• Are you using Flatpaks?
  • Are you trusting Flathub?
  • Do you bother about the sandboxing and security?
  • TheEntity@kbin.social
    link
    fedilink
    arrow-up
    62
    arrow-down
    2
    ·
    edit-2
    1 year ago

    I expect the Flatpak sandbox to protect my ~/ from getting cluttered by applications, not to protect me from any actually malicious software. The post’s premise seems misguided.

    • Kata1yst@kbin.social
      link
      fedilink
      arrow-up
      25
      arrow-down
      1
      ·
      edit-2
      1 year ago

      YES. I don’t understand this delusion people keep perpetuating. Flatpak has a MILD form of container sandboxing. For a real security sandbox we have Firejails or Bubble wrap.

      Flatpak is, at it’s core, a software development and distribution packaging format. NOT a security implementation.

        • hornedfiend@sopuli.xyz
          link
          fedilink
          arrow-up
          2
          ·
          edit-2
          1 year ago

          I always check my flatpak settings post install before running the app and adjust permissions according to need. I mean it does offer more security to me since it’s user installed, I can granularly update permissions and control more or less where and what is can touch.

          Alternatives to this are SELinux,AppArmour and firejails which are slightly more inconvenient to use.

          To me that is mostly secure,or secure enough.

          Well and then there’s some immutable distros which might help overall.

          Edit: paragraphs

      • michaelmrose@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        If we admit that then an app store where anyone can create an account and upload software becomes extremely problematic. This is especially true wherein clients autoupgrade very quickly.

        Step one. Legit package a popular app Step two. Wait for substantial uptake Step three. Mix in some ad or malware and watch a tens of thousands get instantly owned.

          • michaelmrose@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            Anyone can’t become a packager in 30 seconds in an automated process that they can’ t repeat the 47th time they transmit malware.

            • AProfessional@lemmy.world
              link
              fedilink
              English
              arrow-up
              2
              ·
              1 year ago

              The process is identical.

              You show up with a package. It gets a basic review. You are granted commit access to your package. You can push changes.

              There is slightly more oversight in that another mentor often also has commit access but they can’t and don’t review everything.

    • jollyrogue@lemmy.ml
      link
      fedilink
      arrow-up
      6
      ·
      1 year ago

      Yeah, Flatpak was never meant to be a security mechanism. It is a convenient way to add security to userland though.

    • Avid Amoeba@lemmy.ca
      link
      fedilink
      arrow-up
      3
      arrow-down
      1
      ·
      edit-2
      1 year ago

      In addition to own new code, bundled copies of libraries in packages introduces net new attack surface which isn’t patched via the regular distribution security patch process. The image decoding lib that allows remote code execution now exists in flatpaks independently from the one in /lib. Every flatpak vendor that contains it has to build and ship their own patched version of it. This is even more valid for any other libraries flatpaks include that don’t exist on the system. The most widely used Linux OSes come with security patching processes, expectations and sometimes guarantees. This new attack surface breaks those and the solution is security sandboxing. This approach has been proven in mobile app packaging and distribution systems. Android is a great example where apps are not trusted by default and vulnerable ones rarely cause collateral damage on otherwise up-to-date Android systems. This is an objective problem with the out-of-band distribution model allowed by flatpak and snap or any similar system, whether you care about it or not personally. It’s a well understood tradeoff in software development. It has to be addressed as adoption grows or we risk reducing Linux security to the levels of Windows where apps regularly bundle dependencies with no sandboxing whatsoever.

      • suprjami@lemmy.sdf.org
        link
        fedilink
        English
        arrow-up
        4
        ·
        1 year ago

        Every Flatpak vendor

        So who’s that? Flathub and Fedora, the latter of who automate the Flatpak builds from distro packages anyway.

        If you’re using a smaller distro which is not backed by a huge security team then this is probably an advantage of using Flatpak, not a negative.

          • suprjami@lemmy.sdf.org
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            Yes. All Flatpak apps can be used on any distro.

