5 ms·

Flatpaks unlike Snaps are actually sandboxed properly.

seabass-labrax 3y ago
Just being sandboxed though isn't a help if you actively want the software to process sensitive data! If you want to read a private document in LibreOffice, you have to be sure your copy of LibreOffice and every library it calls is trustworthy and reasonably secure.
- yjftsjthsd-h 3y ago
  I dunno, if it's sandboxed and doesn't have network access then the only attacks I can think of are either really indirect (embedding an attack in saved files in hopes of hitting another user) or really targeted (altering a specific document or phrase when it's read). Assuming the sandbox works and includes blocking of network access, what attack do you see a word processor performing even when handed sensitive data?
  - bluGill 3y ago
    Most word processors have some web abilities. Click and link and the web browser opens. That link can be custom crafted to send data.
  - iudqnolq 3y ago
    Suppose your word processor is allowed to write to arbitrary files in your home directory. It writes a line into your .profile that CURLs your sensitive data to it's server. This has a level of indirection, but that just delays things until the next login. With a little more work there are infinite other places you could inject that might run sooner.
    - yjftsjthsd-h 3y ago
      > Suppose your word processor is allowed to write to arbitrary files in your home directory. It writes a line into your .profile that CURLs your sensitive data to it's server. Yeah, that's like the poster child of sandboxing; I am very much supposing that my word processor is not allowed to touch arbitrary files.
  - bandrami 3y ago
    You're ignoring the supply chain side. RHEL RPMs are signed by Red Hat. Flatpaks are signed by... whoever happens to maintain that flatpak.
    - yjftsjthsd-h 3y ago
      Er, yes? I am ignoring the supply chain, because I'm commenting on the sandboxing, which is separate from who's publishing the software. (The only connection I see is that whoever publishes the flatpak is responsible for setting the default sandboxing config, which is important but I don't know how else you'd do it. But then RPMs aren't sandboxed at all, so what does it matter who signs it? We're talking about sandboxing here.)
      - bandrami 3y ago
        I dont care about sandboxing though; the valuable data is what the apps themselves are handling so it doesn't help. But at any rate the multiple runtimes with multiple upstreams are why it's a non-starter from a security PoV; the uselessness of sandboxing is more just icing.
bandrami 3y ago
I literally don't care about sandboxing. The data the apps themselves handle is the only thing valuable; protecting the rest of the system is pointless since I can reimage essentially for free at any point.
- bandrami 3y ago
  If malicious software takes over my browser it can steal my identity, wreck my finances, and ruin all my business and personal relationships. The fact that it can't add a printer is interesting but not really at the same level of concern.
  - fsflover 3y ago
    I'm using separate browsers in separate VMs for banking, business and personal things. And it's all with a great UX on Qubes OS.
lvass 3y ago
Full or no filesystem access is very, very far from proper sandboxing.
- nerdponx 3y ago
  As far as I know, Flatpak offers a fair amount of control over sandboxing. It's just that isn't particularly useful for some thing like a document processing application that you usually want to be able to use on files in various parts of your system. The alternative might be giving it access to one particular directories, and then copying files there when you want to work on them. But that's already pretty cumbersome, something only the paranoid would bother with. Realistically, I know that I do not have the skills to evaluate complicated applications and their complicated dependencies for security characteristics, so I am 100% reliant on packagers, maintainers, etc. for my security anyway. I'd rather just donate to the people publishing and maintaining the packages and hope that they are doing the job well, than fruitlessly attempt to fuss over it myself.
  - orra 3y ago
    > It's just that isn't particularly useful for some thing like a document processing application that you usually want to be able to use on files in various parts of your syste The good news is there is a solution to this. The trusted system shows a file picker, and then grants access to the sandboxes application. This is called the File Chooser Portal. https://docs.flatpak.org/en/latest/portal-api-reference.html#gdbus-org.freedesktop.portal.FileChooser https://docs.flatpak.org/en/latest/portal-api-reference.html...
    - nerdponx 3y ago
      I didn't realize this existed, it seems a lot like what Apple is doing for the photo gallery in recent iOS versions. That's a nice extra safety feature. I suppose additional security features inspired by mobile systems couldn't hurt either. Like a pop-up whenever something accesses the clipboard.
      - 3y ago

