Flatpak – a security nightmare
flatkill.org
Flatpak – a security nightmare
1–10 of 264 posts
Re: Flatpak – a security nightmare
#2I share this writer's concerns with Flatpak. It looks to me like yet another attempt to bring the horribly broken and insecure "download it and drag it to your desktop" model of application distribution, which has long been a source of viruses and malware on Windows and Macs, to Linux.
Re: Flatpak – a security nightmare
#3oy. i'm not at all familiar with it but the author comes off as being on his game so i'll take it at face value.
beyond disappointing that RH would release such a thing.
Re: Flatpak – a security nightmare
#4Is the sandboxing of flatpak more or less secure than docker?
Re: Flatpak – a security nightmare
#5Wait a minute, did somebody get so pissed at flatpak that they bought a domain name just to specifically host that single blog post?
Re: Flatpak – a security nightmare
#6> Sadly, it's obvious Red Hat developers working on flatpak do not care about security, yet the self-proclaimed goal is to replace desktop application distribution - a cornerstone of linux security.
Sheesh, while the issues raised are all valid, this does not actually justify such a conclusion about the intent of the Red Hat developers. Telling people what their side of the story is for them in a dismissive fashion like this is not going to make it more likely that they admit their mistakes.
A bit of Hanlon's Razor[0] goes a long way to resolve problems involving human cooperation (of any kind) more smoothly.
Re: Flatpak – a security nightmare
#7Wait a minute, did somebody get so pissed at flatpak that they bought a domain name just to specifically host that single blog post?
Domains are cheap. Often free for one year.
Re: Flatpak – a security nightmare
#8Is the sandboxing of flatpak more or less secure than docker?
As I understand it, from reading this page it doesn't actually matter much how secure the sandbox is as many applications effectively disable it.
Re: Flatpak – a security nightmare
#9Is the sandboxing of flatpak more or less secure than docker?
They use a lot of similar techniques. One big difference is that docker uses user namespaces and flatpak does not. I'n not sure about the reasoning, but it's probably a combo of "not trusting user namespaces" (disagree) and user namespaces requiring privileges to use.
It sounds like the bigger issue isn't that the underlying technologies are fundamentally better or worse, but that the de facto configurations are worse. In particular, the median docker container can not write to my home directory. The median flatpak can.
Despite the ordering, the "no updates" seems like a way worse issue than the "most of the sandboxing is ineffective". It seems pretty clear to me that a lot of apps need wide access and the first person who does a great job at that will do us all a big security favor but we're not there yet in terms of UX. Sometimes I really want my text editor to edit my bashrc. Maybe that should require a privilege escalation, that's fine.
Re: Flatpak – a security nightmare
#10Is the sandboxing of flatpak more or less secure than docker?
What's better to hold water, a colander or a sieve?
Which is to say, when you hand out the privileges laid out in the article, it really doesn't matter what software you used to whitelist "every thing".