News for hackers. Stuff that matters.
Re:Flatpak: A security nightmare – two years later by waheoo on Friday October 02, 2020 @11:04AM (#24663377)
> Instead, providing a cross distribution consistent installation experience is the main goal.

Who is asking this exactly?

As an arch user and technically a fedora, Gentoo, slackware, Ubuntu, debian user, I'm not asking for this.

I like how I install packages.

Installing garbage from a webpage like some windows pleb or having to eject weird desktop download things after drag and dropping things on a Mac is not something I want.

Please stop pushing this idea about flatpak being better, its not for a lot of users and for me, security doesn't even enter the equation.

But the idea that random flatpak maintainer has better security processes I place than the sec team for many distros is laughable at best.

You can wrangle the argument all you like about ideal world scenarios but the fact of the matter remains that suboptimal ideal still works out as more effective in the real world. Tragedy of the commons problems generally do require sub optimal solutions in the small to solve in the large.

Re:Flatpak: A security nightmare – two years later by TehCorwiz on Friday October 02, 2020 @11:09AM (#24663418)
There’s a lot of good software that isn’t in package repos. This isn’t a failure in the developers part. It takes knowledge and time and effort to package for a repo, let alone all the different repos on each distro. Flat pack gives a single way to distribute something and on that merit alone it’s valuable.
Re:Flatpak: A security nightmare – two years later by kchr on Friday October 02, 2020 @12:43PM (#24664423)
Almost every package manager on Linux distros allow you to install packages outside of the main repositories and still manage dependencies using the repos.

I agree there are a lot of distros to package for, but I'd say the bonus of not having to maintain and update all the dependencies outweighs that fact.

For example, there are a lot of tools that can generate Debian packages for you if you don't want to spend any time learning the manifests. I assume these exist for most distros.

Re:Flatpak: A security nightmare – two years later by quicklyfrozen on Friday October 02, 2020 @01:46PM (#24665053)
Even if there are easy tools available, I'd still need to learn them for each distro I want to support. Heck, just figuring out the different names each distro uses for a particular package is a fair bit of work.
Re:Flatpak: A security nightmare – two years later by kevin_thibedeau on Friday October 02, 2020 @02:47PM (#24665734)
Just use Gnu Stow as a secondary package manager and install into the /usr/local tree.
Re:Flatpak: A security nightmare – two years later by eikenberry on Friday October 02, 2020 @04:01PM (#24666483)
The discussion is about packaging your software for users, not yourself. Stow is a solution for managing non-packages software on your personal system, not for distributing it.
Re:Flatpak: A security nightmare – two years later by waheoo on Wednesday October 07, 2020 @11:24PM (#24715368)
Most people don't package their software for distros.

Smart distros keep things close to upstream so the burden is small.

This is a weird argument.

Now you want each developer to manage dependency updates for their application? I don't trust them to develop their own app let alone apply security patches properly.

Re:Flatpak: A security nightmare – two years later by waheoo on Friday October 02, 2020 @11:14AM (#24663471)
Again, to whom?

Arch has aur, arch can sideload rpm/Deb's, Mac has home brew, who needs this?

The only people I see using flatpak is the 50 odd Linux users we have at work, they constantly have dramas trying to make things work around home directory sandboxing, permissions, updating and more

> Single way

Why is this valuable? Just saying it doesn't make it true.

Why do we need a single way to install?

I'm not saying it's a bad thing, but giving up home dirs and a bunch of other platform specific benefits is a cost I'm not willing to pay for some made up ideal that gives me a worse experience.

Re:Flatpak: A security nightmare – two years later by knocte on Friday October 02, 2020 @11:44AM (#24663778)
> Again, to whom?

Are you trolling? I think the answer is obvious: less duplication of efforts may make the linux ecosystem be more lean which may mean more manpower to... bring the year of the linux desktop.

Re:Flatpak: A security nightmare – two years later by asveikau on Friday October 02, 2020 @12:38PM (#24664360)
If you avoid duplication of effort by doing something worse than existing solutions, is that progress?

Distro package managers have more than 20 years doing this. If you want to replace them I think there should be fewer drawbacks. Otherwise you are throwing out decades of design, thought, bug fixes for something more problematic.

Re:Flatpak: A security nightmare – two years later by michaelmrose on Friday October 02, 2020 @12:45PM (#24664443)
You are assuming that packaging is a substantial burden when compared to making a complex application and that that labor translates ultimately into tangible benefits.

If the packaging is done by the dev you are assuming that 1% extra effort wont be spent playing chess instead of adding features.

If the packaging is down by an interested party for that distro you are assuming that a person competent to write a package file is even competent to say write an app let alone interested in doing so.

Re:Flatpak: A security nightmare – two years later by santoshalper on Friday October 02, 2020 @11:30AM (#24663632)
Did you know, and this may shock you, that there are other people with other interests. Also, and this one is really going to blow your mind, these other "people" (plebes if you will), may value different things and want products that are of no interest to you.

Flatpak sounds like a shitshow, but the not because it doesn't meet your specific requirements.

