3 ms·

Apps that are published by their developers themselves can verify to get a blue checkmark. E.g. https://flathub.org/apps/org.mozilla.firefox https://flathub.or

• smallerfish 3y ago
  > Apps that are published by their developers themselves can verify to get a blue checkmark. OK great. Why don't apps that are published by third parties get a giant red exclamation mark? If you read all the way through this thread, you'll see a very feasible supply chain attack on BitWarden. For FlatHub to have a credible security posture, they need to do something like very clearly identifying third party packaging as "experimental" or "dangerous". This has been a known issue for years, and yet they appear to be taking a "our volunteers are nice people, thanks community" collective shrug. FWIW the website isn't everything, since a) you can install from the CLI without viewing the website[0], and b) there are third party tools like KDE's Discover which quietly integrate with FlatHub. My father would never understand the difference between FlatHub, Snap, and the Canonical deb repositories, even if I explained 50 times - and yet he's been a happy KDE user for 15 years. How is he supposed to know that he's no longer necessarily accepting properly audited software when he clicks the "update" button? [0]: > flatpak install bitwarden Looking for matches… Found ref ‘app/com.bitwarden.desktop/x86_64/stable’ in remote ‘flathub’ (system). Use this ref? [Y/n]: y Required runtime for com.bitwarden.desktop/x86_64/stable (runtime/org.freedesktop.Platform/x86_64/23.08) found in remote flathub Do you want to install it? [Y/n]: y
  • nani8ot 3y ago
    I don't believe third parties maintainers packaging software on flathub is a big issue but I'm also not familiar with how other distro repos trust their maintainers. Hopefully more developers maintain their flatpak themselves (or someone they trust) and get their apps verified. If most apps are verified, warning users of unverified apps might be a good idea. There's ongoing discussion about splitting open source and proprietary apps in to seperate repos [1]. Additionally having seperate repos for verified and unverified apps might make it more obvious where an app comes from in the cli. But I don't know how seamlessly an app could transition between being in the third party repo and being in the official repo. Having the user quietly stop receiving updates seems like a bad idea, but automatically migrating might not be desirable either. I also think flatpaks cli interface needs some work. It is functional but far from distro package managers. Being verified is especially important for critical apps. Recently someone added malicious versions of apps to the snap store [3]. This lead to people getting their cryptocurrency stolen. [1] https://github.com/flathub/flathub/issues/691 https://github.com/flathub/flathub/issues/691 [2] https://docs.flathub.org/docs/for-app-authors/requirements https://docs.flathub.org/docs/for-app-authors/requirements [3] https://forum.snapcraft.io/t/temporary-suspension-of-automatic-snap-registration-following-security-incident/37077 https://forum.snapcraft.io/t/temporary-suspension-of-automat...