Flatpak

“Flatpak isn't a proper sandbox due to it not being fine-grained, not being properly run-time based and having numerous sandbox escape possibilities.”

“the distro matters a lot less if you use containers or flatpaks for most things (which I'd recommend)”

“The Flatpak project gets panned all the time. Not for having a weak sandbox (which would be a fair criticism), but for having a sandbox at all”

“I've barely ever had a problem with them, and the problems I did have were solvable with a cursory web search.”

“Flatpak is just a cheap container copy. Can't do anything beyond what cgroups and things like apparmor and selinux can do”

“making it possible for software to incorporate these new granular permissions in a backwards compatible manner”

“Isolating individual apps and having to deal with permission prompts and protals, and persistence of permissions is uh, not very user friendly anyway.”

“it's technically implemented uniformely without thought of user access patterns, then yes it's a bad idea causing friction and frustration”

“Flatpak itself might not survive, but the underlying protocols are relevant for sandboxing on linux as a whole.”

“had to use `--sandbox` with every app and then carefully engineer the permissions so the apps would actually work”

“works way better than any other package system on Linux when it comes to security and distro independence”

“It's trivial to use containerization technologies like flatpak to get software to run on any Linux distro.”

“The Windows way, used by Flatpak and Snap, of targetting known-good sets of libraries will work around that.”

“That is actually very poor design that a user requires a separate app (flatseal) to configure how the sandbox works.”

“I know it's has its rough edges, but I use many apps across arch/Fedora/Ubuntu that are delivered as a single flatpak”

“Now the direction changed with the new team/leadership towards integration, security and control instead of "it works everywhere".”

“Flatpak gives me cross-platform/cross-distro software directly/certified by the project or company that has additional security sandboxing”

“I especially love how flatpak has its own version of graphics drivers, which results in my browser flatpak updating to a version that has a mismatch”

“I know I've noticed a big uplift in stability by using a rolling release base, or Flatpak if stuck on "stable".”

“Flatpak gives me one package to install and a little bit of a minor security boundary around the application.”

“the UX for that is such that most Flatpak non-power-users aren't enforcing sandboxing on Flatpaks they install”

“So you never get stupid popups, and update managers use signed packages and check those signatures before installation.”

“They could at least use Flatpak and containers instead of choosing a given distro or package manager.”

“you could avoid having to think about distro package managers by distributing with something like flatpak”

“Ability to deploy user applications using something like Flatpak which ensures they are used within a sandbox”

“Everybody (except Ubuntu) is pushing for it, from the regular desktop distros like Feodra all the way to image based distros like KDE Linux and Fedora Silverblue.”

“provide a rich but controllable set of features, API/ABI compatibility, while providing zero overhead isolation”

“all the machinations that Flatpak goes through to get userspace Mesa drivers etc. working on a different glibc version than the base system”

“Flatpak seems to be a neat advancement, at least in regard to stopping things from basically uploading your filesystems”

“the user has recourse: you can globally block all installed flatpaks from having access to a specific resource”

“Flathub is very explicit and obnoxious about such unsafe permissions and can easily be modified by the user.”

“Which is how Flatpak does it and you sideline the entire problem of having to authenticate clients on the bus”

“flatpak (available as a slackbuild) allows you to easily install apps you would have had to compile yourself”

“With such security technology existing, giving every application full access to the system is no longer appropriate.”

“things like Flatpak give me, the user, the power over application's permissions and I can take them away (or give more) in a few taps at will”

“where you'd run something untrusted there you'd use Flatpak or something similar where what you wrote doesn't apply”

“Flatpaks, from the source if available, are excellent: you get the latest versions of the app from the official source, with permissions set for a pretty locked-down sandbox.”

“Flatpak steam runs like poo for a lot of people. Really, flatpak should be avoided if there are other installation methods”

“Flatpak is fine for user GUI apps but I don't think it would be feasible to e.g. distribute Rust via a Flatpak.”

“You can trivially sandbox your Steam installation with pretty much zero performance overhead, if you install it through Flatpak.”