Below are 2 screenshots from GNOME Software.
Flatpak version is advertised as unsafe. I’m aware of the exact permissions required by the app from the json file and while installing the app from command line. So, I don’t have any issues with this.
But, how will this give confidence to any new user trying to install flatpaks ?
This is just going to be the case with most, if not all, development applications.
GNOME Builder requires full access to the session bus and spawn processes on the host to perform its function, for example. An application that can do these things is obviously not sandboxed in any meaningful way, so it is marked as unsafe.
Probably more misleading is the fact that software from package managers is judged by a different standard. The default debian package is no doubt completely unsandboxed, but its made to seem that it’s somehow safer.
It’s assumed that software packaged by a distribution has seen some reasonable review; after all, you’re already trusting the people who put together your OS, so a package from the same people should be trusted roughly the same way.
I agree. But my main issue here is:
“Unsafe” with red exclamation should NOT be given to packages which have [2][3] and [4].
At worst, packages with [2][3] and [4] should be given a “Potentially unsafe” rating with some yellow exclamation, and at best “Safe” rating.
For packages which are flatpak only and do not pass [2][3] and [4], the current rules are acceptable, and “unsafe” with red exclamation is totally fine.
My point is that there should be some differentiation between “really unsafe” flatpaks ( which are not fully sandboxed and do not pass [2][3] and [4] ) and “technically unsafe to be accurate” flatpaks.
I think the reason for this is the fact that distributions have at least “some” control during packaging and some QA / testing infrastructure in place to guarantee minimal safety, if not a comprehensive one, which is not the case with flatpaks.
Anything using with --filesystem=host is effectively not sandboxed. There is also no real way to know if the version of a Flatpak app actually matches what is packaged by the distribution. Also I suspect opinions will vary greatly on what it means to be a popular / well known package, what kind of justification would there be for GNOME Builder to have preference over any other IDE so it gets to be marked safe, and they do not?
See I think the problem is mixing two different trust models. In one case you’re saying “I trust this application because it’s from a trusted source” and in the other you’re saying “I’m trusting Flatpak’s technology to contain this application”.
I’m also not convinced that merely being a distribution package qualifies as reviewed, certainly not in all cases. Ubuntu, for example, only guarantees support and security updates for specific packages.
I’d suggest that “secure” and “trusted source” are not the same thing, whether the source is a distribution or well-known developer. I especially don’t think they should presented in a way that conflates the two, unless this happens to consider whether the package is actually supported, with regard to security review, backports etc.
I agree with Andy. This inconsistent UI is currently harmful, not helpful.
I have a bug report here and my intention is to remove this UI via downstream patching until it can be fixed properly.
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
