Live data from Hacker News

Sovereign Tech Agency invests €500k in Flatpak

modal.cx

61–70 of 144 posts

Re: Sovereign Tech Agency invests €500k in Flatpak

#61

Earlier quoted context omitted.

> What stops the OS from granting access to read the directory structure by default, but not read/write its contents? It’s imperfect, but better than the alternative. Not much, it is entirely possible to do. But it also does have security implications like exposing SSH keys and such, which is why something like this isn't the default for flatpak. Though IIRC in a recent GUADEC or LAP(? too many talks recently happene…

It would not expose SSH keys, but the location of SSH keys.

And what is even the concern about that? I don't mind software knowing that my ssh key is in ~/.ssh/id_ed25519. Maybe if you see a 500 byte ~/.ssh/id_rsa that's an issue, but then the real issue is the tiny key

Thinking about threat scenarios of directory structure access, I'd be much more concerned about exposing that I have ~/documents/work/mergers/2027/[secret]_WarnerBros-Fox.docx

But only being able to see the file name would still be a huge improvement over being able to open the document and exfiltrate it

Re: Sovereign Tech Agency invests €500k in Flatpak

#62

My trust in Flatpak diminished after installing the book reader Calibre and finding that despite the sandboxing Calibre was given blanket access to my drive. Apparently a quirk of the developer behind Calibre insisting upon it. No warnings or communication of the exception were given. All trust I had in Flatpak was eroded from that moment on. Curious about the podman options or similar. Having desktop apps in a conta…

Had similar concerns about the default sandboxing, so had to use `--sandbox` with every app and then carefully engineer the permissions so the apps would actually work.

After reading about potential future problems with Flatpak on my distro, I decided to experiment more with Bubblewrap. It turned out to be surprisingly easy to build a minimal container manager around it (here comes the shameless self-plug): https://github.com/pakstak/pakstak

Although for desktop apps, it is not as easy as just packing an app into an OCI container and expecting it to work. Since you are basically building on top of the kernel, which brings true portability between distros, you have to provide the userspace part of the drivers, and this layer depends on your hardware. Overlaying an app container on top of a "driver container" can help with this though.

Re: Sovereign Tech Agency invests €500k in Flatpak

#63
post #55
post #4

Earlier quoted context omitted.

I use podman for things like this, works perfect until you want desktop applications but you can hack it about a bit to work fine with pipewire and Xephyr and you have. I feel like a lot of these desktop container systems are horrible and are quite hostile to configuring in the way you want around permissions and such and podman or docker does a better job.

> Xephyr Given that X11 is becoming more and more obsolete over time, what's the Wayland option?

Not using Wayland I am not 100% sure, I think Xephyr works in XWayland and I think their is a similar tool to Xephyr for setting up an embedded Wayland session (I would have thought this is even easier and more elegant in wayland but not sure). So could be even better.

I personally use X11 as I am on exwm and exwm does not support wayland and no alternative to it does AFAIK (I think theirs a POC floating around somewhere). Also I know X11 even though it's a bit crap in many ways it's the devil I know.

Re: Sovereign Tech Agency invests €500k in Flatpak

#64
post #54

Earlier quoted context omitted.

Well put. Would it make more sense if this Sovereign Tech Agency behaved less like a Sovereign Tech Fund and simply hired the developers? Or is civil servants developing OSS commodities too much of a heresy?

> is civil servants developing OSS commodities too much of a heresy I see two problems here for Germany. First, the salaries of civil servants are regulated, and might be not what most developers, even German ones, expect. In addition civil servant status is bundled with privileges and duties that make it painful to lay it down. Most developers are used to job flexibility though, especially as, as I said, the salarie…

The first part boils down to any civil servant: inflexibility and lower wages aren't for everyone, but it should not be impossible to attract talent intrinsically motivated to contribute to public cause. Especially when it's OSS.

The second part is a bit closer to the heresy angle: new public management forbids competing with "free market". Of course, many EU governments have always found and used all kinds of loopholes to support "independent enterprises" like railways, airlines, power companies and banks once they become too big to fail.

Maybe commodity open source software has reached that level too...

Re: Sovereign Tech Agency invests €500k in Flatpak

#65
post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

I don't really agree here. I think what they are doing is pretty strategic, especially given the relatively limited money they have.

There's basically two sides to funding software that are actually rather different

   1. Accelerator phase: getting the software to a point where it can reasonably replace some foreign closed source enterprise option (i.e. feature devlopment). This sort of thing is often highly speculative. It should be project based, with concrete deliverables, and done with a non-permanent grant. If things go reasonably well, then there can be followup grants. This is what the STA focuses on, and is a major gap in the FOSS world.

   2. Established phase: Once the software is actually ready for adoption (thanks to help from the STA!), and gets integrated into government functions, then the agencies that *use* the software should be setting up enterprise support contracts that give long-term support and stability to the projects they've adopted. A good example of this would be Nextcloud who has multiple such contracts with different parts of Germany (also other European organizations). This part is better off being done by the agency that *uses* the software, rather than having the STA do it. Some of these agencies do in fact also have internal software developers that work on Nextcloud.
I don't think it's a shortcoming of the STA that they're focused on point 1 rather than point 2, I think if they were forced to do both, they'd actually be less effective at what they're doing.

The STA is basically trying to fill the role that venture capital plays in getting a startup ready to take on customers, except the STA doesn't take an ownership stake, and they focus on FOSS.

Re: Sovereign Tech Agency invests €500k in Flatpak

#67
post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

Well put. Would it make more sense if this Sovereign Tech Agency behaved less like a Sovereign Tech Fund and simply hired the developers? Or is civil servants developing OSS commodities too much of a heresy?

There is also the option of structural funding (Strukturförderung in german) where important organizations receive multi-year contracts instead of short term project funding.

Re: Sovereign Tech Agency invests €500k in Flatpak

#68
post #46

Great to see open source projects funded, but the value of Flatpak for tech sovereignty evades me somewhat. It's a pretty niche and questionable piece of technology, and likely won't be there in 10 years. Some grants by STF, like Mastodon, Openstreetmaps, Let's Encrypt, rustls are spot on, but there are many questionable ones.

Flatpak itself might not survive, but the underlying protocols (portals, security contexts in wayland, pipewire, and d-bus, systemd-appd, …) are relevant for sandboxing on linux as a whole. While I do not personally with every design decision, I still think this is useful and valuable work.

Re: Sovereign Tech Agency invests €500k in Flatpak

#69
post #46

Great to see open source projects funded, but the value of Flatpak for tech sovereignty evades me somewhat. It's a pretty niche and questionable piece of technology, and likely won't be there in 10 years. Some grants by STF, like Mastodon, Openstreetmaps, Let's Encrypt, rustls are spot on, but there are many questionable ones.

Flatpak is proving to be a very important piece of underlying infrastructure if government agencies want to switch to Linux computers running distributed graphical applications for their workers.

Yes, it has major problems, and you might be right it won't exist in 10 years, but the point of this grant is to fund their attempt at fixing their problems and getting it to a point where it's better infrastructure that can survive into the future.

Re: Sovereign Tech Agency invests €500k in Flatpak

#70
post #59
post #58

Earlier quoted context omitted.

A single percentage of the revenue google generated by using ffmpeg would fund development indefinitely.

A single percentage of the food budget for the google private jets would fund ffmpeg development indefinitely.

It would be enough if software donated to software development actually went to developers. Not to foundation CEOs and bs actovism!
Post reply on HN