Benefit of Flatpak?

Lounge
22

It is not because you did not stick with windows it is because you did not know you do not just install any apps you find on the internet and no one knows these things when they are new to linux unless they ask before installing apps and for most new users coming from windows they really may not think about doing so…

I recommend when you want to upgrade to a new release stick to the LTS version and do a clean install so you have a fresh install with no third party apps and go from there instead of trying to remove a lot of apps, just back up any data you want before you begin.

This is what I would do because of my personal experience, it will save you a lot of time and make your system much more stable then a possible failed upgrade unless a course you are just trying to learn by doing then that is great too.

1 Like
23

Moved to the Lounge, as this is general discussion rather than a support request.

24

You could just stick to the App Center, all software in it is well integrated with the system and uses supported ways of installing and keeping it up to date …

Again though, this is linux, you can bend it in any direction, you can install things how you like and modify them as you like, this is totally up to you in the end, but some delivery and update mechanisms of software are better integrated than others with the OS itself and as I said above, this differs from distro to distro, fedora supports rpm and flatpak out of the box, slackware only supports tarballs, ubuntu supports deb and snap…

If you pick one of the other install methods the load is on you to make sure the update mechanisms work, to follow the security notices for an app or one of its dependencies so your machine doesn’t end up as part of a bot net used by hackers without you knowing…

Another thing to keep in mind when using some non-integrated method is trust … apt/dpkg are designed in a way that you effectively give the owner of an archive/repository full root access to your machine, do you trust this person that provides a package via a website howto to you by adding an apt repository enough to give them root to your machine (or let me put it differently, do you mind if they sniff your homebanking passwords with a keylogger) ?

The packages you get through the App Center have been verified to be secure, they are signed by your distributor and get regular security updates for any open vulnerabilities.

After all it is a question of how much do you actually care and how much of extra maintenance work do you want to invest to keep your machine secure and up to date … though you should perhaps open another thread and go over these apt errors you mention with somebody to make sure they are not harmful …

There are two other Chirps that you for some reason ruled out from the start, one is in the archive (apt show chirp), the other in the snap store (snap info chirp-snap) and both are installable via the App Center …

The deb one is used by millions of debian users and is provided via debian in the Ubuntu archive, these packages usually get pretty heavy testing in the debian community already but are usually slightly outdated, the snap one seems to get updated every few months though in case you want something more up to date … though given the purpose of Chirp I highly doubt it is necessary to have anything newer or having to jump on any untested new release the upstream developer throws out …

You picked the pip install method though … and that is fine but as mentioned above pip isnt really a software packaging system so you have to jump through countless hoops with it to keep your software up to date (i.e. you need to pip uninstall and reinstall to do an upgrade (instead of just updating the existing install), you need to regularly check the website for updates etc etc) … If you prefer this way and perhaps want to help upstream to find bugs in untested versions , this is indeed totally up to you, it is linux after all, you have the freedom to tweak it, bend it and break it to your liking nothing is mandatory but steps you take might mean you need to care for things yourself vs. relying on your distributor to do it for you …

4 Likes
25

No one is offering a sales pitch.

You figured Linux would be a drop in replacement for Windows.

To have a good first Linux experience the new to Linux user must learn some basic Linux how to.

If a new to Linux user fails to learn some basic Linux how to than a bad first Linux experience is the result.

An old article but spot on.
https://linux.oneandoneis2.org/LNW.htm

1 Like
26

This was not “just any app”, this is one of my primary apps I want to use. I saw they had instructions for Linux, but how would I know those are not the “approved” (even though they work) method of installing?

27

Which method allows this? How does one know which is approved ahead of time or not?

28

I don’t know about those so much. I tried one (the “snap” one?), but it is nowhere near up to date.

29

Almost all applications in the Ubuntu archive are being checked by debian and Ubuntu developers (some that are not coming from debian into Ubuntu are indeed only checked by the Ubuntu devs), with these you are generally safe and the archive is signed by the Ubuntu archive gpg key to verify the integrity …

Snap and flatpak run their binaries sandboxed, in the case of snap the security hardening is mandatory, in the case of flatpak you want to make sure the developer has locked it down properly by verifying the flatpak permissions (if they are to open you want to restrict them with i.e. flatseal)

Any other way of installing that you listed above is purely a matter of trust…

If it is some external package repository or a PPA for deb packages, keep in mind you give the person root access, they could install anything or change anything on your system without you knowing (i.e. the proverbial key logger) …

If it is a tarball or zip … well, it will most likely only contain a binary to execute and you will likely not be able to know what it will do at all until you run it …

Pip or CPAN, I have no idea how the verification or entry criteria for a package is, I have ever only used pip during python development when I needed a newer module than the Ubuntu archive provides, not sure if there is any kind of review process for people uploading anything to it …

In general though (and this is not different on Windows), think twice about the risk when you install software from an untrusted location …

30

Why exactly do you need the “more up to date” version ?

Is there any feature that is only available in these revisions ?

Especially Chirp doesn’t look like something where you urgently need to have the very latest (obviously many people using the deb from the archive (in debian and Ubuntu) do not feel like this and I know the debian Ham Radio community is rather big, so it is interesting to hear why you feel you need to have the very latest (and most likely not very widely tested) version)

2 Likes
31

That is not quite right. Both have their faults, but your post makes it seem like Snap is always more locked down than flatpak.

