Hacker News Reader

Comment by eyberg | Hacker News Reader

> flatpak: I really like software distribution done with flatpak, packages are all running in their own namespace, they can't access all the file system, you can roll back to a previous version, and do some interesting stuff

As of today flatpak still has holes you can drive a truck through.

View on HN

Use flatseal with flatpak.

https://github.com/tchx84/Flatseal

I still don't understand the slapdash approach the desktop Linux crowd took, Qubes is a much better approach. Such unprofessional software engineering pervades FLOSS with the worn and tired "but it's a hobby project" when it's a core dependency necessary for international corporate, government, and military strategic systems. (I also don't understand the lack of appropriate support for critical projects either, but it makes sense because of decline, entitlement, corruption, and greed.)

I had to shout and scream at docker early on for container image integrity, but that fell on deaf ears. Heck, Python even threw away GPG to roll their own sketchy setup and Ruby doesn't even care about package integrity or supply chain attacks.

qubes is x86-only that's why people hate it

Perhaps it's the "corporate, government and military strategic systems" doing it wrong, if they choose to rely on a hobbyist project? Not the hobbyist publishing their sources?

Could you link some related Flatpak issues where this happens? I've been under the impression that security under bwrap could be relatively acceptable and mostly the same as running containers (aside from all the portals).

I haven't been using Flatpak, but was recently thinking about it.

flatpack for isolation is a joke. All the file duplication, none of the security. Not to mention nothing that depends on camera, screen cap, etc will ever get close to working.

Just accepting there's no easy solution, and do aparmour+firejail. It's awful user experience, but at least only once per application. Then it is perfect. There should be a distro like qubes but where everything must have either a firejail profile or a hardened systemd unit file (which is the worse designed/documented thing in the universe, taking the place of X11). That would be the ideal world.

To be hones I appreciate flatpak for software distribution. Afaik (correct me if I’m wrong) some degree of security is implemented through selinux (i’m on fedora).

> implemented through selinux

Yes, you are technically right, but you are wrong only in the sense that most packs either do not ship with a selinux policy or ship with some just-added-whatever policy.

> I appreciate flatpak for software distribution

Flatpack is for distributors. Not end users or for the benefit of the end system running them. There are already too much written about this. The lax state of selinux policies is also a result of this focus.

PS: you will see my top comment get downvoted by the distributors who enjoy to offload the burden to end users, without offering any counter argument.

"Let's blame flatpak for softwares that don't support it"

best argument I've heard against my points so far. but still, since the other solutions require the same amount of work for isolation, the only real benefit of flatpak is bundling soon-to-be-outdate dependencies.

Reply on news.ycombinator.com