            I’m using the Fedora Flatpak Firefox on Debian, because Fedora’s Flatpak runtime supports Kerberos authentication, the Flathub runtime doesn’t.

          • AProfessional@lemmy.world
            link
            fedilink
            English
            arrow-up
            1
            ·
            1 year ago

            All Flatpaks are portable. There is no reason to use their repo usually though as Flathub often has more up to date, featureful, or upstream maintained versions instead.

  • jollyrogue@lemmy.ml
    link
    fedilink
    arrow-up
    46
    ·
    1 year ago

    Yes, I’m using flatpaks.

    Yes, I’m trusting flathub. LOL about people repackaging applications. Wait until they find out the Linux distro they use is a collection of software repackaged by 3rd parties. 😂

    Userland hasn’t had any concept of security, so it’s nice people are trying to fix it.

  • 𝘋𝘪𝘳𝘬@lemmy.ml
    link
    fedilink
    arrow-up
    35
    ·
    1 year ago

    I have a handful of applications from Flathub I trust, but that’s it.

    I don’t see Flatpak as a security mechanism and I don’t treat it like one.

    • qwesx@kbin.social
      link
      fedilink
      arrow-up
      12
      arrow-down
      2
      ·
      1 year ago

      This is generally good advice. Would you run the program without a sandbox? No? Then you probably shouldn’t run it inside a sandbox either.
      You can never be sure that the program isn’t using a flaw in the sandbox to break out or is just piggybacking onto a whitelisted action that is required for the program’s basic functionality.

      And if some program requires r/w for your entire home directory and network access then you might as well not use a sandbox in the first place because it can already do everything useful that it needs to do.

  • Pantherina@feddit.de
    link
    fedilink
    arrow-up
    24
    arrow-down
    1
    ·
    edit-2
    1 year ago

    There is a subset of only verified apps, if you want to be secure. But then you lack trustworthy unofficial apps like VLC.

    flatpak remote-delete flathub ; flatpak remote-add --subset=verified flathub https://dl.flathub.org/repo/flathub.flatpakrepo
    

    Also until every app uses Portals, and until we have a share portal, most apps are basically unrestricted if you compare it to Android.

  • TCB13@lemmy.world
    link
    fedilink
    English
    arrow-up
    18
    ·
    edit-2
    1 year ago

    Are you using Flatpaks?

    Yes, makes Debian desktop perfect. Rock solid base system, all desktop apps updated to the latest and greatest without pollution.

    Are you trusting Flathub?

    Yes BUT… there should be a way to have / manage / install Flatpaks offline like AppImages and/or easy and officially supported ways of archiving the repository into something useful and easy to use.

    Related: https://github.com/flatpak/flatpak/issues/4874

    Do you bother about the sandboxing and security?

    Too much security already: https://github.com/flathub/org.keepassxc.KeePassXC/issues/29#issuecomment-559476300 A password manger can’t community with a Browser as it is. This makes both useless and kills one of the best use cases for Flatpak.

    • Perroboc@lemmy.world
      link
      fedilink
      arrow-up
      8
      ·
      edit-2
      1 year ago

      I would love to install a browser, and a password manager through flatpaks but they won’t talk with each other.

      I would get an IDE like visual studio code, through flathub, but it doesn’t talk with the system software I want to develop on.

      I would love to get Steam or any other games as flatpaks but having to redownload mesa and other system files just for that uses a lot of space and feels like a second OS.

      So yeah, I agree with you. It’s awesome! But it has some flaws right now (that I’m sure they’re being worked on)

      • TCB13@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        ·
        edit-2
        1 year ago

        Yes but they solve the cross distro packing problem and that’s neat. The GNOME Software integration is also amazing, those few times when you see that desktop Linux actually can do it. :P

        I just hope for better and easier tools to mange the security / process communication. For me flatpaks are more about finally having a fast and decent way of packing stuff across distros with dependencies than a sandbox / security feature.

        • Perroboc@lemmy.world
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          I’m not against them, at all. I use them extensively. I just wish I could use them for everything!

