Nice
Good to see one of the two big packaging hubs do something against malware
Next step, display the “potential unsafe”-badge next to verified or unverified, that can be found on the same page. In example https://flathub.org/apps/io.github.shiiion.primehack is marked as verified, but if you scroll down you can see the application has full system and data access and is marked as potential unsafe.
Verification doesnt help at all if the source is not trusted. All this says is “upstream developers maintain this package”. Unofficial packages can be safe too, like VLC.
deleted by creator
If you create malware and publish it on flathub, you are the upstream dev. But for sure it helps against duplicate scams.
deleted by creator
Nice!
Add flathub with
--subset=verifiedand get apps you really need from their .flatpakref files
Flathub is doing more and more, but stuff like hiding
--subset=verifiedis very bad.They simply need to gain critical mass until they can force changes like portals etc.
Fedora has their own flatpak repo built from their own rpms and their own runtime. Flathub has more flatpaks though.
This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.
At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.
deleted by creator
That’s my point, it does not “help” preventing from malware from being downloaded.
deleted by creator
cough cough snap cough
Snap already marks unverified apps
Yet Ubuntu still recommends installing anything from the terminal if a command was found in a rando unverified snap.
How does that Help against Malware?
deleted by creator
Apt has done this forever
Traditional GNU/Linux distributions (as well as F-Droid) are not “app stores” even though they are superficially similar. Traditional distributions are maintained and curated by the community, and serve the interests of users first and software developers second, whereas an “app store” has minimal curation and serves the needs of software developers first and users second.
I point this out because there’s an annoying meme that traditional distributions are obsoleted by the “app store” model. I don’t think that’s the case. “Verification” is essential for an app store but pointless for a distribution.
great, when appimage hub begin doing this
I still don’t understand why a central repository for AppImages exist. The moment you are using a repository (and possibly version management), the format looses its reason to exist.
I don’t see how that’s true. The main point of AppImage is it ‘just works’ on any distro. If you have one primary place to distribute them to any distro - it’s still meeting AppImage’s vision.
To be fair, after some thinking I think you are right and I was a bit in a tunnel vision logic. My previous statement looks a bit foolish now.
No. Appimages are selfcontained and thus useful for archiving software or carrying it around in random ways. Flatpak could do this too but not as easy.
I personally use a few AppImages, but want replace them with Flatpaks. Flatpaks have their own issues, and because I did not want to troubleshoot in case I encounter another issue, just carry on using AppImages for these selected applications. Also I was not able to archive Flatpak easily, its very complicated with keys and not. Compared to it, I just have the AppImages included in my regular backup process with regular files.
My point was not if AppImages are useful (they clearly are and I use them), but was talking bout repositories. However after some other replies I thought about it and indeed such a repository makes sense even for AppImages. I personally just don’t have to use them.
Even with such a repo they are highly insecure by design.
Not really. AppImages are as much secure as any other executable you run on your system. If you download it from a trusted source, like you download trusted Flatpaks or your systems repository, then they are not worse. If you say AppImages are highly insecure, because you run executable code, then you have to take that logic to any other executable format. The problem is not the format itself that makes it insecure, it’s the source.
No they arent. Please read the linked post.
I read that page and there is nonsense included too. Just because I read that page does not make it correct. If you think that AppImages insecure, then you did not understand my point that its not the format thats insecure, but the source where you get the files. Every packaging system is insecure if you get it from bad source.
That’s not even a question. AppImages are fine and not insecure if you download it from a secure place you trust (like your system packages, you trust your distro maintainer fully). Would you trust every distribution maintainer on every distribution? Let’s say a Chinese Linux distribution, that maintains Flatpaks and native packages. Let’s say they are flaky. See? It’s the source you don’t trust, not the file format or packaging system.
Read my replies (just like you said I should read the linked post). And understand the issues.
So all of them?
Would be nice if FlatHub actually supported cryptographic verification of apps…
What app is that GUI from?
This screenshot is from the Flathub website. The only good GUI for Flatpaks…
The only good GUI for Flatpaks…
Ain’t that the truth. I don’t know why KDE Discover is so sluggish when it comes to Flatpak, it takes me like 10+ seconds to load the landing page and see the popular apps.
And several minutes to update a 10MB app…
what? there’s something wrong with your internet
Nah, it’s Discover that’s shit. Flatpak’s CLI works fine.
Seriously why does Gnome software feel so much faster!
First time I’ve heard someone call Gnome Software fast. In my experience that app feels like it’s on it’s last legs; the Flatpak CLI is far better than any desktop GUI.
Gnome Software has received numerous updates over the last few years which make it considerable faster. Searching and viewing apps is now fast enough to be usable, compared to it taking many seconds to minutes for basic tasks.
I’ve stopped removing Software on every system, altough I’m not usually using it. I’ve not tested it, but I feel like Discover is now slower than Software.
COSMIC Appstore ;D
I’m not saying it’s fast; I’m saying that it’s faster than KDE Discover
My main issue with Gnome Software is if I queue something to install, and go back to browse for more apps, once something is done installing it “refreshed” and I lose the spot I was at. Makes me feel I can only install one thing at a time.
Gnome Software is pretty similar. KDE Discover way worse.
deleted by creator
