Distributors entering Flatpakland [LWN.net]

Distributors entering Flatpakland

Posted Jul 9, 2022 20:39 UTC (Sat) by atnot (guest, #124910)
In reply to: Distributors entering Flatpakland by jafd
Parent article: Distributors entering Flatpakland

> But I get it, learning from past mistakes and current mistakes of the competition is *hard*. Let’s grow, let’s hype what we don’t have, let’s fix it later or maybe never.

Please do tell me what your alternatives are. Offering a grand selection of five GNOME apps? Giving users alert fatigue by showing a big red banner for every large application? Hosting broken applications and ensuring the users' next course of action is purging Flatpak? (Snap has been very good at that.) The Flatpak developers coming in and personally porting every codebase to Wayland and Portals (including proprietary ones like Zoom)? I disagree, Flatpak definitely learned from competitors like UWP in what happens if you try to force people to do things your way overnight.

I get that you want Flatpak to be more than it is. I agree that what you're describing would be wonderful. But what I also see is that it is already a significant increase in security for the average user over what we have right now and lays the technological foundations for it being even more secure in the future. I'm willing to cut it some slack on the things it needs to compromise on to get us there.

to post comments

Distributors entering Flatpakland

Posted Jul 10, 2022 5:05 UTC (Sun) by jonesmz (subscriber, #130234) [Link] (2 responses)

What I'm primarily confused by is that so far nothing that's claimed to be a benefit of flatpack here needs flatpack in order to be provided.

Every single one of the security benefits claimed by flatpack could be provided by traditional packaging systems like dpkg and rpm as an incremental improvement to those packages.

So why flatpack in the first place, if it comes with all this enormous baggage?

Distributors entering Flatpakland

Posted Jul 10, 2022 7:41 UTC (Sun) by pabs (subscriber, #43278) [Link]

I think the primary aim of Flatpak is a separate install directory for each app, so that you can have apps installed that are ABI/API incompatible with the rest of your system. So if you have an app that needs GTK5 but your distro has only GTK4, no worries, just install the Flatpak without needing to backport the app to GTK4 or backport GTK5 to your distro. The other bits were added on top of that.

Distributors entering Flatpakland

Posted Jul 10, 2022 8:31 UTC (Sun) by atnot (guest, #124910) [Link]

> Every single one of the security benefits claimed by flatpack could be provided by traditional packaging systems like dpkg and rpm as an incremental improvement to those packages.

Sure, but are they doing it? Almost universally no, because this kind of sandboxing for linux GUI applications requires a lot of additional work, metada, code changes and considerations and distros don't see a need. As far as I can tell, Flatpak have been the only ones driving these features. It does happen a bit for system services though thanks to systemd's sandboxing features. But getting every maintainer to turn them on has been hard.

If you want to change that go ahead, it would be great!

> So why flatpack in the first place, if it comes with all this enormous baggage?

The primary goal is to make it easier to target applications at Linux. The biggest demographic of Flatpak developers, afaict, is KDE and GNOME developers who were annoyed by the amount of work required to get your application onto every distro and inability to deliver speedy updates. Isolation and sandboxing are just implementation details to make that less haphazard.

Distributors entering Flatpakland

Posted Jul 10, 2022 12:18 UTC (Sun) by jafd (subscriber, #129642) [Link]

In which place did I tell you it was easier?

Learning from the mistakes of the competition is hard. But it’s also vital.

I wouldn’t have anything against distributions just being honest: we adopt and push flatpak on everyone because maintenance of packages is hard and we don’t want to be doing it. Flatpak is also slightly better at removing stuff you don’t need without leftover files. Okay. I can understand that.

This brings us more or less to the level of Windows 7 security where you download all sorts of crap from the internet, and the publisher has the final word.

But offering a sandbox that doesn’t quite protect you, and claiming “hey it’s better than nothing” is vile. It doesn’t provide anything more than a false sense of security. Like a counterfeit bulletproof vest.