For these Flatpak improvements, are they also going to end up in bubblewrap?
Sovereign Tech Agency invests €500k in Flatpak
51–60 of 144 posts
Re: Sovereign Tech Agency invests €500k in Flatpak
#52Waste of money. "For Modal, a robust app sandboxing story is essential to creating a Free Software OS that is competitive with modern mobile platforms." Why? Focus should be desktop, not mobile. We have enough mobile stuff that creeped in already.
[deleted]
Re: Sovereign Tech Agency invests €500k in Flatpak
#53Earlier quoted context omitted.
By default, software has a sandboxed location that is exposed to the host in `~/.var/app/[APP]`. Most software needs access to user files. Since most applications aren't written with Flatpak in mind, they will attempt to load files using their own file browser, meaning that for the application to function at all it needs to have access to swaths of extra data. You can see what data the application can access either v…
> Note that you can't magic your way out of this. You can't eg. wait for the program to request access to a file before displaying a "Program wants access to this file. Allow/Deny" because the program doesn't know if this file exists, and the user wouldn't be able to navigate to it via the program's bespoke file browser since it doesn't have access to directories or their contents. What stops the OS from granting acc…
You don't get such prompts on macOS if the app uses the system file picker, which they nearly all do.
You will get prompts for certain sub-directories of $HOME if the app directly opens them using POSIX or similar, so for example, anything running in a terminal emulator, or inside a virtual machine. Developers will see these prompts a lot more often than regular users do. MacOS doesn't let apps read directories but not files.
Re: Sovereign Tech Agency invests €500k in Flatpak
#54I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…
Well put. Would it make more sense if this Sovereign Tech Agency behaved less like a Sovereign Tech Fund and simply hired the developers? Or is civil servants developing OSS commodities too much of a heresy?
> is civil servants developing OSS commodities too much of a heresy
I see two problems here for Germany. First, the salaries of civil servants are regulated, and might be not what most developers, even German ones, expect. In addition civil servant status is bundled with privileges and duties that make it painful to lay it down. Most developers are used to job flexibility though, especially as, as I said, the salaries are not going to be great.
Second, there is a decision by the Constitutional Court that prohibits the state from competing with the market. Temporary grants to independent actors are among other things a way to work around it.
Re: Sovereign Tech Agency invests €500k in Flatpak
#55I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside o…
I use podman for things like this, works perfect until you want desktop applications but you can hack it about a bit to work fine with pipewire and Xephyr and you have. I feel like a lot of these desktop container systems are horrible and are quite hostile to configuring in the way you want around permissions and such and podman or docker does a better job.
> Xephyr
Given that X11 is becoming more and more obsolete over time, what's the Wayland option?
Re: Sovereign Tech Agency invests €500k in Flatpak
#56Earlier quoted context omitted.
By default, software has a sandboxed location that is exposed to the host in `~/.var/app/[APP]`. Most software needs access to user files. Since most applications aren't written with Flatpak in mind, they will attempt to load files using their own file browser, meaning that for the application to function at all it needs to have access to swaths of extra data. You can see what data the application can access either v…
> Note that you can't magic your way out of this. You can't eg. wait for the program to request access to a file before displaying a "Program wants access to this file. Allow/Deny" because the program doesn't know if this file exists, and the user wouldn't be able to navigate to it via the program's bespoke file browser since it doesn't have access to directories or their contents. What stops the OS from granting acc…
macOS does this for select directories. You either give access to all of `Documents` or none. It's also not great for notification fatigue, as you get like 8 popups at once in iTerm2. If you choose not to give access to a directory, you'll need to go to system settings to change this.
So, for a "better" system, we'd need to ask for every directory and you better hope the program doesn't try to glob all files in every directory and overload the user in prompts. Or you can "Allow all" or something, and then we're back at square one where the program has too much access.
Re: Sovereign Tech Agency invests €500k in Flatpak
#57Earlier quoted context omitted.
It's up to you, really, to only use flatpaks that declare tight permissions and implement the proper protocols to safely access resources they don't declare. This isn't always easy and a lot of software on flathub is old-ish, so people tend to open up permissions since it's difficult to implement all these features properly. In my experience people will rarely stand in your way if you try to improve a package.
It’s also just hard to make breaking changes on Linux. Apple can declare something is changing and you have 1 year to get with the program. In Linux you have to bargain and plead with devs over 10 years to change something. Restricting an app to not have file system access is a breaking change. It would have been dead in the water if they didn’t meet half way and make file system access an optional permission.
Apple has much better backwards compatibility than Linux. The APIs haven't changed much since the Carbon->Cocoa transition 25 years ago, and SwiftUI (but that's optional). The impact of app sandboxing on developers was small - and sandboxing is universal on macOS now, there are only different levels of sandboxing but no such thing as unsandboxed apps anymore.
Apple's introduction of sandboxing to an app ecosystem designed without it was a masterclass in OS design that goes unappreciated in our industry. Nobody else pulled that off. It's no exaggeration to say that macOS is the most secure desktop OS by a long way, it's not even close. Linux trails far behind in third place. They achieved this via:
• Extremely long term planning (multi-decade timescales).
• Extremely good systems design.
• Incremental change, so developers always had a digestable chunk of work at any given point. The work needed was smeared out over decades, not drop-kicked onto people in ways that left them flailing.
• Good developer relations work to ensure devs got help quickly if they hit issues.
At no point has Apple's security team had to change course, reverse a prior decision, redesign a subsystem or fail to meet their goals. Everything has slowly clicked together so smoothly most people, even devs, didn't even notice it happening.
The sad thing is, the engineers who pulled this off are largely unknown. The head of Apple Security came from the One Laptop Per Child project and deserves a lot of credit, but much of the careful detailed design that makes the Apple security architecture work is done by unsung heroes. One guy was known only by the name "Perry the Cynic"!
Edit: I did some searches. Perry the Cynic was Peter Kiehtreiber, who seems to now be retired.
Re: Sovereign Tech Agency invests €500k in Flatpak
#58I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…
A single percentage of the revenue google generated by using ffmpeg would fund development indefinitely.
Re: Sovereign Tech Agency invests €500k in Flatpak
#59I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…
A single percentage of the revenue google generated by using ffmpeg would fund development indefinitely.
A single percentage of the food budget for the google private jets would fund ffmpeg development indefinitely.
Re: Sovereign Tech Agency invests €500k in Flatpak
#60Earlier quoted context omitted.
Don't know how you installed it, but required permissions are usually shown and warned about. The CLI could be clearer, though, but shows that host filesystem access is granted to calibre when it prompts to install
Permissions being granted implicitly is awful for security. During installation they're _mentioned_ but the you can't pick which permissions to grant. If the developer requested it, its granted by default. There are third party tools to tinker with permissions, but even those tools follow a "implicit grant first, revoke later" model, mostly because of how Flatpak implicitly grants permissions.
It's explicit in the sense that you choose to grant those permissions, but I get what you mean. Android apps also used to be more like that but nowadays you can have more control when to grant access to what. Flatpak apps can also explicitly request access through portals, but many apps probably haven't put the effort to properly use the sandboxing features and instead try to request excessive permissions beforehand.