3 ms·

Now hold on a minute. I'm reading the Codeberg posts, and I think Neowin is getting it wrong. The LoucheBear person seems to be saying that their ClamAV scan is

Now hold on a minute. I'm reading the Codeberg posts, and I think Neowin is getting it wrong. The LoucheBear person seems to be saying that their ClamAV scan is clean without Kapitano, but not clean with Kapitano. Anyone want to grab the flatpak quick, just to see if somehow some malware hitched a ride? Anyway, if I'm reading this right, then these two people are just talking past one another, not understanding what the other is talking about. Off-topic: It's absolutely mad from a security perspective that you can't download flatpaks as a simple bzip file for security analysis.

red-iron-pine 1y ago
> Off-topic: It's absolutely mad from a security perspective that you can't download flatpaks as a simple bzip file for security analysis. You can download Flatpak bundles: Flatpak supports exporting apps as .flatpak bundle files, which are single-file archives that can be analyzed offline. These can be created using flatpak build-bundle or downloaded if the distributor provides them. If...
- phendrenad2 1y ago
  From a security perspective, I don't trust the binary that downloads and installs a package to just download it. Some package installers, such as Bundler, like to run arbitrary code from the package on install. I don't trust that to not be invoked with a simple download. I'd rather use hardened tools like CURL or a web browser. It's just good security hygiene.