Flatpak builds are not reproducible and why that's a practical problem

General
1

Guix >>>

2
3
4

There’s also this counter article

5

They fixed some stuff..

from HN:

None of that debunks the 2020 article. It sounds like they kind of fixed some of the stuff a year later, but it’s still largely broken. Am I missing something?

Yeah, they “partially agree” for some point, and “partially disagree” for some other point. Does not sound like they “debunk”.

EDIT: response to FUD

6
7

While I am by no means an expert on the matter, as far as I can tell, anti-Flatpak sentiment generally hinges on the perfect-solution fallacy sprinkled with misleading vividness (“a security nightmare”, anyone?).

However imperfect it may be, it’s still the best we’ve got right now. Incidentally, the now-recommended secureblue project pretty much arrives at the same conclusion.

At the very least, can we get rid of the references to the questionable (and likely outdated by now) flatkill.org? @dngray

On a slightly unrelated note, there’s this passage in the Linux overview, under System Counting:

This option is currently off by default. We recommend adding countme=false to /etc/dnf/dnf.conf just in case it is enabled in the future.

Properly speaking, there’s no way to disable it globally. Further reading:

1 Like
8

Disagree, you can install distro packages instead and sandbox them.

9

Good overview of current status and possible improvements

1 Like
10

Hm… Is there any how-to on the matter you would recommend?

Well, that does sound concerning. Time will tell, I guess.

11

Look into bubblejail. There’s a guide in the community wiki for extra configuration

12

Alright, I finally got a round tuit…

A couple links for future audiences, since none were provided:

Yeah… Ain’t nobody got time for that. And even if Bubblejail is technically superior to Flatpak, the latter should be readily available on any major distro out there. Moreover…

Using distro packages generally means having to trust additional people (maintainers), whereas Flatpak apps are much more likely to be provided by developers themselves.

That said, I do not mean to dismiss Bubblejail outright, and may take a closer look at it eventually – if it ever lands in Fedora repositories.

13

It’s neither hard nor does it take much time.

You make a default profile with most stuff that you need and is safe to share and then use it as a template. If anything it takes considerably less time than to tweak every single flatpak with flatseal. And with bubblejail there’s no risk of accidentally launching something with excessive permissions and not realizing it.

At least there’s some curation with distro packages. Plus, half of the reason to sandbox your apps is to reduce trust in the developers.

There’s an unofficial package, though I haven’t tried it myself