Re:Comparing LibreOffice Versions: AppImage, Flatpak, and Snap
by rlpb on Friday June 14, 2019 @07:18AM
(#20182047)
> That's likely to happen after apt did its job.
When looking at this aspect, I think it's important to remember that users can often conflate apt-from-the-distribution with apt-from-a-third-party-repository.
What you've said is true if a user is using a distribution-provided package using apt.
If the user has installed from a third party repository using apt, and that repository has bumped the version of a library because it needs a newer version (this is quite common), then the user is dependent on the third party author to fix the library for security, just the same as a flatpak or snap.
However, in the case of the snap (not sure about the flatpak), at least the impact of an insecure library is limited to within the sandbox. Third party apt repositories do not benefit from any sandbox.
This is perhaps obvious to you, but I think it is misleading to users in general to not separate the two cases. "apt is great for security because you don't have to wait for the upstream author" is not true for third party repositories.
When looking at this aspect, I think it's important to remember that users can often conflate apt-from-the-distribution with apt-from-a-third-party-repository.
What you've said is true if a user is using a distribution-provided package using apt.
If the user has installed from a third party repository using apt, and that repository has bumped the version of a library because it needs a newer version (this is quite common), then the user is dependent on the third party author to fix the library for security, just the same as a flatpak or snap.
However, in the case of the snap (not sure about the flatpak), at least the impact of an insecure library is limited to within the sandbox. Third party apt repositories do not benefit from any sandbox.
This is perhaps obvious to you, but I think it is misleading to users in general to not separate the two cases. "apt is great for security because you don't have to wait for the upstream author" is not true for third party repositories.