus this has been debunked but I haven't saved link for where it is - if someone knows please post.

Twirrim 4y ago
https://theevilskeleton.frama.io/2021/02/11/response-to-flatkill-org.html https://theevilskeleton.frama.io/2021/02/11/response-to-flat...
- hedora 4y ago
  None of that debunks the 2020 article. It sounds like they kind of fixed some of the stuff a year later, but it's still largely broken. Am I missing something?
  - palata 4y ago
    Yeah, they "partially agree" for some point, and "partially disagree" for some other point. Does not sound like they "debunk".
tardibear 4y ago
Here's a page (2018) which defends Flatpak wrt security: https://www.omgubuntu.co.uk/2018/10/new-website-claims-flatpak-is-a-security-nightmare https://www.omgubuntu.co.uk/2018/10/new-website-claims-flatp...

deleted 4y ago

[deleted]

Twirrim 4y ago

See also.. https://news.ycombinator.com/item?id=27600511 https://news.ycombinator.com/item?id=27600511 https://news.ycombinator.com/item?id=26528404 https://news.ycombinator.com/item?id=26528404 https://news.ycombinator.com/item?id=23520603 https://news.ycombinator.com/item?id=23520603 https://news.ycombinator.com/item?id=18180017 https://news.ycombinator.com/item?id=18180017

cogman10 4y ago

What's the security profile of flatpak compared to the security profile of deb/yum/nix? That seems to be the only question for me. Like, if firefox can access my user folder, great, but what's the alternative? Running firefox in a vm?

yjftsjthsd-h 4y ago
> Like, if firefox can access my user folder, great, but what's the alternative? Running firefox in a vm? Firejail, bubblewrap, docker, VM.

zzo38computer 4y ago

In addition to the problems mentioned there, the sandbox capability is deficient; there does not seem to be any reasonable way to do things such as: - Dealing with non-Unicode text (including file names). - Running external user-specified programs by pipes (popen), and/or user-specified dynamic libraries. - Sandboxed X resource manager access and X toolkit intrinsics. - Because it uses systemd, all of the problems of systemd also apply. The design of D-Bus is also full of problems. I do not use a desktop environment on my computer, and I should not need one. Programs should not need to draw their own window decorations. There are other issues, too (some of which are mentioned on the web page about the security problems). GTK also has many problems. The blue "sandboxed" icon is not very good if it does not elaborate the specifics of the sandboxing (and, ideally, should allow user customization of the sandbox settings). The system should not make it difficult for programs to be used together. Unfortunately, many programs do (although I try to fix this; use of user-specified commands with popen is one thing that should help, but some things will just need much of the existing designs to be corrected or entirely replaced).

yjftsjthsd-h 4y ago
> Because it uses systemd, all of the problems of systemd also apply. It works on Void and Alpine, though? Are you saying that the security model is degraded there?

booonpower 4y ago

User repository with no assurance that apps are integrated properly with the framework. Applications that are packaged to just spawn on the host, that is outside the sandbox, are accepted and distributed on flathub. Its all over, but you are naturally checking every runtime and app manifest to ensure otherwise.

Buxato 4y ago

Before Flatpak I had tons also of unaudited repositories too, binaries in my home, appimages (I still have some of this) ... Flatpak have tons of things yet to improve (security ones the more worrisome), but it is a step forward from what we had before (specially if your workflow needs many apps that should be always updated).