I see that it can be slower because of having all the dependencies included with the flatpak itself instead of relying solely on whats installed on the system. I read that this means it isolates or sandboxes itself from the rest of the system.
Does this not mean that it can’t infect the rest of the system even if it had malware?
I have seen people say that it isnt good for security because sometimes they force you to use a specific version of certain dependencies that often times are outdated but I’m wondering why that would matter if it was truly sandboxed and isolated.
Do they mean that installing flatpak itself is a security risk or that also specific flatpaks can be security risks themselves?
Flatpak does NOT provide sandboxing. It containerises your applications. It’s better for permission management but by no means make the system invulnerable from malware.
Linux users will do anything to avoid using an honest-to-god command-line package manager.
I don’t think speed is an issue. They’re larger but all software loads dependencies from disk, flatpaks just have them bundled into a different location.
Snap did have some loading time issues but in terms of performance, I don’t think there was much measurable difference.
The flatpak sandbox shouldn’t be considered secure against malware. It is more of a loose sandbox.
It is technically possible for a flatpak to ship a insecure library. However, that’s not unique to flatpak and I’ve never actually heard of that happening (I’m sure it had)
I see that it can be slower because of having all the dependencies included with the flatpak itself instead of relying solely on whats installed on the system.
No. Packing its own libraries wouldn’t make it slower. If anything it would be the extra access checks added by the sandbox (which is optional FWIW, apps don’t have to use it). I haven’t ever used Flatpak but I would assume the sandbox impact is minimal if at all noticeable.
There aren’t any “extra access checks” to my knowledge. It’s just the same regular access checks applied to a different set of circumstances.
It is a container so any access to the outside system is passed though.
There are XDG portals but those are just standard ways of accessing a resource.
Go to flathub and check the permission of the application that you want to install. Normally they won’t have access to root directory, but could access your home dir. If they had any malicious intent, they could mess with your personal files.
I think there is another application that can restrict the permission scope on flathub itself.Most flatpaks don’t have full access. You can grant permission via the file picker. (It happens automatically)
Also flatpaks are moving away from file system permissions towards portals. Though currently I wouldn’t see flatpak as much of a security measure.
Flatpak is supposed to be a sandbox, so if there is a vulnerable dependency then in theory any attack would be limited to the sandbox.
However, it depends on the software - some Flatpak need quite low level access to use, and in that case an attack or mlaware could get into the main system. And unfortunately Flatpak itself has vulnerabilities which cna negate the whole idea of a sandbox.
Flatpaks should be using up to date secure dependencies, but the reality is many do not. I would not rely on Flatpak for security. Even fully up to date Flatpaks can be insecure, and Flatpak itself have vulnerabilities that have needed fixing. And for many Flatpaks it’s not even clear who is maintaining them.
Flatpaks are useful for deploying software that’s just not available in your distros repos. But when deploying any software outside your repos - including App Image, build from source or 3rd party repos - you are opening your system up to security vulnerabilities. That’s the nature of installing 3rd party software. Flatpak offers some reassurance compared to some methods but it’s far from perfect.
If security is your prime concern, then Virtual Machines may be more secure route to sandboxing software (if done properly). Building from source would be the other option, as it means you take ont he responsibility for security by using the latest code including for dependencies. But there is no perfect option, it’s always about balancing risk vs convenience.
It’s also worth noting that software repos are also not perfect. But good distros invest a lot of time and effort in keeping them as up to date and secure as possible, usually via the hard work of volunteers.
I wish I saw this post yesterday before I installed VSCode from flathub, trying to get the terminal to see the same file system as my other shells. I got it fixed and learned a lot about flatpak.
There are vulnerabilities found in Flatpak’s sandboxing all the time so it’s pretty much broken. The opening speed on HDD systems is really really bad too. That’s why I only use Flatpak to install software that’s not available in my distro’s repos. Though I use Arch (btw) so distro packages being old isn’t an issue for me.
Do you have current proof that there is security problems in the current stable version of Flatpak? Nothings perfect but bubblewrap should be pretty solid.
Well the sandboxing does help with trustworthy browsers so the websites can’t have excessive permissions. But relying on such a broken system isn’t a very good idea imo.
Sandboxing in the browser is different than the sandboxing done by flatpak.
You really want your browser sandbox to be rock solid as any weakness allows for drive by attacks by websites.
Flatpak uses bubblewrap under the hood so it is just as secure. Flatpak also has a security tracker and when security issues are found they are taken very seriously.
It’s still better than no sandbox at all, isn’t it? And who installs their OS on an HDD in 2024?
It’s still better than no sandbox at all, isn’t it?
I guess so.
And who installs their OS on an HDD in 2024?
Those who earn less than $5k a month (aka 80+% of people in the world).
Nearly all of my friends make less than $5k per month, and all of them have SSDs as the boot drive in their computer.
Yes. 1TB SSDs can be bought new for 50€, 500GB for even less. For some people this is expensive depending in the region (e.g. I also know someone who uses an HDD). But given the price of other pc parts it isn’t something to cheap out on (a 1TB/2TB HDD is also 50€).
It’s not securely sandboxed like a Qube, but apps can have their permission to access files and such restricted. Malware can escape the sandbox, or apps may come with very permissive permissions.
Also the sandbox won’t prevent social engineering
