Re:Flatpak: A security nightmare – two years later
by cycloptic on Friday October 02, 2020 @03:05PM
(#24665949)
>How many Ubuntu users have custom software sources enabled; how many of them are installing games from Humble Bundle that come as their own `deb` packages with statically linked assets?
I don't have an answer to this question, but I would never do this. If the game was open source, I would rebuild it to be dynamically linked, and then publish the dynamically linked package.
Re:Flatpak: A security nightmare – two years later
by danShumway on Friday October 02, 2020 @03:30PM
(#24666228)
If this is genuinely your philosophy then Flatpak isn't a real problem for you because you can take any OS application that's bundled with Flatpak, rebuild it to be dynamically linked, and then publish the new package using whatever package manager you prefer.
Heck, there's a decent amount of Linux software being distributed right now as `tar.gz` files with an install script that just extracts the folder someplace and then modifies the user's path.
Flatpak improves on all of that.
It's one thing to look at the Linux security model and say that OSS authors should coordinate with distros, but OSS authors and general Linux developers already don't do that today. So how is Flatpak making that situation any worse?
Developers were already abandoning the sane security model. Flatpak is a response to that trend, not the cause of it.