Snap

Snap is not always sandboxed. It provides a classic confinement mode so that some apps, such as IDEs, can access things that an ordinary strictly confined snap cannot.

However even “strictly” confined snaps can be a misnomer. It’s far too common for snap apps to have home folder access and network access. These are not privileged connections. So any snap app has access to all your pictures, videos, documents and upload them to a remote server without being reviewed by a human. Though at least snap blocks apps from read/writing to stuff like your .bashrc to avoid running arbitrary commands, which flatpak does not (which is why its especially important not to use home or host permissions for flatpaks).

Flatpak

On Flathub, the de facto flatpak store, thing are different. Every app gets reviewed by a human when being submitted and when permissions are changed. Flathub volunteers review the permissions of an app before it gets on the store.

Flatpak also allows for more granular filesystem access than snap. So a flatpak app may just request access to your downloads folder (or even a subfolder for even less access!) whereas a snap version will typically ask for the whole home folder. I think you could technically do the same with snap with a custom plug, but what’s the point when snap’s home folder permission is free to use, no questions asked?

Flatseal is also much more user friendly to use than snap’s permission page (hopefully snap fixes this with the new desktop security app). I am able to tailor the sandbox to be nearly perfect for my needs thanks to its more granular handling of filesystem permissions. It also gives the control to the end user, if they so desire. Unfortunately, snap puts this control in the hands of Canonical. If a snap does not request a permission, say removable-media, then I cannot grant the snap access to that plug. My only recourse is to use a bind mount or rebuild the snap myself, at which point it will be dangerous and no longer receive automatic updates. So the snap sandbox is too rigid and inflexible. It both has too much access (home and removable-media plugs expose so much to apps without granular control) and too little (I as the user cannot give it more access if it does not have the permission in its yaml).

And to be a stickler, I’d like to say that flatpak is merely the technology. It has no de jure store (though the de facto store is clearly Flathub). Anyone could host their own store and ensure that all apps have minimal, safe permissions. That’s not the case for Snap, where the de jure store is the Snap Store.

32

You can not upload classic snaps to the store without them going into full manual review. They will only get granted classic confinement when they fit one of the few categories allowed and only after the publisher has been vetted as part the original upstream developers…

The process is documented in detail here:

1 Like
33

I didn’t mean to imply that you could upload classic snaps without review. Only that classic snaps do exist, so snap’s sandbox isn’t mandatory.

Personally, I find more issue with snap’s “strict” sandbox allowing free access to home and network without ever being reviewed by a human. Especially since Canonical has not tightened up their policies after dozens of malicious apps have made it onto the store.

I find it alarming because those two permissions can cause a lot a damage.

  • With just the network permission, the crypto-stealing malware was able to transmit the user’s recovery passwords to the attackers.
  • With just the home folder permission, an app could encrypt all your files and demand a ransom to get the password to unlock them
  • With both permissions, an app could transmit sensitive data (pictures, videos, documents) to a remote server

Though I am unaware of any attacks performed like the last two, the first one was been done plenty of times, recently too: Malicious apps on the store - store - snapcraft.io

34

There were quite a few policy changes regarding uploads and reviews as well as:

(and IIRC there was a series of blog posts too around all this)

Either way, lets not turn this thread into a snap vs flatpak thingie …

Point is though, flatpak is not supported OOTB in Ubuntu (and if you seek support with it beyond the flatpak deb itself, you will have to seek it elsewhere), snaps and debs are …

3 Likes
35

Does this mean that what is sandboxed may change depending on the needs of the app? The human reviewers may decide in one case to allow access to the entire home folder and in another case allow access to only the Downloads folder? Do I have this right?

36

I read the post. It sounds like all new snaps are being reviewed by humans now. Do I have that right? (The terms “manual” and “snap name” are throwing me off.)

37

There were new changes in the automated review process that check for certain things but this particular change I linked above is literally to filter out phishing apps through limiting name registration.

As soon as you try to register something that could be some $FOO-coin app you will have to undergo publisher vetting to prove that you are involved with upstream before you get granted the snap name…

38

Ok, thanks. Sounds good.

39

Yes. The permissions change depending on the needs of the app.

For example, GIMP has host fileystem access, meaning everything in your home folder and other drives. That’s because GIMP does not use the xdg-portal file chooser, but users may need to access and save files in any number of locations.

Meanwhile, Firefox can use the xdg file chooser, so it doesn’t need as much filesystem access, but it does need the xdg-download folder access for automatically saving files to the downloads folder.

And best of all, apps that take sandboxing seriously like Video Downloader from Unrud only can access a subdirectory of the Downloads folder called “Video Downloader”, so it has absolutely 0 access to your files while still being able to save files in a sane location.

Firefox could do this too (save to a subdirectory called Firefox), but that would require them special-casing flatpak to use a different location. Or better yet, make the change on all platforms. May not help with sandboxing on all platforms but at least it would be neater.

40

Thanks. Appreciate it.

41

The important point is that apart from Ubuntu , flatpak is almost preinstalled / Defacto standard on almost all others major distros

You even have major distros where flatpak is the “only” way to install apps : SteamOS , endless etc…

It does not mean it’s better but that the Linux ecosystem is steadily moving to this as the default entry for developers who want to publish to all distros at once (apart from default ubuntu again …) .