News for hackers. Stuff that matters.

A comment on KDE and GNOME seeks $100k to turn Flathub into a Store for the Linux desktop. Parent comment

Re:KDE and GNOME seeks $100k to turn Flathub into a Store fo... by yencabulator on Friday February 24, 2023 @01:12PM (#34927724)
And write access to $HOME lets a process climb out of the sandbox.

Trying to make sense of Flatpak's threat model is just near-impossible. It might protect you from something, if the specific app's configuration told it to do so. Starting a random Flatpak app, you have no guarantees, and the UX doesn't communicate anything about this.

[ Parent | on HN ]
Re:KDE and GNOME seeks $100k to turn Flathub into a Store fo... by AnIdiotOnTheNet on Friday February 24, 2023 @02:46PM (#34929106)
I totally agree about letting applications determine their own defaults being a bad idea.
[ Parent | on HN ]
Re:KDE and GNOME seeks $100k to turn Flathub into a Store fo... by Gigachad on Friday February 24, 2023 @04:52PM (#34930632)
We are in a transition period. Starting with getting apps packaged in flatpak even if it doesn’t improve security, and then once that’s all done we can start tightening the restrictions.
[ Parent | on HN ]
Re:KDE and GNOME seeks $100k to turn Flathub into a Store fo... by yencabulator on Friday February 24, 2023 @05:09PM (#34930839)
We shall see. "And then, we add security" has so far never won.
[ Parent | on HN ]
Re:KDE and GNOME seeks $100k to turn Flathub into a Store fo... by littlestymaar on Saturday February 25, 2023 @04:13PM (#34940541)
In that case can you please at least stop advertising flatpak for its security until it happen to be secure eventually…
[ Parent | on HN ]