Response to “Flatpak Is Not the Future”

I'm always surprised to see discussions about desktop Linux software place such a heavy emphasis on the security aspect. In practice, malicious software (which is ubiquitous on other platforms in the form of adware and apps stealing personal information) is almost a non-issue on the Linux desktop platform. And I don't see it becoming a bigger issue in the future either. The desktop Linux market is too small and too fragmented, and its clientele are too tech-savvy and privacy-aware on average, to be of interest to Big Ads and co.

The elephant-in-the-room issue, and the one that any debate about the Linux desktop as a platform must necessarily focus on, is: How do I get my application to my users? For historical reasons, there hasn't been a good answer to this question for a long, long time, and anything that improves on the status quo (Flatpak, Snap, AppImage) is indeed (part of) "the future".

Of course, this being Linux, "the future" won't consist of "this one thing that everybody uses". If that's the goal, it was unattainable from the beginning. I love that Flatpak is repository-agnostic. I love that Snap applications update automatically. But most importantly, I love that I have a choice between the two.

> How do I get my application to my users?

I was concerned about that but I just thought of it. For example I want to install VSC on a new device, I go to their website and download binary or .deb file.

It is nice to be trusted/be sudo apt installable say... But also requires being vetted I believe.

I'm case of KDE they have their software "marketplace" which to my surprise had a lot of options. (Context was Pinephone)

Pretty much anyone can avoid at least 90% of malware really easily these days.

You just don't install things from media sharing sites with full page ads, and if it doesn't have it's own subreddit and nobody blogs about it... never mind you're going to install cleanmyram.exe.deb anyway aren't you?

NPM supply chain attacks are slightly scary, but for now it seems to happen a lot less in popular apps than it does in the smaller stuff.

I think Linux probably will eventually pick a "Thing everyone uses", it will just have a significant minority that reject it, like with systemd or NetworkManager.

Another factors is that most of the software used by an average linux user is curated by the distro repository maintainers. Moreover, free software is almost always privacy-respecting, so you don't really need much in the way of security to use them, unlike on other systems. I think these new packaging solutions are only really meant to push proprietary software onto linux.

> Regardless, I personally believe that it is unfair to blame the backend utility (Flatpak) for an issue caused by the frontend (GNOME Software).

There is no good Flatpak fronted to compare it to. The Flatpak project seems to believe it is Somebody Else's Problem, and consequently when everyone else poorly integrates Flatpak support into their traditional package manager frontend the Flatpak project gets to wipe their hands of it and say it isn't their fault. As a user, I don't really care who is at fault for a bad user experience if there is no good user experience alternative, and the lack of one reflects poorly on Flatpak regardless of who they believe is at fault.

That said, I'll take Flatpak over the traditional package manager with its limited and out of date software collection that requires an army of volunteer middle men to prop up.