I usually trust my distro repos without checking. Can the same be applied to flathub without much worry?

  • ZephrC@lemm.ee
    link
    fedilink
    arrow-up
    2
    ·
    1 year ago

    I’ve never heard of anyone getting an unsafe package from flathub, but they certainly aren’t all as thoroughly vetted as stuff from a well maintained distro. Any major package is almost certainly fine, but if you’re downloading something obscure I’d use Flatseal to make sure it’s very well sandboxed, just in case.

    They’ve also recently added verified checkmarks to the website for flatpaks that are officially maintained by the developers of the app, so that’s another thing to look out for.

  • RegalPotoo@lemmy.world
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    They aren’t inherently safe. I don’t have any examples of Flatpak packages off FlatHub being poisoned, but FlatHub does allow “community” maintained packages - as in, someone unaffiliated with the development team of an app packages and publishes the app to FlatHub. That would seem to be a really good place to get into a supply chain if you were a bar actor.

  • qwesx@kbin.social
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    Even disregarding the trust issues with Flatpak packages made by random people: Packages often contain versions of some libraries in order to not depend on the distro’s. If there are security vulnerabilities in a library then the distro maintainers usually fix it very quickly (if not go find a better distro) and it’s fixed for all packages on your system that depend on it. But this doesn’t apply to Flatpak where the package providers have to update the libraries in their own package - and the track record isn’t great. Sandboxing doesn’t help if that vulnerability leads to wiping your home directory.

  • Grangle1@lemmy.world
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    Flathub is likely safer than most other places to get flatpaks from, certainly safer than just some random repo you find on some guy’s website somewhere, but no software source is guaranteed to be 100% safe.

  • Flathub apps will likely be removed quickly if they’re found to be malicious. They’re slightly more unsafe than official repos, but you should be fine. Make sure to carefully check apps with like 4 downloads though.

  • ono@lemmy.ca
    link
    fedilink
    arrow-up
    1
    ·
    edit-2
    1 year ago

    No, they are not always safe.

    Be picky about what you install, and vigilant about permissions.

    • iopq@latte.isnot.coffee
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      Needlessly reductionist, but also wrong. If your code is proven to work (like, machine verified), and you use a compiler that is also verified to generate correct code, then that code is secure.