I usually trust my distro repos without checking. Can the same be applied to flathub without much worry?

  • Fryboyter
    link
    fedilink
    arrow-up
    8
    ·
    1 year ago

    At https://blog.frehi.be/2023/04/23/the-security-risks-of-flathub/ someone has published an article about Flathub in which he addresses a few problems.

    Therefore, the answer is that Flathub is not always safe to use. However, I do not know of any package source that is always safe to use. Is Flathub more insecure than other package sources? I can’t answer that because I don’t use solutions like Flatpak, AppImage etc. myself.

    • z3bra@lemmy.sdf.org
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      It’s more about trust, than security. When you use a specific distro, you only have to trust the distro packagers. These packages are reviewed by multiple persons, tested thoroughly and (usually) built in a reproductible way. The packagers are usually different from the developers, so they can also review the code itself and eventually patch issues if needed to be in line with the distro’s ideology.

      With flatpak, snap and friends, anyone is a potential packager, so for each software you gotta trust this single entity, which is usually the developer itself.

    • itchy_lizard@feddit.it
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      I can: yes, Flathub is more unsafe than package managers that actually verify all packages signatures after they download software.