Earlier quoted context omitted.
Yeah, Flatpak has some kind of hangup about the idea that some tools need actually real full access to the system. Wireshark is similarly useless because you can't actually capture packets with it. It is really strange that both this and "it's totally ok for packages to set their own security defaults" are true in Flatpak land.
If Linux starts attracting commercial development and we see an influx of new apps, wouldn't you feel safe knowing that the ones you install as flatpaks aren't allowed to capture packets on your system? Wireshark is a tool more in the realm of development/sysadminry, whereas flatpaks are designed for more traditional apps, like Discord or Firefox. I wouldn't want my development tools to come from flatpaks even if the…
See, here's the problem with letting packages determine their own defaults. I want the ability to give a Flatpak those permissions, not that they be able to give them to themselves. As it is, Flatpaks can give themselves permission to $HOME without ever notifying me, which I think is just as silly.
In my opinion, Flatpak should support a user-definable default permissions template that says "always permit", "always deny", and "don't care" for any given permission.
> you have Toolbox for that
Actually I agree that when it comes to these collections of software to build an "environment" something like toolbox/distrobox is a better fit. I have my issues with both[0], but the base concept is sound.
[0] For instance: why is podman required? The container functionality required is built into the kernel and podman has a lot of features that are entirely unused. Even bubblewrap has all that's needed and it is included anyway because of Flatpak. I will probably end up writing my own replacement for these tools.