Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Flatpak – still a security nightmare – 2 years later (2020) (flatkill.org)
23 points by metadat on Oct 24, 2022 | hide | past | favorite | 13 comments


In addition to the problems mentioned there, the sandbox capability is deficient; there does not seem to be any reasonable way to do things such as:

- Dealing with non-Unicode text (including file names).

- Running external user-specified programs by pipes (popen), and/or user-specified dynamic libraries.

- Sandboxed X resource manager access and X toolkit intrinsics.

- Because it uses systemd, all of the problems of systemd also apply.

The design of D-Bus is also full of problems.

I do not use a desktop environment on my computer, and I should not need one. Programs should not need to draw their own window decorations. There are other issues, too (some of which are mentioned on the web page about the security problems). GTK also has many problems.

The blue "sandboxed" icon is not very good if it does not elaborate the specifics of the sandboxing (and, ideally, should allow user customization of the sandbox settings).

The system should not make it difficult for programs to be used together. Unfortunately, many programs do (although I try to fix this; use of user-specified commands with popen is one thing that should help, but some things will just need much of the existing designs to be corrected or entirely replaced).


> Because it uses systemd, all of the problems of systemd also apply.

It works on Void and Alpine, though? Are you saying that the security model is degraded there?


(2020) - plus this has been debunked but I haven't saved link for where it is - if someone knows please post.



None of that debunks the 2020 article. It sounds like they kind of fixed some of the stuff a year later, but it's still largely broken. Am I missing something?


Yeah, they "partially agree" for some point, and "partially disagree" for some other point. Does not sound like they "debunk".


Here's a page (2018) which defends Flatpak wrt security: https://www.omgubuntu.co.uk/2018/10/new-website-claims-flatp...



Before Flatpak I had tons also of unaudited repositories too, binaries in my home, appimages (I still have some of this) ... Flatpak have tons of things yet to improve (security ones the more worrisome), but it is a step forward from what we had before (specially if your workflow needs many apps that should be always updated).


User repository with no assurance that apps are integrated properly with the framework. Applications that are packaged to just spawn on the host, that is outside the sandbox, are accepted and distributed on flathub. Its all over, but you are naturally checking every runtime and app manifest to ensure otherwise.


I still avoid using flatpak due to the lack of proper integration. Flatseal helps a lot in fixing some of those issues (at least in Fedora) but I would rather go and find an .rpm or .deb than rely on Flathub for anything but a quick test to see if I like an application.


What's the security profile of flatpak compared to the security profile of deb/yum/nix?

That seems to be the only question for me. Like, if firefox can access my user folder, great, but what's the alternative? Running firefox in a vm?


> Like, if firefox can access my user folder, great, but what's the alternative? Running firefox in a vm?

Firejail, bubblewrap, docker, VM.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: