5 ms·

Linux Mint Disabling Unverified Flatpaks by Default

39 points by mikece 2y ago

Kalanos 2y ago
Wow, this include VS Code https://flathub.org/apps/com.visualstudio.code https://flathub.org/apps/com.visualstudio.code
- pojntfx 2y ago
  Yeah, Microsoft doesn't really support Flatpak. VSCodium is verified though and there isn't really any reason to use the proprietary VSCode anymore these days: https://flathub.org/apps/com.vscodium.codium https://flathub.org/apps/com.vscodium.codium
  - resoluteteeth 2y ago
    > there isn't really any reason to use the proprietary VSCode anymore these days There is if you want to use some of Microsoft's extensions legally
    - somerandomqaguy 2y ago
      Do you know if there an easy way to identify which extensions are tied into VSCode itself vs a third party build? Or is it just install and try?
    - undefined9059 2y ago
      legally. lol. You are not allowed to ship the extensions outside of Microsofts control. But nothing stops you from downloading the extension from the marketplace and installing them manually. Or just use the registry anyway. Who's gonna check it?
- Kalanos 2y ago
  VSCodium is verified though https://flathub.org/apps/com.vscodium.codium https://flathub.org/apps/com.vscodium.codium
  - mort96 2y ago
    I wish VSCodium was a viable alternative, but the sheer amount of unsupported first party plug-ins makes it a no-go. License issues prevents the C and C++ integration from working, remote editing is a halfway working unsupported hack which breaks with editor upgrades. At least that was my experience when I tried to switch to a "modern" GUI editor. In the end I just stuck with neovim; it seems more reliable and has better working C/C++ integration and remote editing.
    - elashri 2y ago
      The C/C++ extension is open source with MIT license but the shipped extension binary contains MS proprietary binaries that is not as open [1]. I am not sure what will be the difference between using MS official build and compiling the source (there will be some for sure). [1] https://github.com/microsoft/vscode-cpptools/blob/main/LICENSE.md https://github.com/microsoft/vscode-cpptools/blob/main/LICEN...
    - arcanemachiner 2y ago
      Same. Not being able to use the SSH plugin made VSCode DOA for me when I tried it a while back.
mouse_ 2y ago
Alright kids, time to place our bets. How long will this last?
- MR4D 2y ago
  It’s literally a check box that is unchecked by default, so my guess is this will stick. Good question though, given all the security theatre in the world today.
bitmasher9 2y ago
This feels like a no brainer, why hasn’t this always been the default?
adhamsalama 2y ago
Good decision.
tapoxi 2y ago
I really wish we'd see more developers support and verify their apps. Steam, Signal, Chrome, etc. It's probably the most popular way to ship desktop apps on Linux at this point.
Am4TIfIsER0ppos 2y ago
What does "verified" mean in this?
deleted 2y ago
[deleted]
danirod 2y ago
I think that other stores and social platforms are making the word "verification" gain a bad reputation, due to the bureucracy and fees, and it is not the case here. Verifying an app on Flathub is a simple and open process that only requires to upload a file into the .well-known tree of the developer website: https://docs.flathub.org/docs/for-app-authors/verification https://docs.flathub.org/docs/for-app-authors/verification At the same time, I think that the verification mark does not work as some people may expect. Flatpak has become a popular way to sandbox privative apps that are non-free Electron dumb frontends that interact with a cloud SaaS. Discord is a verified Flathub application and it probably sends information about the computer such as the list of process as part of their telemetry. The point is that this verification process will prevent running apps that have been packaged without the knowledge of the original developer (someone packaging malicious code inside existing apps and deploying them to Flathub), but it will NOT prevent running apps that have additional surprises placed by the original developers in first place.
vondur 2y ago
It seems like many of the big apps hosted in Flathub aren't official (Google Chrome, Steam, VS Code)

39 points by mikece 2y ago

Kalanos 2y ago

Wow, this include VS Code https://flathub.org/apps/com.visualstudio.code https://flathub.org/apps/com.visualstudio.code

pojntfx 2y ago
Yeah, Microsoft doesn't really support Flatpak. VSCodium is verified though and there isn't really any reason to use the proprietary VSCode anymore these days: https://flathub.org/apps/com.vscodium.codium https://flathub.org/apps/com.vscodium.codium
- resoluteteeth 2y ago
  > there isn't really any reason to use the proprietary VSCode anymore these days There is if you want to use some of Microsoft's extensions legally
  - somerandomqaguy 2y ago
    Do you know if there an easy way to identify which extensions are tied into VSCode itself vs a third party build? Or is it just install and try?
  - undefined9059 2y ago
    legally. lol. You are not allowed to ship the extensions outside of Microsofts control. But nothing stops you from downloading the extension from the marketplace and installing them manually. Or just use the registry anyway. Who's gonna check it?
Kalanos 2y ago
VSCodium is verified though https://flathub.org/apps/com.vscodium.codium https://flathub.org/apps/com.vscodium.codium
- mort96 2y ago
  I wish VSCodium was a viable alternative, but the sheer amount of unsupported first party plug-ins makes it a no-go. License issues prevents the C and C++ integration from working, remote editing is a halfway working unsupported hack which breaks with editor upgrades. At least that was my experience when I tried to switch to a "modern" GUI editor. In the end I just stuck with neovim; it seems more reliable and has better working C/C++ integration and remote editing.
  - elashri 2y ago
    The C/C++ extension is open source with MIT license but the shipped extension binary contains MS proprietary binaries that is not as open [1]. I am not sure what will be the difference between using MS official build and compiling the source (there will be some for sure). [1] https://github.com/microsoft/vscode-cpptools/blob/main/LICENSE.md https://github.com/microsoft/vscode-cpptools/blob/main/LICEN...
  - arcanemachiner 2y ago
    Same. Not being able to use the SSH plugin made VSCode DOA for me when I tried it a while back.

mouse_ 2y ago

Alright kids, time to place our bets. How long will this last?

MR4D 2y ago
It’s literally a check box that is unchecked by default, so my guess is this will stick. Good question though, given all the security theatre in the world today.

bitmasher9 2y ago

This feels like a no brainer, why hasn’t this always been the default?

adhamsalama 2y ago

Good decision.

tapoxi 2y ago

I really wish we'd see more developers support and verify their apps. Steam, Signal, Chrome, etc. It's probably the most popular way to ship desktop apps on Linux at this point.

Am4TIfIsER0ppos 2y ago

What does "verified" mean in this?

deleted 2y ago

[deleted]

danirod 2y ago

I think that other stores and social platforms are making the word "verification" gain a bad reputation, due to the bureucracy and fees, and it is not the case here. Verifying an app on Flathub is a simple and open process that only requires to upload a file into the .well-known tree of the developer website: https://docs.flathub.org/docs/for-app-authors/verification https://docs.flathub.org/docs/for-app-authors/verification At the same time, I think that the verification mark does not work as some people may expect. Flatpak has become a popular way to sandbox privative apps that are non-free Electron dumb frontends that interact with a cloud SaaS. Discord is a verified Flathub application and it probably sends information about the computer such as the list of process as part of their telemetry. The point is that this verification process will prevent running apps that have been packaged without the knowledge of the original developer (someone packaging malicious code inside existing apps and deploying them to Flathub), but it will NOT prevent running apps that have additional surprises placed by the original developers in first place.

vondur 2y ago

It seems like many of the big apps hosted in Flathub aren't official (Google Chrome, Steam, VS Code)