3 ms·

> Nobody ever even audits the binary contents of flatpaks on flathub (were they actually built from the source? the author attests so!). IME/IIRC There aren't

> Nobody ever even audits the binary contents of flatpaks on flathub (were they actually built from the source? the author attests so!). IME/IIRC There aren't (or shouldn't be) any binary contents on Flathub that are submitted by the author, at least for projects with source available? You're supposed to submit a short, plain-text recipe instead, which then gets automatically built from source outside the control of the author. > The Flathub service then uses the manifest from your repository to continuously build and distribute your application on every commit. https://docs.flathub.org/docs/for-app-authors/submission/#how-to-submit-an-app https://docs.flathub.org/docs/for-app-authors/submission/#ho... Usually the recipes should just list the appropriate Git-based URLs to get the source code, or, for proprietary applications, the official .DEBs. Kinda like AUR, but JSON/YAML. Easy to audit if you want: https://github.com/orgs/flathub/repositories https://github.com/orgs/flathub/repositories Plus, if properly configured, Flatpak is supposed to securely sandbox every application anyway, although other systems it needs to be compatible with (E.G. X11) currently prevent that.

bandrami 3y ago
I agree there shouldn't be, and it would be fairly easy to check in the json file that it actually does what it "should" do in the build and nothing else, but have you ever actually checked? The only time I've ever even looked was when I wanted to change a build option for some reason, and that's not often. And then the frequent use of git submodules makes it even worse: that's often a whole lot of code that even the author of the flatpak doesn't have control over.
- Intralexical 3y ago
  Hm. You're right. I haven't. And I guess the entire problem is that we shouldn't just assume somebody else has. The JSON manifest is a much smaller attack surface than uploading random binaries would be though. And the standardized build procedure should make it relatively easy to tell if something's out of the ordinary and should be raising eyebrows, or even automate much of it. Maybe stick an `alias CheckFlatHub=` for a LLM prompt, or just some plain regexes, in `.bashrc`? Looking for fishing URLs and install commands sounds like a relatively simple problem, as far as security challenges go.

bandrami 3y ago

I agree there shouldn't be, and it would be fairly easy to check in the json file that it actually does what it "should" do in the build and nothing else, but have you ever actually checked? The only time I've ever even looked was when I wanted to change a build option for some reason, and that's not often. And then the frequent use of git submodules makes it even worse: that's often a whole lot of code that even the author of the flatpak doesn't have control over.

Intralexical 3y ago
Hm. You're right. I haven't. And I guess the entire problem is that we shouldn't just assume somebody else has. The JSON manifest is a much smaller attack surface than uploading random binaries would be though. And the standardized build procedure should make it relatively easy to tell if something's out of the ordinary and should be raising eyebrows, or even automate much of it. Maybe stick an `alias CheckFlatHub=` for a LLM prompt, or just some plain regexes, in `.bashrc`? Looking for fishing URLs and install commands sounds like a relatively simple problem, as far as security challenges go.