5 ms·

Doesn't matter, Flatpak won over Appimages and Snaps in adoption numbers. And the example given here for GIMP having r/w permission to your home doesn't hold w

Doesn't matter, Flatpak won over Appimages and Snaps in adoption numbers. And the example given here for GIMP having r/w permission to your home doesn't hold water. The distro-packaged app probably has the same permissions in comparison. At least with Flatpak, to deny it this permission is a simple toggle with Flatseal.

deleted 3y ago
[deleted]
prmoustache 3y ago
The point is the proponent raise the security flag like it is a huge advantage and you could trust anything coming from flathub while it is mostly pixie dusk. Untrustable apps aren't more trustable because they are delivered as flatpaks.
- Timber-6539 3y ago
  You missed my point. > The point is the proponent raise the security flag like it is a huge advantage and you could trust anything coming from flathub while it is mostly pixie dusk. Okay then, as you criticize Flatpaks give us your alternative to a trusted application. > Untrustable apps aren't more trustable because they are delivered as flatpaks. Nobody made this claim.
  - prmoustache 3y ago
    > Okay then, as you criticize Flatpaks give us your alternative to a trusted application. I am not criticizing, I am saying it is mostly a moot point. The sandboxing allow a bit of isolation but this it ranks quite poorly in term of actual security benefits for the typical end users use cases. > Nobody made this claim. Well, not the authors of flatpak, but yes some did. On medias that many people watch such as youtube videos.
    - Timber-6539 3y ago
      > The sandboxing allow a bit of isolation but this it ranks quite poorly in term of actual security benefits for the typical end users use cases. Ranked poorly in what checklist? > Well, not the authors of flatpak, but yes some did. On medias that many people watch such as youtube videos. Let's try to stay on topic. The point I made was that, the author's example about Flatpak GIMP doing something unauthorized on your system applies to any package format. The differentiating factor here is that Flatpak/Flatseal allows you to sandbox the application easily and quite effectively if I may add.
      - prmoustache 3y ago
        yes and the point I made that usually when you are using most applications that aren't fetching content from the internet, this is to work on your data, so you have to give those applications access to your data and thus if the app is malicious it can do stuff on your data. Worse is if your application needs local files and internet access, said app can exfiltrate your data, receive payload and the fact it is sandboxed to a subset of your data doesn't change a lot compared to a non sandboxed app if this is data you cannot allow to be stolen/modified/ransomwared. Sandboxing can limit a bit the attack surface / scenarios, but that's it.
padraic7a 3y ago
Did it? What adoption numbers? Number of distros? Number of applications? Ubuntu seems to dwarf other Linux distrobutions in terms of numbers of users. Are you saying more users have Flatpak installed than have Snap installed?
- Timber-6539 3y ago
  The numbers of app installs for popular software available from flathub.org but sure you can use the number of supported distros as an easy base. Including Ubuntu with a few workarounds. > Ubuntu seems to dwarf other Linux distrobutions in terms of numbers of users. I'd ask you the same thing. Based on what figures? > Are you saying more users have Flatpak installed than have Snap installed? Yes until Ubuntu's Snapcraft store provide download numbers. I can almost swear they used to provide this sometime back but can't see anything like that now.

deleted 3y ago

[deleted]

prmoustache 3y ago

The point is the proponent raise the security flag like it is a huge advantage and you could trust anything coming from flathub while it is mostly pixie dusk. Untrustable apps aren't more trustable because they are delivered as flatpaks.

Timber-6539 3y ago
You missed my point. > The point is the proponent raise the security flag like it is a huge advantage and you could trust anything coming from flathub while it is mostly pixie dusk. Okay then, as you criticize Flatpaks give us your alternative to a trusted application. > Untrustable apps aren't more trustable because they are delivered as flatpaks. Nobody made this claim.
- prmoustache 3y ago
  > Okay then, as you criticize Flatpaks give us your alternative to a trusted application. I am not criticizing, I am saying it is mostly a moot point. The sandboxing allow a bit of isolation but this it ranks quite poorly in term of actual security benefits for the typical end users use cases. > Nobody made this claim. Well, not the authors of flatpak, but yes some did. On medias that many people watch such as youtube videos.
  - Timber-6539 3y ago
    > The sandboxing allow a bit of isolation but this it ranks quite poorly in term of actual security benefits for the typical end users use cases. Ranked poorly in what checklist? > Well, not the authors of flatpak, but yes some did. On medias that many people watch such as youtube videos. Let's try to stay on topic. The point I made was that, the author's example about Flatpak GIMP doing something unauthorized on your system applies to any package format. The differentiating factor here is that Flatpak/Flatseal allows you to sandbox the application easily and quite effectively if I may add.
    - prmoustache 3y ago
      yes and the point I made that usually when you are using most applications that aren't fetching content from the internet, this is to work on your data, so you have to give those applications access to your data and thus if the app is malicious it can do stuff on your data. Worse is if your application needs local files and internet access, said app can exfiltrate your data, receive payload and the fact it is sandboxed to a subset of your data doesn't change a lot compared to a non sandboxed app if this is data you cannot allow to be stolen/modified/ransomwared. Sandboxing can limit a bit the attack surface / scenarios, but that's it.

padraic7a 3y ago

Did it? What adoption numbers? Number of distros? Number of applications? Ubuntu seems to dwarf other Linux distrobutions in terms of numbers of users. Are you saying more users have Flatpak installed than have Snap installed?

Timber-6539 3y ago
The numbers of app installs for popular software available from flathub.org but sure you can use the number of supported distros as an easy base. Including Ubuntu with a few workarounds. > Ubuntu seems to dwarf other Linux distrobutions in terms of numbers of users. I'd ask you the same thing. Based on what figures? > Are you saying more users have Flatpak installed than have Snap installed? Yes until Ubuntu's Snapcraft store provide download numbers. I can almost swear they used to provide this sometime back but can't see anything like that now.