Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sovereign Tech Agency invests €500k in Flatpak

modal.cx

Post reply on HN
Print view View original

21–30 of 144 posts

Re: Sovereign Tech Agency invests €500k in Flatpak

#21

Post by kalaksi »

minimeow wrote: post #15

My trust in Flatpak diminished after installing the book reader Calibre and finding that despite the sandboxing Calibre was given blanket access to my drive. Apparently a quirk of the developer behind Calibre insisting upon it. No warnings or communication of the exception were given. All trust I had in Flatpak was eroded from that moment on. Curious about the podman options or similar. Having desktop apps in a conta…

Don't know how you installed it, but required permissions are usually shown and warned about. The CLI could be clearer, though, but shows that host filesystem access is granted to calibre when it prompts to install

Re: Sovereign Tech Agency invests €500k in Flatpak

#22

Post by moooo99 »

znpy wrote: post #9

To be honest i don't see how having flatpack going to help the (european/german) "sovereign tech" initiative. A waste of money if you ask me. I think there are much more important issues that should deserve money and attention.

Flatpaks are a common packaging mechanism used on immutable systems. They are very attractive (conceptually) for large org deployments, so I can totally see the appeal here

Re: Sovereign Tech Agency invests €500k in Flatpak

#23

Post by JanisErdmanis »

I like the idea behind Flatpak and the ability to sandbox applications. What I don't understand is why they chose to lock the build process so tightly to Linux.

I'm currently on macOS, and while I can cross-compile applications, I can't actually bundle them as Flatpaks. For that, I need `flatpak-builder`, which is so deeply coupled to Linux itself that I don't think it can realistically run on other platforms.

Snaps have a similar issue with `snapcraft`. However, you can still build a snap manually with `mksquashfs`, whereas I haven't found an equivalent low-level option for Flatpak. I may be missing something, though, and I'm still looking.

Re: Sovereign Tech Agency invests €500k in Flatpak

#24

Post by tancop »

koe123 wrote: post #3

Maybe I am too propagandized, but honestly after going Nix I can’t help but feel like this stuff is fundamentally a waste of time

Nix is always doing its own thing. The community is fragmented and there are no enforced packaging conventions. They have a "best practices" page that lists language features you're not supposed to use because they break reproducible builds, aka the whole point of Nix. And they don't even restrict network access by default.

It's also not doing runtime sandboxing at all. Isolated builds protect you from supply chain attacks but not malware or vulns in the actual code, and they don't do anything for closed source apps.

Flatpak runs everything in a container with access limited to what is declared in the manifest and you can restrict it even more with Flatseal. It's not as secure as a Firecracker VM but it works way better than any other package system on Linux when it comes to security and distro independence.

Re: Sovereign Tech Agency invests €500k in Flatpak

#26

Post by koe123 »

tancop wrote: post #24
koe123 wrote: post #3

Maybe I am too propagandized, but honestly after going Nix I can’t help but feel like this stuff is fundamentally a waste of time

Nix is always doing its own thing. The community is fragmented and there are no enforced packaging conventions. They have a "best practices" page that lists language features you're not supposed to use because they break reproducible builds, aka the whole point of Nix. And they don't even restrict network access by default. It's also not doing runtime sandboxing at all. Isolated builds protect you from supply chain a…

Maybe I am vastly underestimating it, but I could imagine this being buildable atop of nix quite straightforward?

Re: Sovereign Tech Agency invests €500k in Flatpak

#27

Post by a-french-anon »

regexorcist wrote: post #25

I use bubblewrap directly, never liked Flatpak.

Same except for Steam. Hope this money revitalizes bubblewrap's development, it'd be nice to get proper signal handling cleanup up then merged (even util-linux's unshare has it, these days).

Re: Sovereign Tech Agency invests €500k in Flatpak

#28

Post by Gigachad »

meibo wrote: post #12
TekMol wrote: post #2

I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside o…

It's up to you, really, to only use flatpaks that declare tight permissions and implement the proper protocols to safely access resources they don't declare. This isn't always easy and a lot of software on flathub is old-ish, so people tend to open up permissions since it's difficult to implement all these features properly. In my experience people will rarely stand in your way if you try to improve a package.

It’s also just hard to make breaking changes on Linux. Apple can declare something is changing and you have 1 year to get with the program. In Linux you have to bargain and plead with devs over 10 years to change something.

Restricting an app to not have file system access is a breaking change. It would have been dead in the water if they didn’t meet half way and make file system access an optional permission.

Re: Sovereign Tech Agency invests €500k in Flatpak

#29

Post by WhyNotHugo »

kalaksi wrote: post #21
minimeow wrote: post #15

My trust in Flatpak diminished after installing the book reader Calibre and finding that despite the sandboxing Calibre was given blanket access to my drive. Apparently a quirk of the developer behind Calibre insisting upon it. No warnings or communication of the exception were given. All trust I had in Flatpak was eroded from that moment on. Curious about the podman options or similar. Having desktop apps in a conta…

Don't know how you installed it, but required permissions are usually shown and warned about. The CLI could be clearer, though, but shows that host filesystem access is granted to calibre when it prompts to install

Permissions being granted implicitly is awful for security.

During installation they're _mentioned_ but the you can't pick which permissions to grant. If the developer requested it, its granted by default.

There are third party tools to tinker with permissions, but even those tools follow a "implicit grant first, revoke later" model, mostly because of how Flatpak implicitly grants permissions.

Re: Sovereign Tech Agency invests €500k in Flatpak

#30

Post by banger180 »

I really like flatpaks to install desktop applications, as mentioned in some other comments the sandbox is sometimes poked full of holes because some applications don't use XDG desktop protals and need full filesystem access. If you are really concerened about this, you can use flatseal to limit the access that the application has.

If you prefer other ways of installing your software, that fine. But I really hope flatpaks continue improving and become the de facto way of installing desktop applications across all Linux distributions. For a normal, non-technical user installing and updating software should be easy, and I believe that flatpak provides this.

Post reply on HN