Re:Flatpak: A security nightmare – two years later by jdright on Friday October 02, 2020 @12:32PM (#24664293)
To me at least, but I'm sure there is more people than me who wants this.
Re:Flatpak: A security nightmare – two years later by filmor on Friday October 02, 2020 @11:54AM (#24663884)
As a Gentoo user, I very much welcome being able to pull in some applications that are closed source and/or not part of the portage tree without the hassle of finding out how exactly the base platform that it was compiled against looks like. For a while I had to keep a lot of 32bit versions of libraries around just to make Steam happy, and build the stupidly large qtwebengine just for the Nextcloud client. Nowadays I get both of them via Flatpak without hassle and can keep a leaner base system.
Re:Flatpak: A security nightmare – two years later by AshamedCaptain on Friday October 02, 2020 @11:59AM (#24663952)
Why do you exactly run Gentoo in the first place if you don't actually value building the dependencies from source?
Re:Flatpak: A security nightmare – two years later by filmor on Friday October 02, 2020 @12:08PM (#24664038)
That's an odd question. I absolutely value having almost everything built from source and the control I get from that through use-flags.

That doesn't mean I enjoy compiling some incarnation of webkit every few weeks for multiple hours on a laptop, in particular if it's just for a single application (in this case: Nextcloud client). Same for 32bit stuff, I have absolutely zero use for these libraries outside of closed-source games, so I'd rather have them just work than full control over them.

Re:Flatpak: A security nightmare – two years later by herewulf on Friday October 02, 2020 @12:02PM (#24663974)
As a Gentoo/Funtoo user, I feel like we can solve this problem with better security by running applications in Docker. See Funtoo's approach to Steam for example.

https://www.funtoo.org/Steam

Re:Flatpak: A security nightmare – two years later by xtracto on Friday October 02, 2020 @11:48AM (#24663833)
As a free software developer of Windows, Linux and Mac software I would not want to have to need to be "approved by the gods" in order to release an application to the AppStore / SnapStore / Windows Store and whatever is called in the different flavors of linux.

I put my software in my webpage and whoever wants to download it and use it does it. If they don't trust it well then I'm sorry.

Re:Flatpak: A security nightmare – two years later by commoner on Friday October 02, 2020 @08:45PM (#24668505)
You can self-host Flatpak repositories with flat-manager, which differentiates Flatpak from the App/Snap/Windows Stores.

https://docs.flatpak.org/en/latest/hosting-a-repository.html

https://github.com/flatpak/flat-manager

Re:Flatpak: A security nightmare – two years later by Wowfunhappy on Friday October 02, 2020 @12:05PM (#24664007)
Then don't use Flatpak!

The other side is that Software Developer Foo isn't necessarily going to have the resources/inclination to work with your distro maintainer. You may decide to avoid Foo's software as a result, and that's totally fine—but if I like Foo's software and want to use it, Flatpak gives me that opportunity.

Re:Flatpak: A security nightmare – two years later by waheoo on Saturday October 03, 2020 @08:53AM (#24671720)
I don't and I won't but I'm still looking to point out its shortcomings whenever it comes up.

Staying silent is as good as encouraging the echo chamber outright.

People are pushing this shit because it's trendy not because it's good.

Re:Flatpak: A security nightmare – two years later by jillesvangurp on Friday October 02, 2020 @01:03PM (#24664636)
Well, getting the wrong version (years old, not what the developer designated as stable & supported as of yesterday) of absolutely everything I care about is actually kind of really annoying with most contemporary linux distributions.

But basically, as with anything open source, if you don't like it, don't use it, make some other choices, or build your own. I see a lot of people whining and stamping their feet here but not a lot people building alternatives. Quit whining & start coding if it matters that much to you. As far as I can see there's Flatpack, Snap, and not much else here because nobody can be bothered apparently.

Re:Flatpak: A security nightmare – two years later by waheoo on Saturday October 03, 2020 @08:55AM (#24671728)
Microsoft calls typescript stable. I find bugs in it all the time.

I don't trust developers to designate things as stable.

Re:Flatpak: A security nightmare – two years later by karmakaze on Friday October 02, 2020 @03:02PM (#24665914)
I can see two opensource groups that benefit from this. Maintainers can produce quality packages that don't vary unintentionally between target systems with less effort to produce. Package consumers can rely on having the same quality packages on varying systems. I use Ubuntu Server mostly because its packages are highly consumed. If I could get the same packaging on a different system I wouldn't have to worry about arbitrary variations not related to the distro but different just because it's produced through a separate workflow.
Re:Flatpak: A security nightmare – two years later by 188201 on Friday October 02, 2020 @02:15PM (#24665375)
Flatpak is supposed to be the solution for installing proprietary app while staying safe. For open source software, less value for using flatpak apart from no need for package in multiple format for different distro. Appimage also solve the same problem.

Now is flatpak secure for installing closed source app? At least not when they have full x11 access when using x11 desktop.

Re:Flatpak: A security nightmare – two years later by bertman on Friday October 02, 2020 @11:54AM (#24663894)
> As an arch user

> like some windows pleb

I'm not sure if you're serious or making fun of stereotypes and thus don't know how to respond.

Re:Flatpak: A security nightmare – two years later by waheoo on Saturday October 03, 2020 @08:56AM (#24671736)
Seriously making fun of windows plebs? Yes. How anyone trusts Mac/windows these days still amazes me.
Re:Flatpak: A security nightmare – two years later by PopsiclePete on Friday October 02, 2020 @06:57PM (#24667872)
Not that I expected different from a "l337" Arch user, but "Windows plebs" have had "chocolatey" and the Windows Store for a while now...
Re:Flatpak: A security nightmare – two years later by tsss on Friday October 02, 2020 @11:55AM (#24663904)
It's for the people who spent their free time to write the software that you use for free and call plebs.