It improves usability only. It also creates false perception of security. Malware already found in NPM packages, AUR packages, and other packaging systems without maintainers.

Do you not think Flatpaks (and Snaps) are more secure than curl | bash scripts?

I suspect they provide a far more consistent attack surface for exploitation. One that likely won't change for many months in the case of some proprietary vendors.

So no. I don't, but that doesn't make curlbash good either.

Is the sandboxing in Flatpack completely useless then? Any details on this?

It is a work in progress. A few packages are very secure but many have lax permissions for now.

There are big improvements coming like PipeWire, DConf sandboxing, etc but it will not happen over night.

It depends. Historically, sandboxing used to protect from takeovers, because computer time and network bandwidth was costly. But today, user information is much more valuable than computer time. Flatpack partially protects from both attacks on system and on user data, but this protection is not perfect. We should expect that Flatpack protection is (or will be) on par with Android anit-malware protection.

Not the person you're replying to by you're intentionally being obtuse to try and prove a point he never argued.

v_lisivka never mentioned sandboxing as an issue. They were clearly talking about the fact it's a free for all user submitted repo which have a provable history of people adding malware.

The comparison above was vendor-provided install scripts.

From my understanding, Flatpak provides sandboxing and asks the user to confirm exceptions, which if it works reliably does seem like I win something security-wise going from "go to vendor website, use their installation script" to "go to vendor website, get their flatpak thing, know that it can't totally screw my system without me granting it exceptions".

Parent claims it's only a usability benefit, so I'd like to know details about the problems with its sandboxing (totally willing to accept that they exist, sandboxing is tricky and not a cure-all)

You're overly aggressive in your reply, GP just asked a legitimate question.

> That software is not currently being installed with a package manager - it is the curl | bash scripts you see all the time,

On Mac.

This is mostly a sovled problem on Linux. Hell even slackware has this mostly solved.

I will concede there is a lot of Linux users out there either misinformed or simply don't mind the hassle of upgrading via random curl scripts if at all.

Maybe it will help them? Maybe it will just increase the target size making exploitation more worthwhile / likely?

Who knows.

For me, if it's not in the Arch repos (or aur) I'm incredibly unlikely to install it, to the point I don't actually have any software installed out of band other than stuff I specifically work on.