Just being sandboxed though isn't a help if you actively want the software to process sensitive data! If you want to read a private document in LibreOffice, you have to be sure your copy of LibreOffice and every library it calls is trustworthy and reasonably secure.

yjftsjthsd-h 3y ago
I dunno, if it's sandboxed and doesn't have network access then the only attacks I can think of are either really indirect (embedding an attack in saved files in hopes of hitting another user) or really targeted (altering a specific document or phrase when it's read). Assuming the sandbox works and includes blocking of network access, what attack do you see a word processor performing even when handed sensitive data?
- bluGill 3y ago
  Most word processors have some web abilities. Click and link and the web browser opens. That link can be custom crafted to send data.
- iudqnolq 3y ago
  Suppose your word processor is allowed to write to arbitrary files in your home directory. It writes a line into your .profile that CURLs your sensitive data to it's server. This has a level of indirection, but that just delays things until the next login. With a little more work there are infinite other places you could inject that might run sooner.
  - yjftsjthsd-h 3y ago
    > Suppose your word processor is allowed to write to arbitrary files in your home directory. It writes a line into your .profile that CURLs your sensitive data to it's server. Yeah, that's like the poster child of sandboxing; I am very much supposing that my word processor is not allowed to touch arbitrary files.
- bandrami 3y ago
  You're ignoring the supply chain side. RHEL RPMs are signed by Red Hat. Flatpaks are signed by... whoever happens to maintain that flatpak.
  - yjftsjthsd-h 3y ago
    Er, yes? I am ignoring the supply chain, because I'm commenting on the sandboxing, which is separate from who's publishing the software. (The only connection I see is that whoever publishes the flatpak is responsible for setting the default sandboxing config, which is important but I don't know how else you'd do it. But then RPMs aren't sandboxed at all, so what does it matter who signs it? We're talking about sandboxing here.)
    - bandrami 3y ago
      I dont care about sandboxing though; the valuable data is what the apps themselves are handling so it doesn't help. But at any rate the multiple runtimes with multiple upstreams are why it's a non-starter from a security PoV; the uselessness of sandboxing is more just icing.

bandrami 3y ago

I literally don't care about sandboxing. The data the apps themselves handle is the only thing valuable; protecting the rest of the system is pointless since I can reimage essentially for free at any point.

bandrami 3y ago
If malicious software takes over my browser it can steal my identity, wreck my finances, and ruin all my business and personal relationships. The fact that it can't add a printer is interesting but not really at the same level of concern.
- fsflover 3y ago
  I'm using separate browsers in separate VMs for banking, business and personal things. And it's all with a great UX on Qubes OS.

lvass 3y ago

Full or no filesystem access is very, very far from proper sandboxing.

nerdponx 3y ago
As far as I know, Flatpak offers a fair amount of control over sandboxing. It's just that isn't particularly useful for some thing like a document processing application that you usually want to be able to use on files in various parts of your system. The alternative might be giving it access to one particular directories, and then copying files there when you want to work on them. But that's already pretty cumbersome, something only the paranoid would bother with. Realistically, I know that I do not have the skills to evaluate complicated applications and their complicated dependencies for security characteristics, so I am 100% reliant on packagers, maintainers, etc. for my security anyway. I'd rather just donate to the people publishing and maintaining the packages and hope that they are doing the job well, than fruitlessly attempt to fuss over it myself.
- orra 3y ago
  > It's just that isn't particularly useful for some thing like a document processing application that you usually want to be able to use on files in various parts of your syste The good news is there is a solution to this. The trusted system shows a file picker, and then grants access to the sandboxes application. This is called the File Chooser Portal. https://docs.flatpak.org/en/latest/portal-api-reference.html#gdbus-org.freedesktop.portal.FileChooser https://docs.flatpak.org/en/latest/portal-api-reference.html...
  - nerdponx 3y ago
    I didn't realize this existed, it seems a lot like what Apple is doing for the photo gallery in recent iOS versions. That's a nice extra safety feature. I suppose additional security features inspired by mobile systems couldn't hurt either. Like a pop-up whenever something accesses the clipboard.
    - 3y ago