3 ms·
flatpack for isolation is a joke. All the file duplication, none of the security. Not to mention nothing that depends on camera, screen cap, etc will ever get c
by 1oooqooq 2y ago
flatpack for isolation is a joke. All the file duplication, none of the security. Not to mention nothing that depends on camera, screen cap, etc will ever get close to working.
Just accepting there's no easy solution, and do aparmour+firejail. It's awful user experience, but at least only once per application. Then it is perfect. There should be a distro like qubes but where everything must have either a firejail profile or a hardened systemd unit file (which is the worse designed/documented thing in the universe, taking the place of X11). That would be the ideal world.
- znpy 2y agoTo be hones I appreciate flatpak for software distribution. Afaik (correct me if I’m wrong) some degree of security is implemented through selinux (i’m on fedora).
- 1oooqooq 2y ago> implemented through selinux Yes, you are technically right, but you are wrong only in the sense that most packs either do not ship with a selinux policy or ship with some just-added-whatever policy. > I appreciate flatpak for software distribution Flatpack is for distributors. Not end users or for the benefit of the end system running them. There are already too much written about this. The lax state of selinux policies is also a result of this focus. PS: you will see my top comment get downvoted by the distributors who enjoy to offload the burden to end users, without offering any counter argument.
- Vilian 2y ago"Let's blame flatpak for softwares that don't support it"
- 1oooqooq 2y agobest argument I've heard against my points so far. but still, since the other solutions require the same amount of work for isolation, the only real benefit of flatpak is bundling soon-to-be-outdate dependencies.