- VLC ships with a slightly older version of ffmpeg (4.1.3) with two known CVEs:

https://github.com/flathub/org.videolan.VLC/blob/f1b27c13b13...

- MakeMKV uses an outdated ffmpeg (4.1.0), which has several known CVEs:

https://github.com/flathub/com.makemkv.MakeMKV/blob/3c44c8bc...

- Openshot uses an outdated ffmpeg (4.0.3) which has several known CVEs:

https://github.com/flathub/org.openshot.OpenShot/blob/ec2077...

This is what you get when every application ships custom dependencies, rather than having a consistent package set.

(I like the idea of Flatpak, but I think it hasn't found its optimum yet in terms of dependency management.)

So often, a distribution would be held back on an old ffmpeg (perhaps patched with some of the CVE fixes by a distro maintainer who might not be familiar with the codebase) to isolate the churn of upstream.

flatpak lets app maintainers update at their leisure, which actually gets them on a faster update cycle.

https://github.com/search?q=org%3Aflathub+%22--filesystem%3D... https://github.com/search?q=org%3Aflathub+%22--filesystem%3D...

So, many applications use it as a distribution mechanism and not so much for sandboxing. Of course, this is bound to get better over time when applications are modified to support sandboxing better and can use portals.

IMO you need both: isolation through e.g. sandboxing and timely security updates of applications and all their dependencies. Flatpak currently provides the former for some applications and the latter is completely dependent on the maintainer of the Flatpak.

If things were so easily automatically updated and maintained we wouldn't need flatpak.

One benefit is that if you have some software in the chain blocking updates others can update.

This may actually improve overall security.

I think I just argued myself out of hating flatpak. :/

Which is cool, because that os-tree switching thing sounds like btrfs snapshot hopping on steroids.

> Flatpak mostly deployed as a convenient library bundling technology early on, with the sandboxing or containerization being phased in over time for most applications.

I don't really know if sandboxing is worth it for me. Running everything inside docker cotnaienrs sounds like an absolute nightmare when it comes to troubleshooting. You might think logs and things would be well defined and put in the right place for the OS to pick up, but if things were so well behaved we wouldn't feel the need for sandboxing now would we.

https://blogs.gnome.org/mclasen/2019/07/12/settings-in-a-san...

Flatpak is one piece of a broader design to secure Linux workstations. It is also intended to work in conjunction with Wayland and the in-development Pipewire. These lock down video and audio respectively, so that shared resources can't be misused by applications.

Applications have vulnerabilities. Sandboxes help as an additional layer of security for trusted applications.

Of course, if applications are trusted and under control, a simpler mechanism like OpenBSD's pledge/unveil may be enough.

> I'm not sure why there is this push for Linux to have the "download and double click" install experience of windows / Mac.

No joke. I seriously don't see desktops running rich applications around anywhere, except the mini-computer / workstation use case.

Generally people are running a glorified thin terminal with a browser or putty connection to a dosbox app. People who actually do things on their own computers generally run laptops now. The exceptions are people who do demanding work loads, and they run workstations that can handle it--more like the mini-computer than the traditional office desktop.

There are public computer terminals in libraries and such, but the only reasons these are not laptops are theft prevention and the need for a large screen, keyboard and mouse.

Plus "putty connection to a dosbox app"? I have never heard of anyone doing that, and don't understand why they would. Or maybe you don't mean "dosbox" [1], but "console"/"terminal"?

[1] https://www.dosbox.com

The exception is things like receptionists, or other areas where multiple employees share a common terminal. But as mentioned before, those computers are basically used as stationary, large-screen browsers or thin clients for cloud applications. Email? Excel? It's been a decade since I've seen people doing that on desktops in office environments.