    • wile_e8@lemmy.world
      link
      fedilink
      arrow-up
      4
      ·
      1 year ago

      FWIW I figured out how to get a password manager (Browserpass, not KeePassXC) to communicate with flatpak Chrome if you want some advice on how to get it to work.

      But yes, it was way more difficult than it should have been (which is “should work out of the box, just like a regular package”). So if you’re just listing some of the shortcomings of flatpak, never mind.

        • wile_e8@lemmy.world
          link
          fedilink
          arrow-up
          5
          ·
          1 year ago

          OK, so I looked though my browser history, and here are some relevant pages I found:

          I don’t remember how much I used each one, but eventually I pieced together enough information information to get the Browserpass extension working in the Google Chrome flatpak. But three of those links are KeePassXC, which should be useful for adapting this for your use.

          The main file that was having problems was the Browserpass Native Messaging Hosts file in my config directory for the Chrome flatpak, ~/.var/app/com.google.Chrome/config/google-chrome/NativeMessagingHosts/com.github.browserpass.native.json. Originally it was a symlink to a file at /usr/lib/browserpass/hosts/chromium/com.github.browserpass.native.json:

          {
              "name": "com.github.browserpass.native",
              "description": "Browserpass native component for the Chromium extension",
              "path": "/usr/bin/browserpass-linux64",
              "type": "stdio",
              "allowed_origins": [
                  "chrome-extension://naepdomgkenhinolocfifgehidddafch/"
              ]
          }
          

          The call to /usr/bin/browserpass-linux64 did not see to work for me, so I ended up making a copy of the file in the NativeMessagingHosts directory and modified it to point to a script in my home mount:

          wile_e8 NativeMessagingHosts $ diff com.github.browserpass.native.json.orig com.github.browserpass.native.json
          4c4
          <     "path": "/usr/bin/browserpass-linux64",
          ---
          >     "path": "/home/wile_e8/.config/browserpass/browserpass.sh",
          
          

          I don’t remember why I picked to do it inside the ~/.config directory, but it worked so I left it. And here is the script I put at ~/.config/browerpass/browserpass.sh:

          #!/bin/sh
          cd ~
          /usr/bin/flatpak-spawn --host /usr/bin/browserpass-linux64 2>/tmp/error.log
          

          I don’t remember how I came up with that script, it must be somewhere in the four links at the top.

          Finally, I needed to use Flatseal to allow access to the script. In the Google Chrome settings, under “Filesystem->Other files”, I added an entry saying ~/.config/browserpass:ro. Also modified from the default in Flatseal, I have “Filesystem->All user files” enabled, along with “Socket->D-Bus session bus” and “Socket->D-Bus system bus”. I don’t know how necessary the last three are, but I’m not messing with it now that I have it working.

          So, that’s what I did to get the Browserpass extension working in the Google Chrome flatpak. You’ll have to modify some things to get it working for KeePassXC, or for Firefox. But that general pattern should work.

          • TCB13@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            ·
            1 year ago

            Hmm I kind of tried that route before but haven’t gone so far. I’ll check it asap. Thanks!

        • wile_e8@lemmy.world
          link
          fedilink
          arrow-up
          4
          ·
          1 year ago

          Keep an eye out, I’ll come back to this. It involves posting config file diffs and a script I wrote, it’ll be a longer post I don’t have the time to write right at this moment.

          But yes, the fact that I need to find the time to post all the changes I needed to make to get this to work is part of the problem here.

    • redd@discuss.tchncs.deOP
      link
      fedilink
      arrow-up
      3
      arrow-down
      1
      ·
      edit-2
      1 year ago

      Even if you have trust. There can be security vulnerabilites in apps we are using. Flatpak seems to not really help in any way.

    • Umbrias@beehaw.org
      link
      fedilink
      arrow-up
      1
      arrow-down
      3
      ·
      1 year ago

      And this is why I’ve never taken much of Linuxs user base seriously when they talk about security. Hilariously bad defense strategy.

