Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sovereign Tech Agency invests €500k in Flatpak

modal.cx

Post reply on HN
Print view View original

41–50 of 144 posts

Re: Sovereign Tech Agency invests €500k in Flatpak

#41

Post by omnimus »

koe123 wrote: post #26
tancop wrote: post #24

Earlier quoted context omitted.

Nix is always doing its own thing. The community is fragmented and there are no enforced packaging conventions. They have a "best practices" page that lists language features you're not supposed to use because they break reproducible builds, aka the whole point of Nix. And they don't even restrict network access by default. It's also not doing runtime sandboxing at all. Isolated builds protect you from supply chain a…

Maybe I am vastly underestimating it, but I could imagine this being buildable atop of nix quite straightforward?

Yes because both flatpak and nix use bubblewrap and linux. So it is indeed possible to build it with bubblewrap.

GUI apps on NixOS rarely care about sandboxing so while you can do it yourself i bet almost noone does. Flatpak is trying to give you basic protections out of the box.

Re: Sovereign Tech Agency invests €500k in Flatpak

#42

Post by sdcfgy »

ho_schi wrote: post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

Well said.

On your last point, I'd love one day to see that OSS developers are paid because society benefits from their work.

Re: Sovereign Tech Agency invests €500k in Flatpak

#43

Post by audidude »

Vogtinator wrote: post #35
WhyNotHugo wrote: post #32

A lot of Flatpak's design is a great prototype, but it's somewhat worrying (for the ecosystem in general) that this was taken as a final design and being pushed out in all directions. Portals are just a terrible design for a security boundary: all interfaces clobbered up into one huge daemon, which also deals with a lot of the internals of Flatpak/Snap. If you want your sandbox to use portals, you can't, because it r…

In the beginning, Flatpak was seen as savior for the Linux desktop ecosystem by making more applications available for more distributions, possibly packaged by the upstream maintainer, but they didn't realize that Flatpak resp. Flathub are actually just another distro with its own builds, repository, package manager, package format and community. On the security side it was also seen as the only way forward, but it's…

This is true. I wrote a sandbox for applications shipped on an immutable distro last month and it uses all the same portals just fine but no ostree/flatpak whatsoever.

You also can have separate portals implemented with different processes if you, you know, use d-bus properly.

Re: Sovereign Tech Agency invests €500k in Flatpak

#44

Post by jimbob45 »

ho_schi wrote: post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

We do all this self-congratulation around funding OSS companies and then end up with OSS companies that exist only thanks to government subsidization. Why? Isn’t governmental control over funding what we hate about Microsoft? What is so bad about letting real customers decide which companies need funding?

Re: Sovereign Tech Agency invests €500k in Flatpak

#45

Post by danielheath »

alkonaut wrote: post #33
vaylian wrote: post #8

Earlier quoted context omitted.

> But I would much prefer a "An application is a directory and by default cannot access anything outside of that directory" approach. That makes sense if the application is the only program that needs to interact with the data. For example: If you have a drawing or photo editing program. You might have downloaded an image from the internet or from your camera. Then you make some edits. Afterwards you want to send the…

Can't it request and be granted that permission, transparently to the app? E.g. the app does EnumerateDirectories("~/photos") then without requiring modification to the app, the call is interecpted, the user is presented with a permission request UI, and once granted, the app continues? At least that's how I'd thought it would work. Perhaps this isn't viable?

Apps built with a toolkit which ships its own filepicker will immediately attempt to enumerate directories in `/`, `/home`, and probably a few other places.

Apps with a config file will often try to read `~/.config/myapp` and also `~/.myapp/config` and maybe one or two other places.

How many permission prompts will users tolerate?

Re: Sovereign Tech Agency invests €500k in Flatpak

#46

Post by oytis »

Great to see open source projects funded, but the value of Flatpak for tech sovereignty evades me somewhat. It's a pretty niche and questionable piece of technology, and likely won't be there in 10 years. Some grants by STF, like Mastodon, Openstreetmaps, Let's Encrypt, rustls are spot on, but there are many questionable ones.

Re: Sovereign Tech Agency invests €500k in Flatpak

#48

Post by repelsteeltje »

ho_schi wrote: post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

Well put.

Would it make more sense if this Sovereign Tech Agency behaved less like a Sovereign Tech Fund and simply hired the developers? Or is civil servants developing OSS commodities too much of a heresy?

Re: Sovereign Tech Agency invests €500k in Flatpak

#49

Post by actionfromafar »

NekkoDroid wrote: post #40
hattar wrote: post #34

Earlier quoted context omitted.

> Note that you can't magic your way out of this. You can't eg. wait for the program to request access to a file before displaying a "Program wants access to this file. Allow/Deny" because the program doesn't know if this file exists, and the user wouldn't be able to navigate to it via the program's bespoke file browser since it doesn't have access to directories or their contents. What stops the OS from granting acc…

> What stops the OS from granting access to read the directory structure by default, but not read/write its contents? It’s imperfect, but better than the alternative. Not much, it is entirely possible to do. But it also does have security implications like exposing SSH keys and such, which is why something like this isn't the default for flatpak. Though IIRC in a recent GUADEC or LAP(? too many talks recently happene…

It would not expose SSH keys, but the location of SSH keys.

Re: Sovereign Tech Agency invests €500k in Flatpak

#50

Post by hvb2 »

jimbob45 wrote: post #44
ho_schi wrote: post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

We do all this self-congratulation around funding OSS companies and then end up with OSS companies that exist only thanks to government subsidization. Why? Isn’t governmental control over funding what we hate about Microsoft? What is so bad about letting real customers decide which companies need funding?

> What is so bad about letting real customers decide which companies need funding?

Because human nature means you won't get paid when something is free. There's donate options but those are not a reliable source of money.

Unless your software is big enough that you can make money through support contracts, I don't see how you can keep the lights on while being paid

Post reply on HN