Sovereign Tech Agency invests €500k in Flatpak • Hacker News Board

Re: Sovereign Tech Agency invests €500k in Flatpak

#71

Post by j16sdiz » Fri, Aug 28, 2026, 10:08 AM UTC

hattar wrote: post #34

pinkwah wrote: post #19

Earlier quoted context omitted.

By default, software has a sandboxed location that is exposed to the host in `~/.var/app/[APP]`. Most software needs access to user files. Since most applications aren't written with Flatpak in mind, they will attempt to load files using their own file browser, meaning that for the application to function at all it needs to have access to swaths of extra data. You can see what data the application can access either v…

> Note that you can't magic your way out of this. You can't eg. wait for the program to request access to a file before displaying a "Program wants access to this file. Allow/Deny" because the program doesn't know if this file exists, and the user wouldn't be able to navigate to it via the program's bespoke file browser since it doesn't have access to directories or their contents. What stops the OS from granting acc…

The "open panel" in macOS is actually a system service, run out-of-process, with different sandbox and permission.

Re: Sovereign Tech Agency invests €500k in Flatpak

#72

Post by ximm » Fri, Aug 28, 2026, 10:09 AM UTC

a-french-anon wrote: post #27

regexorcist wrote: post #25

I use bubblewrap directly, never liked Flatpak.

Same except for Steam. Hope this money revitalizes bubblewrap's development, it'd be nice to get proper signal handling cleanup up then merged (even util-linux's unshare has it, these days).

I have bad news for you: The flatpak developers plan to stop using bubblewrap. They say it is no longer necessary because most distros now support unprivileged user namespaces. https://youtu.be/NsVhkz2Xl0E?si=-ypxvTlRukCZLql9

Re: Sovereign Tech Agency invests €500k in Flatpak

#73

Post by alkonaut » Fri, Aug 28, 2026, 10:12 AM UTC

danielheath wrote: post #45

alkonaut wrote: post #33

Earlier quoted context omitted.

Can't it request and be granted that permission, transparently to the app? E.g. the app does EnumerateDirectories("~/photos") then without requiring modification to the app, the call is interecpted, the user is presented with a permission request UI, and once granted, the app continues? At least that's how I'd thought it would work. Perhaps this isn't viable?

Apps built with a toolkit which ships its own filepicker will immediately attempt to enumerate directories in `/`, `/home`, and probably a few other places. Apps with a config file will often try to read `~/.config/myapp` and also `~/.myapp/config` and maybe one or two other places. How many permission prompts will users tolerate?

I'm assuming that the config scenario can be re-routed so the app thinks its opening that file but instead gets routed to different ones transparently.

If the file picker enumerates N different directories immediately (which aren't the active one) that causes a problem yes. I guess allowing enumeration access _anywhere_ (but not file read access) isn't a necessarily a problem.

Re: Sovereign Tech Agency invests €500k in Flatpak

#74

Post by nwellnhof » Fri, Aug 28, 2026, 10:16 AM UTC

ho_schi wrote: post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

> They don’t employ software-developers.

They actually do employ developers: https://www.sovereign.tech/programs/fellowship

> The projects need to apply repeatingly for funding.

Still better than no funding at all.

Re: Sovereign Tech Agency invests €500k in Flatpak

#75

Post by SwellJoe » Fri, Aug 28, 2026, 10:19 AM UTC

jimbob45 wrote: post #44

ho_schi wrote: post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

We do all this self-congratulation around funding OSS companies and then end up with OSS companies that exist only thanks to government subsidization. Why? Isn’t governmental control over funding what we hate about Microsoft? What is so bad about letting real customers decide which companies need funding?

"Isn’t governmental control over funding what we hate about Microsoft?"

No. And, I'm confused why you'd think that's the problem "we" have with Microsoft or any other monopolist.

Re: Sovereign Tech Agency invests €500k in Flatpak

#76

Post by internet_points » Fri, Aug 28, 2026, 10:24 AM UTC

ximm wrote: post #72

a-french-anon wrote: post #27

Earlier quoted context omitted.

Same except for Steam. Hope this money revitalizes bubblewrap's development, it'd be nice to get proper signal handling cleanup up then merged (even util-linux's unshare has it, these days).

I have bad news for you: The flatpak developers plan to stop using bubblewrap. They say it is no longer necessary because most distros now support unprivileged user namespaces. https://youtu.be/NsVhkz2Xl0E?si=-ypxvTlRukCZLql9

I tried to find out what unprivileged user namespaces was, and all I can find is people talking loudly about how insecure they are, e.g. https://secureblue.dev/articles/userns

But does bubblewrap also use them?

Re: Sovereign Tech Agency invests €500k in Flatpak

#77

Post by vrighter » Fri, Aug 28, 2026, 10:25 AM UTC

Flatpak: adjust permissions here, workaround there, different workaround for a different DE.

My solution: I'm very careful about what I run, but when I do run it, I just do. No fanfare. No security theater.

Re: Sovereign Tech Agency invests €500k in Flatpak

#78

Post by preya2k » Fri, Aug 28, 2026, 10:39 AM UTC

nwellnhof wrote: post #74

ho_schi wrote: post #39

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to en…

> They don’t employ software-developers. They actually do employ developers: https://www.sovereign.tech/programs/fellowship > The projects need to apply repeatingly for funding. Still better than no funding at all.

I don't think the Fellowship qualifies as "working for STF". These people are being paid/supported for the work they do in their own projects. They're not being paid to work on/work for STF to help them steer/analyze/control the other projects that are being funded.

EDIT: OPs comment can be understood in multiple ways: Should STF hire Developers to work on their own projects, or should they hire Developers to understand/guide/manage the funded projects in a better way.

Re: Sovereign Tech Agency invests €500k in Flatpak

#79

Post by [deleted] » Fri, Aug 28, 2026, 10:41 AM UTC

preya2k wrote: post #78

nwellnhof wrote: post #74

Earlier quoted context omitted.

> They don’t employ software-developers. They actually do employ developers: https://www.sovereign.tech/programs/fellowship > The projects need to apply repeatingly for funding. Still better than no funding at all.

I don't think the Fellowship qualifies as "working for STF". These people are being paid/supported for the work they do in their own projects. They're not being paid to work on/work for STF to help them steer/analyze/control the other projects that are being funded. EDIT: OPs comment can be understood in multiple ways: Should STF hire Developers to work on their own projects, or should they hire Developers to underst…

[deleted]

Re: Sovereign Tech Agency invests €500k in Flatpak

#80

Post by account42 » Fri, Aug 28, 2026, 10:45 AM UTC

vaylian wrote: post #8

TekMol wrote: post #2

I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside o…

> But I would much prefer a "An application is a directory and by default cannot access anything outside of that directory" approach. That makes sense if the application is the only program that needs to interact with the data. For example: If you have a drawing or photo editing program. You might have downloaded an image from the internet or from your camera. Then you make some edits. Afterwards you want to send the…

Exactly, and for many productivity tasks there can be even more applications involved. There is a reason why the restricted model was introduced on consumption-oriented mobile platforms first.