        • Lupec@lemm.ee
          link
          fedilink
          arrow-up
          2
          ·
          1 year ago

          Side note, I wish yesterday me had read this before cloning the full 4 gigs lol

      • Lupec@lemm.ee
        link
        fedilink
        arrow-up
        4
        ·
        1 year ago

        As someone who struggled quite a bit to learn Nix, I’d say start small. Install Nix the package manager on any old distro you’re familiar with and play with standalone Home Manager. Enable one program here and there, have it manage your shells and CLI apps, set environment variables and write files. It’s something you can immediately see the effects of and feels pretty rewarding, so I think it’s a great place to start.

        I also happened upon this video series a few days ago and it’s a great resource, easy to parse and walks you through not only the basics but how to look around and investigate in the REPL when you want to figure something out.

        • PipedLinkBotB
          link
          fedilink
          English
          arrow-up
          1
          arrow-down
          1
          ·
          1 year ago

          Here is an alternative Piped link(s):

          this video series

          Piped is a privacy-respecting open-source alternative frontend to YouTube.

          I’m open-source; check me out at GitHub.

  • ChristianWS@lemmy.eco.br
    link
    fedilink
    arrow-up
    10
    ·
    1 year ago

    I’m mostly using Flatpaks on Tumbleweed, I only use the package manager if I can’t find a Flatpak version. Reason for that is that with Flatpak I can precisely know what I manually installed, as Tumbleweed lacks a proper easy way of getting a list of user installed packages

  • ExLisper@linux.community
    link
    fedilink
    English
    arrow-up
    3
    arrow-down
    1
    ·
    1 year ago

    Tried couple of times and it didn’t work. I had more luck with AppImage. Don’t use it, don’t want it.

    • setVeryLoud(true);@lemmy.ca
      link
      fedilink
      arrow-up
      10
      arrow-down
      1
      ·
      1 year ago

      The Flatpak experience on Ubuntu is piss poor on purpose fwiw, Canonical kneecapped Flatpak in favour of Snaps. Try it on Fedora!

      AppImages offer zero protection or containerization, it’s just a distribution format.

  • smileyhead@discuss.tchncs.de
    link
    fedilink
    arrow-up
    4
    arrow-down
    2
    ·
    edit-2
    1 year ago

    Okey, let me start the discussion.

    What’s the point of sandboxing or permissions on environment for one user?

    • erwan@lemmy.ml
      link
      fedilink
      arrow-up
      8
      ·
      1 year ago

      It means you can run apps without trusting their developer will full access to your computer and your files.

      Just like on mobile, you only allow apps to access what you know they need. Nothing more.

      • smileyhead@discuss.tchncs.de
        link
        fedilink
        arrow-up
        3
        arrow-down
        4
        ·
        edit-2
        1 year ago

        Okey, so why we run apps without trusing developers in the first place? Or why do we even need the trust?

        (It’s not that I think sandboxing is not useful sometimes, I just want to see if we get somewhere)

        • redd@discuss.tchncs.deOP
          link
          fedilink
          English
          arrow-up
          8
          ·
          edit-2
          1 year ago

          Think about service providers (government, banking, messaging, streaming, gaming). To participate in life we might depend on some of their services but don’t fully trust these parties. Flatpak is not secure/sandboxed enough to run untrusted apps. Meanwhile on Android the situation looks much better.

    • hottari@lemmy.ml
      link
      fedilink
      arrow-up
      6
      ·
      1 year ago

      That’s a feature not a bug. Under flathub, the original author of the software (for verified apps at least) knows what is the best configuration to ship for their package.

      ATM. You are not trusting flathub when installing a flatpak. You are trusting the application’s author. Maybe in the future, flathub would introduce restrictions on certain permissions but we would be speculating at that point.

  • Papamousse@beehaw.org
    link
    fedilink
    arrow-up
    4
    arrow-down
    4
    ·
    1 year ago

    Nope, I’ll never use flatpak, appImage, snap, things like this.

    If there’s no .deb to install, I try to compile it myself.