HN

Comments (120)

• ndiddy
  It's great that there's more investment being put into Flatpak development. The page mentions adding more granular permissions, which is nice to see. However, another necessary improvement is actually making it possible for software to incorporate these new granular permissions in a backwards compatible manner.As one example, I maintain a game on Flathub that supports game controllers as an input device. By default, access to game controllers are blocked in the sandbox just like access to any other piece of hardware. The only way to use game controllers is to mark your software as requiring a blanket permission that grants access to all devices connected to the user's system. The Flatpak maintainers realized this is problematic, so a few years ago they added a permission to specifically request access to input devices (https://github.com/flatpak/flatpak/pull/5481). However, because the permissions aren't backwards compatible, and because there's LTS distros under active support with old Flatpak versions released before the permission was added, you aren't allowed to use this permission on Flathub, only the blanket "all devices" permission. As a result, Flathub lists my game as "potentially unsafe" because it "can access hardware devices such as webcams and game controllers" since the only other option was disabling controller support on the Flatpak version of the game.If they figure out a way to implement the new permissions so they can fall back to the broader kind on old Flatpak versions, this would be a massive improvement over the current situation. Otherwise you'll have to wait 10+ years before you can use newly added permissions because the only other option is breaking Flatpak on whatever ancient Ubuntu or RHEL version is still under support.
• Menu

  ho_schi
  I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to ensure that this work for the people.We feed for 30 years constantly money into monopolies. We shall feed the next century constantly money into things the people need.Many developers of Linux and GCC are paid. Because companies decided it is necessary.
• Menu

  TekMol
  I never understood why a program installed in Flatpak is not just a directory on disk.When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk.The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside of that directory" approach.
• EffrafaxOfWug
  I avoid flatpaks and snaps as much as I can.Here is a little blog post from 2021 that lists some of the huge issues flatpaks have https://ludocode.com/blog/flatpak-is-not-the-futureIf you want to sandbox your programs highly recommend looking at firejail.
• Menu

  robin_reala
  The Soverign Tech Agency are currently hiring for a Director of Technology. Definitely a dream job for someone. https://www.sovereign.tech/jobs/director-of-technology
• Menu

  j1elo
  I loved Flatpak until I started building a MiniPC with a 112 GB internal disk for HTPC usage... Then I felt the pain of having to get all slightly different dependency versions for each little program I wanted.The box' cost already topped the project's budget so no new disk for it. I'm back to "proper .deb packaging please"
• Menu

  minimeow
  My trust in Flatpak diminished after installing the book reader Calibre and finding that despite the sandboxing Calibre was given blanket access to my drive. Apparently a quirk of the developer behind Calibre insisting upon it. No warnings or communication of the exception were given. All trust I had in Flatpak was eroded from that moment on. Curious about the podman options or similar. Having desktop apps in a container with selective access to system resources seems like it would be more secure and configurable if configured correctly. Flatpak as it stands seems to be a legacy solution to what should be a container and namespacing solution.
• kombine
  Better money spent than on Omarchy.
• Menu

  sdcfgy
  I'd rather they invested €500k in contributing to the maintenance of distribution packages so I don't need to deal with Flatpak (on Debian here).
• Menu

  aradar46
  And Omarchy gets 7mi for being ....you know
• JanisErdmanis
  I like the idea behind Flatpak and the ability to sandbox applications. What I don't understand is why they chose to lock the build process so tightly to Linux.I'm currently on macOS, and while I can cross-compile applications, I can't actually bundle them as Flatpaks. For that, I need `flatpak-builder`, which is so deeply coupled to Linux itself that I don't think it can realistically run on other platforms.Snaps have a similar issue with `snapcraft`. However, you can still build a snap manually with `mksquashfs`, whereas I haven't found an equivalent low-level option for Flatpak. I may be missing something, though, and I'm still looking.
• Menu

  regexorcist
  I use bubblewrap directly, never liked Flatpak.
• Menu

  WhyNotHugo
  A lot of Flatpak's design is a great prototype, but it's somewhat worrying (for the ecosystem in general) that this was taken as a final design and being pushed out in all directions.Portals are just a terrible design for a security boundary: all interfaces clobbered up into one huge daemon, which also deals with a lot of the internals of Flatpak/Snap. If you want your sandbox to use portals, you can't, because it relies on internals of both of these sandboxing mechanisms. The devs have confirmed they won't implement an API for other sandboxing engines to integrate with them.The whole system also deeply intermixes the package manager and sandboxing engine — to the point where you can't use the sandboxing engine with your favourite package manager, and you can't use the package manager without the sandboxing engine.It seems that the mentality is: all other distributions are irrelevant, all other sandboxing engines are unsupported.And then desktop applications start having first-class integration with Flatpak, and start having issues everywhere else.You already need to set up Flatpak's daemons for using some features in Firefox (like screen sharing, where the native interfaces aren't supported), and it seems that the plan is to do the same for other features.
• banger180
  I really like flatpaks to install desktop applications, as mentioned in some other comments the sandbox is sometimes poked full of holes because some applications don't use XDG desktop protals and need full filesystem access. If you are really concerened about this, you can use flatseal to limit the access that the application has.If you prefer other ways of installing your software, that fine. But I really hope flatpaks continue improving and become the de facto way of installing desktop applications across all Linux distributions. For a normal, non-technical user installing and updating software should be easy, and I believe that flatpak provides this.
• Menu

  Nux
  Waste of money."For Modal, a robust app sandboxing story is essential to creating a Free Software OS that is competitive with modern mobile platforms."Why? Focus should be desktop, not mobile.We have enough mobile stuff that creeped in already.
• trlphj
  No one has been fired for sponsoring an IBM (RedHat) project. Well done!
• Menu

  oytis
  Great to see open source projects funded, but the value of Flatpak for tech sovereignty evades me somewhat. It's a pretty niche and questionable piece of technology, and likely won't be there in 10 years. Some grants by STF, like Mastodon, Openstreetmaps, Let's Encrypt, rustls are spot on, but there are many questionable ones.
• vrighter
  Flatpak: adjust permissions here, workaround there, different workaround for a different DE.My solution: I'm very careful about what I run, but when I do run it, I just do. No fanfare. No security theater.
• megous
  Dunno why people try to push app isolation on Linux desktop.It'd be better and more comfortable to make task/workspace isolation easier. You have all your apps installed system wide as usual, and you isolate processes in sandbox per your current task.Isolating individual apps and having to deal with permission prompts and protals, and persistence of permissions is uh, not very user friendly anyway.Feels like this whole flatpak and similar mechanisms is more oriented on bringing in untrusted apps, rather than anything actually comfortable and useful as far as "work" isolation needs go.
• aussieguy1234
  For these Flatpak improvements, are they also going to end up in bubblewrap?
• Menu

  koe123
  Maybe I am too propagandized, but honestly after going Nix I can’t help but feel like this stuff is fundamentally a waste of time
• goodpoint
  flatpak is unsustainable
• Menu

  znpy
  To be honest i don't see how having flatpack going to help the (european/german) "sovereign tech" initiative.A waste of money if you ask me.I think there are much more important issues that should deserve money and attention.
• blizdiddy
  Flatpak is great for installing, but as a happy Aurora user, it’s annoying and it breaks things all the time. Every desktop app i use has some broken feature. Sandboxes as another permissions panel suck. Simple browser-like permissions that allow prompted overwrite would be WAY better!Now i have media organizer programs that deletes my files if i try to write on a networked drive. Games that can’t see the controller. Chat apps that can’t see attachments. Music app that can’t save at all. Good luck accessing any binary and using it in a script.
• redsocksfan45
  [dead]