this post was submitted on 23 Jun 2023
56 points (92.4% liked)
Open Source
31206 readers
115 users here now
All about open source! Feel free to ask questions, and share news, and interesting stuff!
Useful Links
- Open Source Initiative
- Free Software Foundation
- Electronic Frontier Foundation
- Software Freedom Conservancy
- It's FOSS
- Android FOSS Apps Megathread
Rules
- Posts must be relevant to the open source ideology
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon from opensource.org, but we are not affiliated with them.
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Ah, if it's only available on flatpaks, that's why few people know about it.
Flatpak is a very insecure method to download software BTW, you probably should avoid it
Edit: It's curious that I'm getting downvoted for stating a fact. It seems a lot of flatpak users don't understand security. But that's kinda the point: even the flatpak developers don't understand the difference between integrity and authenticity
Flatpak currently does not provide authenticity, and one developer made it clear that he doesn't understand why that matters in the above ticket that requested signatures of packages back in 2016. It's been 7 years and still they haven't fixed this. I don't think the flatpak team understands or cares about security.
Flatpaks aren't any less secure than any other installation option, where did you get that idea from?
This is misinformation. Flatpaks are far less secure than installing from apt. All packages installed from apt are cryptographically signed. This isn't the case with flatpaks.
Hey, let's just have a discussion without calling each other misinformation. I have made my claim and you have made yours.
Now, it is true that apt packages are signed with GPG. However, the same is also true for Flatpak packages. https://docs.flatpak.org/en/latest/flatpak-builder.html#signing
You can see Flathub's GPG key by downloading https://flathub.org/repo/flathub.flatpakrepo and
cating it.When it comes to supply chain security, Flathub's centralized nature allows for additional security than traditional distro packaging, as packages can come directly from app developers. https://docs.flathub.org/docs/for-app-authors/verification
Of course, I would love to see also reproducible builds like nix, and/or SBOMs like Docker, but these are not very popular security tools at the moment.
I'm not calling you names, I'm calling you out on misinformation. There is such a thing as facts, and it's important that we don't misconstrue them.
Optional signing of commits in git is not the same thing as mandatory signing of all packages.
Fact: If I download software with apt in Debian, It's 100% going to verify the cryptographic authenticity of that package. If the signature doesn't match, it won't proceed with the install (unless I choose to override the warning).
Fact: If I download software with flatpak, it may download maliciously modified software and install it without verifying its authenticity.
I'm not aware of any way to configure flatpak to force it to verify the signature of releases between download & install (so if the signature is unavailable or invalid, it does not install the software). Again, flatpak is not a safe way to download software, and I don't think it's possible to configure it to be safe.
If I'm the one spreading misinformation, then show me the documentation from flatpak that indicates that all packages are verified by their PGP key after download.
I think it's a fairly reasonable expectation that a software repo won't download malicious software. Flatpak doesn't do that.
The first link I sent says that flatpak does not allow users to override GPG and allow unsigned flatpaks unless they are root.
That's not users of flstpak, that's developers. This applies to developers uploading to flstpak. There isnot security for end-users downloading from flatpaks.
I don't think it is, I remember something like rpm, but im really new to Linux.
Why is that? Could you elaborate further? you peaked my interest.
Cryptographic signatures of releases are not required for all packages in flatpaks. They are for packages installed in apt.
Thanks for the heads up man, appreciate it.