Next step, display the “potential unsafe”-badge next to verified or unverified, that can be found on the same page. In example https://flathub.org/apps/io.github.shiiion.primehack is marked as verified, but if you scroll down you can see the application has full system and data access and is marked as potential unsafe.
Verification doesnt help at all if the source is not trusted. All this says is “upstream developers maintain this package”. Unofficial packages can be safe too, like VLC.
This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.
At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.
Nice
Good to see one of the two big packaging hubs do something against malware
Next step, display the “potential unsafe”-badge next to verified or unverified, that can be found on the same page. In example https://flathub.org/apps/io.github.shiiion.primehack is marked as verified, but if you scroll down you can see the application has full system and data access and is marked as potential unsafe.
Verification doesnt help at all if the source is not trusted. All this says is “upstream developers maintain this package”. Unofficial packages can be safe too, like VLC.
deleted by creator
If you create malware and publish it on flathub, you are the upstream dev. But for sure it helps against duplicate scams.
deleted by creator
Nice!
Add flathub with
--subset=verifiedand get apps you really need from their .flatpakref filesFlathub is doing more and more, but stuff like hiding
--subset=verifiedis very bad.They simply need to gain critical mass until they can force changes like portals etc.
Fedora has their own flatpak repo built from their own rpms and their own runtime. Flathub has more flatpaks though.
This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.
At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.
deleted by creator
That’s my point, it does not “help” preventing from malware from being downloaded.
deleted by creator
cough cough snap cough
Snap already marks unverified apps
Yet Ubuntu still recommends installing anything from the terminal if a command was found in a rando unverified snap.
How does that Help against Malware?
deleted by creator
Apt has done this forever