Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sovereign Tech Agency invests €500k in Flatpak

modal.cx

Post reply on HN
Print view View original

11–20 of 144 posts

Re: Sovereign Tech Agency invests €500k in Flatpak

#11

Post by lunar_rover »

TekMol wrote: post #2

I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside o…

Tech debt, primarily. Flatpak is designed to be able to package apps not designed with it in mind.

If neither compatibility nor resources are of concern then integrating true Mandatory Access Control into both the UX and the entire tech stack would be the best way forward.

Re: Sovereign Tech Agency invests €500k in Flatpak

#12

Post by meibo »

TekMol wrote: post #2

I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside o…

It's up to you, really, to only use flatpaks that declare tight permissions and implement the proper protocols to safely access resources they don't declare.

This isn't always easy and a lot of software on flathub is old-ish, so people tend to open up permissions since it's difficult to implement all these features properly. In my experience people will rarely stand in your way if you try to improve a package.

Re: Sovereign Tech Agency invests €500k in Flatpak

#13

Post by Nux »

Waste of money.

"For Modal, a robust app sandboxing story is essential to creating a Free Software OS that is competitive with modern mobile platforms."

Why? Focus should be desktop, not mobile.

We have enough mobile stuff that creeped in already.

Re: Sovereign Tech Agency invests €500k in Flatpak

#14

Post by bashZorina_09 »

TekMol wrote: post #2

I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside o…

Same prefer, although I'm not sure what you mean by "installing changes data in places on my disk"?

Nothing should change, all installations and addons go to the ~/.var directory. When you launch the application, yes it can start reading and writing to arbitrary places on disk, which is why I make it a habit of first launching Flatseal to modify permissions and know exactly what it can and can't do and reach.

I actually vastly prefer this methodology with what we have right now, but if it or something else adopted an application/directory methodology as you described I'd be elated.

Re: Sovereign Tech Agency invests €500k in Flatpak

#15

Post by minimeow »

My trust in Flatpak diminished after installing the book reader Calibre and finding that despite the sandboxing Calibre was given blanket access to my drive. Apparently a quirk of the developer behind Calibre insisting upon it. No warnings or communication of the exception were given. All trust I had in Flatpak was eroded from that moment on. Curious about the podman options or similar. Having desktop apps in a container with selective access to system resources seems like it would be more secure and configurable if configured correctly. Flatpak as it stands seems to be a legacy solution to what should be a container and namespacing solution.

Re: Sovereign Tech Agency invests €500k in Flatpak

#16

Post by j1elo »

I loved Flatpak until I started building a MiniPC with a 112 GB internal disk for HTPC usage... Then I felt the pain of having to get all slightly different dependency versions for each little program I wanted.

The box' cost already topped the project's budget so no new disk for it. I'm back to "proper .deb packaging please"

Re: Sovereign Tech Agency invests €500k in Flatpak

#17

Post by kalaksi »

TekMol wrote: post #2

I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside o…

Isn't that exactly how it's supposed to work, though? When I install a flatpak app for my user, it gets put into a standard location as a directory and by default has no access to filesystem other than the apps own config and data dirs (can't remember the paths). The fact that many apps choose to require excess permissions and can then bypass standard locations is a different matter

Re: Sovereign Tech Agency invests €500k in Flatpak

#19

Post by pinkwah »

TekMol wrote: post #2

I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside o…

By default, software has a sandboxed location that is exposed to the host in `~/.var/app/[APP]`.

Most software needs access to user files. Since most applications aren't written with Flatpak in mind, they will attempt to load files using their own file browser, meaning that for the application to function at all it needs to have access to swaths of extra data. You can see what data the application can access either via FlatSeal or in whatever "app store" you're using. Often it'll be your entire home directory.

The software that is designed with Flatpak in mind will use XDG Desktop Portals, where the host displays a file browser and then hooks it up to the sandboxed app so it has access only to that file or directory.

Note that you can't magic your way out of this. You can't eg. wait for the program to request access to a file before displaying a "Program wants access to this file. Allow/Deny" because the program doesn't know if this file exists, and the user wouldn't be able to navigate to it via the program's bespoke file browser since it doesn't have access to directories or their contents.

Re: Sovereign Tech Agency invests €500k in Flatpak

#20

Post by jarym »

minimeow wrote: post #15

My trust in Flatpak diminished after installing the book reader Calibre and finding that despite the sandboxing Calibre was given blanket access to my drive. Apparently a quirk of the developer behind Calibre insisting upon it. No warnings or communication of the exception were given. All trust I had in Flatpak was eroded from that moment on. Curious about the podman options or similar. Having desktop apps in a conta…

That’s what the kasmweb images on dockerhub are - desktop apps containerised
Post reply on HN