Flatpak – a security nightmare • Hacker News Board

Re: Flatpak – a security nightmare

#261

Post by gbraad » Fri, Oct 12, 2018, 9:20 AM UTC

gbraad wrote: post #100

kilburn wrote: post #24

Earlier quoted context omitted.

> A bit of Hanlon's Razor[0] goes a long way to resolve problems involving human cooperation (of any kind) more smoothly. I don't like the snarky tone of the article, but I really thing you're being naive here. Let's examine the facts: - Flatpak's intent is clear and stated first in in their homepage [1]: "Flatpak is a next-generation technology for building and distributing desktop applications on Linux" - Red Hat i…

Fedora and Red Hat are not the same thing. Sure, there is a relation between the two, but inclusion in Fedora is not an endorsement or guaranteed inclusion in RHEL. I just wonder why the author of this page does not disclose his name... And even hides this from the whois info. This could have been written by a person with a grudge for all I am concerned. Sure, improvements might be needed, but haa the author tried to…

Nowhere on the page they claim to be secure. See also the https://flatpak.org/faq/. they are aware that security benefits at the moment are at a minimum.

Perhaps the term 'sandboxing'is being misunderstood as it was with docker. This is not per se a means of providing security.

Re: Flatpak – a security nightmare

#262

Post by gbraad » Fri, Oct 12, 2018, 9:21 AM UTC

dpwm wrote: post #142

gbraad wrote: post #100

Earlier quoted context omitted.

Fedora and Red Hat are not the same thing. Sure, there is a relation between the two, but inclusion in Fedora is not an endorsement or guaranteed inclusion in RHEL. I just wonder why the author of this page does not disclose his name... And even hides this from the whois info. This could have been written by a person with a grudge for all I am concerned. Sure, improvements might be needed, but haa the author tried to…

> I just wonder why the author of this page does not disclose his name... > And even hides this from the whois info. The registrant country is listed as France and the registrar is OVH. They are simply adhering to the GDPR. I have domains that have been like this since May, even though I would be quite happy to have everything public. > This could have been written by a person with a grudge for all I am concerned. Yo…

Flatpak does not claim to be secure. This is also clearly stated in the FAQ. They provide a means of separation of applications. Sandboxing is not per se a form of security, just like this was with Docker in the 'early days'.

Re: Flatpak – a security nightmare

#263

Post by megous » Sun, Oct 14, 2018, 11:50 PM UTC

wmf wrote: post #145

megous wrote: post #139

What's cross-platform experience for packagers/builders? Seems like you can't do cross-compilation, so expecting upstream to provide flatpaks for users is expecting upstream to manage virtual or real machines for every [desired] CPU architecture with all the annoying host distro installation/management, networking stuff, etc.? At least with the current model, upstream developers can offload most of that to distributi…

In reality every desired CPU architecture is x86-64.

I have GNU/Linux desktops on armv7 and aarch64, and i686 laptop. So with this attitude, flatpak is mostly worthless to me.

Re: Flatpak – a security nightmare

#264

Post by laurent123456 » Mon, Oct 15, 2018, 3:33 PM UTC

jbk wrote: post #260

laurent123456 wrote: post #197

Earlier quoted context omitted.

Thanks for sharing the info. I'm just curious - how would splitting VLC into multi processes solve the permission issue, since the sub-processes will still need access anyway?

Each subprocess would only get one permission, the one that it actually need. The critical parts (audio decoders, video decoders, parsers) would not get access to $HOME or network, for example.

Thanks, that makes sense.