Re:Flatpak – a security nightmare – 2 years later (2020)
by necovek on Sunday March 21, 2021 @05:43AM
(#26529273)
You've misunderstood "how Flatpaks work": they are using the same system calls that containers use for containerization but in a different way, look at https://en.wikipedia.org/wiki/Linux_namespaces (Snaps use AppArmor too if that's a more familiar technology).
They are not containers in themselves: if you feel this is pedantic, the way namespaces are used can make all the difference (eg. why you should not be running stuff in docker containers as root which can easily be used to get root on the host).
Re:Flatpak – a security nightmare – 2 years later (2020)
by eis on Sunday March 21, 2021 @04:29AM
(#26528976)
Which is good as one should discuss the merits of the arguments brought forth when discussing the pros and cons of a technology rather than who who said it or what motives they might have.
Edit: when I wrote this comment only the first sentence of the parent existed.
Or when neither of the CVE links go anywhere.
Maybe I've understood how Flatpaks work incorrectly (please correct me if so), but the applications are ran in containers. So how would an attacker exploit CVE-2019-17498 on a Gitg? Its not like Gitg has a port open for listening incoming messages.
With ffmpeg I don't know if things like Chromium are actually using the flatpak ffmpeg or if they ship with their own libs.