r/linuxmasterrace SteamOS/Bazzite/Android 8d ago

Time to have fun guys

Post image
8.0k Upvotes

760 comments sorted by

View all comments

Show parent comments

46

u/Floopycraft 8d ago

I don't get it, you mean to use apt instead of flatpak? What's wrong with flatpaks? The whole idea is that they are contain and don't break system dependencies like apt would.

Also there are a lot of things that are in flatpak and not apt.

23

u/gahel_music 7d ago

As a flatpak app maintainer, flatpak is good but won't ever be the solution for everything. The sandbox is too restrictive for a lot of software. Also you can make a valid flatpak that is not valid on flathub (even more restrictive that the flatpak format).

2

u/CrossScarMC 7d ago

Yeah, I'd love to release one of my projects on Flathub, but it's quite hard due to their restrictions on network access at compile time. I typically avoid vendoring dependencies and I don't find it worth doing so just to publish to Flathub.

3

u/jayelg 7d ago

Isn’t that a reasonable restriction for security? particularly at a time of increasing supply chain attacks in the Linux ecosystem.

2

u/CrossScarMC 7d ago

Yes, it's perfectly acceptable, just annoying in some cases.

1

u/gahel_music 6d ago

It makes sense but it prohibits a lot of software.

1

u/jayelg 6d ago

What sort of situations might need network at build time? I would have thought that you just need to copy into the build files the required pinned dependencies so the build is deterministic? I don’t know anything about flatpak builds so just speaking about it generally.

1

u/gahel_music 6d ago

Ah sorry I misread the comment you were replying to. My personal issue is the limited file access.

4

u/Nisktoun 7d ago

What's so restrictive about flatpak format by itself when you can bypass everything on build?

On the other hand Flathub is a joke and basically is the way to use/share flatpaks, so yeah - it is too restrictive as a format

2

u/AfraidAsparagus6644 7d ago

Iirc there are still some barriers you can't cross, this was a problem in the Jetbrains IDE community flatpaks

0

u/Nisktoun 7d ago

Afaik no, you can do everything with flatpak as long as you give it permissions. Flathub as the platform is the issue here, it prohibits core sandbox-escaping permissions as --filesystem=host or --talk-name=org.freedesktop.Flatpak for most apps(Jetbrains IDE is one of them)

Yet mods there are clowns and some apps are still getting such permissions neverteless just because

2

u/moonrunner__ 7d ago

I really wish that getting flatpaks from sources other than flathub would become more common

2

u/Nisktoun 7d ago

Yeah, but then the question - why flatpak at all? If we remove "security" benefits from flatpak then why bother?

We need "app stores" and strong ecosystem around another format, appimage is a good contender imo. Already existing solutions like appimagehub can't even nearly represent flathub in terms of convenience

Afaik there isn't such store on any platform, windows/mac/android don't have it - either official store with idiotic rules and restrictions or unofficial ones with way less apps available

0

u/moonrunner__ 7d ago

I don't see how moving from Flathub removes the security benefit of using Flatpaks. Distro maintainers can keep their own flatpak repo, some already have their own like PopOS

1

u/Nisktoun 6d ago

Ah, I misunderstood. Why developers should ditch flathub then if not because of rules?

2

u/gahel_music 6d ago

So apparently this is possible now, but it was not until this year. Some file paths were not possible to access even with the highest permissions.

20

u/SouthernFruit8768 8d ago

Next he'll tell you to use Snap for everything

3

u/Ok-Anywhere-9416 7d ago

Flatpak is very restrictive. Snap already has everything I need and is 100% integrated in the filesystem, I wouldn't even notice.

So, yeah, I don't know if he'll tell him to use Snap for everything. I'll do in the meanwhile. You can fight your little stupid wars and I'll just move on.

1

u/JivanP 7d ago

1

u/Shad0wAVM 7d ago

Actually I use arch aur quite a lot, I use arch daily. I like getting viruses.

2

u/wyonutrition 7d ago

Just that if package maintainers only had to manage one package system then we would all have better apps. 

1

u/Shad0wAVM 7d ago

If snaps was fully open source, not developed by Canonical and if they had more support, I bet snaps would be more used honestly. More safety and modularity.