You must log in or register to comment.
Flatpak is kind of bringing the BSD mindset of base system versus end-user apps to Linux.
Back in the glory days of FreeBSD, one would have system libraries managed by the FreeBSD team, and then whatever libraries the ports system used in /usr/local/lib which were used for end-user applications. Everything not provided by FreeBSD came from ports and was installed in /usr/local (/usr/local/bin; /usr/local/etc; /usr/local/lib; etc) so you would have two versions of gcc, for example.
With Flatpak, you have your stable, or rolling base, whatever you are comfortable with. In my case, Debian. And it is fully separate from the end-user applications. This is something that I’ve really missed since coming to Linux from BSD. I can keep Firefox bleeding edge without having to worry that the package manager is also going to update the base system, giving me a broken next boot if I run rolling releases.
Conversely, I don’t have to wait for backports from my underfunded, understaffed distro’s security team, or ride Firefox ESR.
End-user applications are in containers. So what ffmpeg in the VLC flatpak has an exploit, VLC can only access your ~/Videos directory anyway. It’s not going to read your PKI certs or send your ssh keys off somewhere.
Use flatseal to manage permissions of each app.
It’s not perfect, but it’s a step in the right direction.
FWIW, OpenBSD has done this for years with Chrome and Firefox, which only have ~/Downloads access.
If you run KDE Plasma 5.27 or later, flatpak permission settings are included right from the system settings. A built-in flatseal, in case anyone didn’t know. https://i.imgur.com/PSdt6iy.png
I can keep Firefox bleeding edge without having to worry that the package manager is also going to update the base system, giving me a broken next boot if I run rolling releases.
On Nix[OS], one can use multiple base Nixpkgs versions for specific packages one wants. What I have is e.g. 2 flakes nixpkgs, and nixpkgs-update. The first includes most packages including base system that I do not want to update regularly, while the last is for packages that I want to update more regularly like Web browser (security reasons, etc).
e.g.
- https://codeberg.org/yuuyin/yuunix/src/branch/main/flake.nix#L52-L77
- packages with pkgs (nixpkgs flake) https://codeberg.org/yuuyin/yuunix/src/branch/main/profile/packages.nix#L12-L26
- firefox with pkgs-update (nixpkgs-update flake) https://codeberg.org/yuuyin/yuunix/src/branch/main/profile/app/firefox.nix#L14-L16
Flatpak is kind of bringing the BSD mindset of base system versus end-user apps to Linux.
What must one not read. The reason is that FreeBSD develop and maintains the whole base system: kernel + system related frontend and because it’s a clean architecture. For the isolation they had jails before containers was a thing.
Flatpak was not about sandboxing, this aspect is quite recent. It is a response to how bad the CI-pseudoCD was for Gnome and to build/deploy apps based on gnome-stack easily. For proprietary product, I still have to see it a proprietary product not available outside flatpak…
Don’t get me wrong, it’s good that Flatpak tackle the sandboxing question that was not what was sold previously. Also, I use official repos and mainly FOSS. Flatpak won’t prevent a supplychain attack. So my trust remains the main repos.
The isolation paragraph seems more like a gripe with Gnome Software Center rather than flatpak itself.
It most likely doesn’t scale to have all developers keep track of all the dependencies of all their software.
Also not sure I agree much with this. When developers don’t keep track of their application’s dependencies, end users often end up having to do it and it’s a much worse experience overall.
I do agree with that it ends up being more of a burden on developers to maintain dependencies in their package. It’s not great knowing there are potentially patched issues sitting in older libraries that are shipped with a flatpak because a package maintainer hasn’t had the bandwidth to update them.
When I was packaging Flatpaks, the greatest downside is
No built in package manager
There is a repo with shared dependencies, but it is very few. So needs to package all the dependencies… So, I personally am not interested in packaging for flatpak other than in very rare occasions… Nix and Guix are definitely better solutions (except the isolation aspect, which is not a feature, you need to do it manually), and one can use at many distros; Nix even on MacOS!
nix on MacOS doesn’t even have Chromium. all my kekw
… :'(
Well; darwin users, just as linux users, should also work on making packages available to their platforms as Nix is still in its adoption phase. There are many already. IIRC I, who never use MacOS, made some effort into making 1 or 2 packages (likely more) to build on darwin.
I’ve been installing all my software on Ubuntu using the flatpaks because they are mostly up to date. They definitely have there downsides. I keep trying to save renders in blender and exports from draktable in my /tmp/ folder but it doesn’t work right because of the isolation. Also running those programs from the command line or trying to run scrips included with darktable is a real pain in the butt.
Is there any particular reason you use flatpaks rather than snaps? (Not that I’m suggesting using snaps, I myself prefer flatpak, just curious)
I said ubuntu but I’m actually mostly running pop-os and the pop shop installed them as flatpak. I’ve been switching between the two alot lately.
Ah alright, that makes more sense. I ran Pop-OS for a while, and a few other distros since then, but keep coming back to Fedora
One huge thing I don’t understand about Flatpak is how, like the article says, everything is shoved into GitHub. Why? What is the rationale behind making each application its own repository just to store a couple modules and a YAML file?
I do like Flatpak though. It works for what I use it for, and it does a good job at keeping the applications I install through it separate from my system, so I can be sure that my package manager isn’t going to brick everything with an update (not like that has ever happened though).
flatpack convert a well-design operating system linux to a sub-optimized system like our favorite microsoft window 😂
