News for hackers. Stuff that matters.
Re:Flatpak: A security nightmare – two years later by filmor on Friday October 02, 2020 @11:54AM (#24663884)
As a Gentoo user, I very much welcome being able to pull in some applications that are closed source and/or not part of the portage tree without the hassle of finding out how exactly the base platform that it was compiled against looks like. For a while I had to keep a lot of 32bit versions of libraries around just to make Steam happy, and build the stupidly large qtwebengine just for the Nextcloud client. Nowadays I get both of them via Flatpak without hassle and can keep a leaner base system.
Re:Flatpak: A security nightmare – two years later by AshamedCaptain on Friday October 02, 2020 @11:59AM (#24663952)
Why do you exactly run Gentoo in the first place if you don't actually value building the dependencies from source?
Re:Flatpak: A security nightmare – two years later by filmor on Friday October 02, 2020 @12:08PM (#24664038)
That's an odd question. I absolutely value having almost everything built from source and the control I get from that through use-flags.

That doesn't mean I enjoy compiling some incarnation of webkit every few weeks for multiple hours on a laptop, in particular if it's just for a single application (in this case: Nextcloud client). Same for 32bit stuff, I have absolutely zero use for these libraries outside of closed-source games, so I'd rather have them just work than full control over them.

Re:Flatpak: A security nightmare – two years later by herewulf on Friday October 02, 2020 @12:02PM (#24663974)
As a Gentoo/Funtoo user, I feel like we can solve this problem with better security by running applications in Docker. See Funtoo's approach to Steam for example.

https://www.funtoo.org/Steam