Flatpak is not perfect, but it's getting better
Flatpak is not perfect, but it's getting better
Flatpak is stable and widely used, but it still has some pain points when used in certain environments or for certain ends. However, most of those drawbacks are being worked on, and fixes are planned.Luca Bramè (LibreNews)
𝕽𝖚𝖆𝖎𝖉𝖍𝖗𝖎𝖌𝖍
in reply to Pro • • •Hmm. This hard on the heels of Sebastian Wick's comments that core Flatpak development had largely stalled (2025-05-14).
I wonder what happened here. There seems to be a disconnect. TA does acknowledge Wick's talk; it's hard to reconcile the two messages, though.
The future of Flatpak
LWN.netdangling_cat
in reply to Pro • • •I wish it opens a prompt asking a list of permissions when open for the first time. Like, VSCodium always needs local file system access, VPN clients always need network interface permission, etc.
Yeah, we have Flatseal, but it should be automated by the publisher to have a list of prerequisite permissions.
dgdft
in reply to Pro • • •Flatpak is quite fucking far from perfect, and will always remain so due to its flawed design and UX approach.
Pretty sure the culprit here is Fedora’s packaging which adds an opaque systemd timer to run auto-updates, but the thread immediately next to this one on my homepage just happened to be a nice case-study in Flatpak fuckery: lemmy.world/post/30654407
Of course, the proposed changes in the article do nothing to fix this sorta problem, which happens to be the variety that end users actually care about. Flatpak is an epic noob trap since it pretends to be a plug-n-play beginner friendly tool, but causes all sorts of subtle headaches that newcomers inevitably don’t have diagnostic experience to address.
Possibly linux
in reply to dgdft • • •dgdft
in reply to Possibly linux • • •From docs.flatpak.org/en/latest/int…
You might be thinking of AppImages, which are more of a pure file format.
Introduction to Flatpak
FlatpakPossibly linux
in reply to dgdft • • •Limonene
in reply to Pro • • •FizzyOrange
in reply to Limonene • • •Limonene
in reply to FizzyOrange • • •Mozilla, for example, would sign Firefox's flatpak with a PGP key that they would disclose on their website. You verify the signature using the RSA algorithm (or any other algorithm for digital signatures. There are a bunch.) Or, you could just trust that your connection wasn't tampered the first time, then you would have the public key, and it would verify each time that the package came from that same person. Currently, you have to trust every time that your connection isn't tampered.
Major flatpak providers (Flathub at the very least) would include their PGP public key in the flatpak software repo, and operating system vendors would distribute that key in the flatpak infrastructure for their operating system, which itself is signed by the operating system's key.
jagged_circle
Unknown parent • • •Flatpak doesn't verify signatures like normal package managers do
So the issue isn't that you downloaded a flatpak that included malicious code. The issue is that you downloaded a legit flatpak and ended up downloading malicious code because flatpak doesn't verify what it downloads
jagged_circle
Unknown parent • • •jagged_circle
Unknown parent • • •jagged_circle
Unknown parent • • •