You will most likely get a malicious AppImage from some website because there is no default central store with such packages.

You could argue that there is a freedom with AppImage that you are not bound to a Store. But that would not be correct, because you can self-host both snaps and flatpaks, if you really need to.

With snaps, you have more fine-grained security privileges. For example, "httpstat" [1] is a network utility to benchmark the access to a website. As a utility, it only requires access to the network. With snaps, the packager can only permit access to the network, and no access at all to the user's files or anything else.

1. https://github.com/davecheney/httpstat

"You will most likely get a malicious AppImage from some website because there is no default central store with such packages." - No. Just no. If you download the AppImage directly from its original author's website, then you know that no one has tampered with it and it is exactly as the original author intended. In contrast, look at Flathub. Most applications there are not provided by their original authors, but by "random guys". Who do you trust more?

> is no default central store with such packages

And this is limitation of Snap and Flatpack - both stored in centralized stores.

AppImage is fully independent from any centralized stores, so developers could distribute own apps as AppImage-package directly to users.

Snap is centralized; anybody can host their own Flatpak repo, it's just files served over HTTP.

https://blogs.gnome.org/alexl/2017/02/10/maintaining-a-flatp...

I said that there is no "default" central store for package in AppImage. Which means that there is a "default" central store for snaps and flatpaks.

And if you do not like the "default" central store, you are free to distribute yourself the individual snap or flatpak package. Just like with AppImage.

Sure... by making the user setup the equivalent of a PPA. AppImage's advantage is that you can mail it to them on a CD and they can just run it from the CD.

Damned if you do, damned if you don't.

Regarding the reference to "like mounting the CD ISO" for AppImage. All three of them actually mount one or more filesystems in order to install the package.

This is probably not the kind of trust you're asking about, but you should also mind about security

When apt updates libxyz.so and fix some vulnerability (think of exploits for JPEG decoding libraries) you have to wait for the authors of the appimage, flatpack and snap to distribute a new version with the update. That's likely to happen after apt did its job. You'll be vulnerable for a longer time.

I confess that I don't know if those other formats autoupdate like apt does or it's a manual user operation. In the latter case, you might be vulnerable for a long time. So, which one you can trust most? The one that autoupdates, if any.

> That's likely to happen after apt did its job.

When looking at this aspect, I think it's important to remember that users can often conflate apt-from-the-distribution with apt-from-a-third-party-repository.

What you've said is true if a user is using a distribution-provided package using apt.

If the user has installed from a third party repository using apt, and that repository has bumped the version of a library because it needs a newer version (this is quite common), then the user is dependent on the third party author to fix the library for security, just the same as a flatpak or snap.

However, in the case of the snap (not sure about the flatpak), at least the impact of an insecure library is limited to within the sandbox. Third party apt repositories do not benefit from any sandbox.

This is perhaps obvious to you, but I think it is misleading to users in general to not separate the two cases. "apt is great for security because you don't have to wait for the upstream author" is not true for third party repositories.

> I confess that I don't know if those other formats autoupdate like apt does or it's a manual user operation.

For Flatpak the updates are automatic, at least on the version I'm using with Debian Buster.

In my opinion they care enough about vulnerabilities (but I would say it depends on the packager), currently the Flatpak Evince doesn't have support for PS files (so for now only PDF) for security reasons (I don't recall the details, it's about the Ghostscript interpreter, there's an open issue on the BTS).

Edit: the issue https://gitlab.gnome.org/GNOME/evince/issues/1058

It's a question who you trust, not a question of the format. Personally, I would only run applications from original authors or projects I trust, and only directly from their download page. Not from some random 3rd party download site or app store. AppImage allows me to do that, with no 3rd party in between the author and me.

IMHO, you should trust AppImage - as it fully portable (if you would not integrate it in your system manually), like mounted ISO-images.