Sovereign Tech Agency invests €500k in Flatpak

TekMol

I never understood why a program installed in Flatpak is not just a directory on disk. When you install something via Flatpak, it still changes data in god-knows-what places on my disk. And the software itself has read/write access to god-knows-where on my disk. The answer is probably "convenience and efficiency". But I would much prefer a "An application is a directory and by default cannot access anything outside of that directory" approach.

koe123

Maybe I am too propagandized, but honestly after going Nix I can’t help but feel like this stuff is fundamentally a waste of time

blizdiddy

Flatpak is great for installing, but as a happy Aurora user, it’s annoying and it breaks things all the time. Every desktop app i use has some broken feature. Sandboxes as another permissions panel suck. Simple browser-like permissions that allow prompted overwrite would be WAY better! Now i have media organizer programs that deletes my files if i try to write on a networked drive. Games that can’t see the controller. Chat apps that can’t see attachments. Music app that can’t save at all. Good luck accessing any binary and using it in a script.

znpy

To be honest i don't see how having flatpack going to help the (european/german) "sovereign tech" initiative. A waste of money if you ask me. I think there are much more important issues that should deserve money and attention.

Nux

Waste of money. "For Modal, a robust app sandboxing story is essential to creating a Free Software OS that is competitive with modern mobile platforms." Why? Focus should be desktop, not mobile. We have enough mobile stuff that creeped in already.

minimeow

My trust in Flatpak diminished after installing the book reader Calibre and finding that despite the sandboxing Calibre was given blanket access to my drive. Apparently a quirk of the developer behind Calibre insisting upon it. No warnings or communication of the exception were given. All trust I had in Flatpak was eroded from that moment on. Curious about the podman options or similar. Having desktop apps in a container with selective access to system resources seems like it would be more secure and configurable if configured correctly. Flatpak as it stands seems to be a legacy solution to what should be a container and namespacing solution.

j1elo

I loved Flatpak until I started building a MiniPC with a 112 GB internal disk for HTPC usage... Then I felt the pain of having to get all slightly different dependency versions for each little program I wanted. The box' cost already topped the project's budget so no new disk for it. I'm back to "proper .deb packaging please"

sdcfgy

I'd rather they invested €500k in contributing to the maintenance of distribution packages so I don't need to deal with Flatpak (on Debian here).

JanisErdmanis

I like the idea behind Flatpak and the ability to sandbox applications. What I don't understand is why they chose to lock the build process so tightly to Linux. I'm currently on macOS, and while I can cross-compile applications, I can't actually bundle them as Flatpaks. For that, I need `flatpak-builder`, which is so deeply coupled to Linux itself that I don't think it can realistically run on other platforms. Snaps have a similar issue with `snapcraft`. However, you can still build a snap manually with `mksquashfs`, whereas I haven't found an equivalent low-level option for Flatpak. I may be missing something, though, and I'm still looking.

regexorcist

I use bubblewrap directly, never liked Flatpak.

banger180

I really like flatpaks to install desktop applications, as mentioned in some other comments the sandbox is sometimes poked full of holes because some applications don't use XDG desktop protals and need full filesystem access. If you are really concerened about this, you can use flatseal to limit the access that the application has. If you prefer other ways of installing your software, that fine. But I really hope flatpaks continue improving and become the de facto way of installing desktop applications across all Linux distributions. For a normal, non-technical user installing and updating software should be easy, and I believe that flatpak provides this.

WhyNotHugo

A lot of Flatpak's design is a great prototype, but it's somewhat worrying (for the ecosystem in general) that this was taken as a final design and being pushed out in all directions. Portals are just a terrible design for a security boundary: all interfaces clobbered up into one huge daemon, which also deals with a lot of the internals of Flatpak/Snap. If you want your sandbox to use portals, you can't, because it relies on internals of both of these sandboxing mechanisms. The devs have confirmed they won't implement an API for other sandboxing engines to integrate with them. The whole system also deeply intermixes the package manager and sandboxing engine — to the point where you can't use the sandboxing engine with your favourite package manager, and you can't use the package manager without the sandboxing engine. It seems that the mentality is: all other distributions are irrelevant, all other sandboxing engines are unsupported. And then desktop applications start having first-class integration with Flatpak, and start having issues everywhere else. You already need to set up Flatpak's daemons for using some features in Firefox (like screen sharing, where the native interfaces aren't supported), and it seems that the plan is to do the same for other features.

ho_schi

I’m thankful for the STF. Germany is one of the few countries doing something. But it is not strategic software-development. * They don’t employ software-developers. No safety for the developers. No control over developers. * It is only temporary. * The projects need to apply repeatingly for funding. Wasting time and resources and chausing worries. The how planet needs Linux, BSD, cURL, ffmpeg, Flatpak. We need to ensure that this work for the people. We feed for 30 years constantly money into monopolies. We shall feed the next century constantly money into things the people need. Many developers of Linux and GCC are paid. Because companies decided it is necessary.

oytis

Great to see open source projects funded, but the value of Flatpak for tech sovereignty evades me somewhat. It's a pretty niche and questionable piece of technology, and likely won't be there in 10 years. Some grants by STF, like Mastodon, Openstreetmaps, Let's Encrypt, rustls are spot on, but there are many questionable ones.

goodpoint

flatpak is unsustainable

aussieguy1234

For these Flatpak improvements, are they also going to end up in bubblewrap?

robin_reala

The Soverign Tech Agency are currently hiring for a Director of Technology. Definitely a dream job for someone. https://www.sovereign.tech/jobs/director-of-technology

vrighter

Flatpak: adjust permissions here, workaround there, different workaround for a different DE. My solution: I'm very careful about what I run, but when I do run it, I just do. No fanfare. No security theater.

aradar46

And Omarchy gets 7mi for being ....you know

EffrafaxOfWug

I avoid flatpaks and snaps as much as I can. Here is a little blog post from 2021 that lists some of the huge issues flatpaks have https://ludocode.com/blog/flatpak-is-not-the-future If you want to sandbox your programs highly recommend looking at firejail.