189
Fedora threatened with legal action from OBS Studio due to their Flatpak packaging
(www.gamingonlinux.com)
this post was submitted on 15 Feb 2025
189 points (98.5% liked)
Linux
6067 readers
392 users here now
A community for everything relating to the GNU/Linux operating system
Also check out:
Original icon base courtesy of [email protected] and The GIMP
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Don't use flatpak. Its extremely insecure.
Source?
Former Unix security lead here, with a build/release background.
Completely insecure in the "I think the doors are locked but I can't check and didn't check and they told me it was okay but I don't know why they are" way. It has absolutely no validation with the rest of the system and fails "how do we know" after about 3 iterations.
Downvote people who aren't flying the right flag - you be you - but maybe one day look into this.
It doesn't have package signing. The source is their documentation.
flatpak build-sign, is what I can find in the documentation.
Yeah, thats optional. Unlike actual secure package managers like apt, where signing has been required since 2005.
What you need to look at is the docs for installing, and note it doesn't say anything about requiring valid signatures after downloading a payload.
Flatpak doesn't care about security. avoid them.
This seems to be blatant misinformation.
The default seems to require a gpg signature. It can be disabled for a remote with
--no-gpg-verify, but the default for installing and building definitely requires a signature.You keep talking about the docs, so please show me where is says that in the Flatpak Documentation.
You're the one spreading misinformation.
The burden of proof is on you. I linked you to the docs showing how package signatures have been required in apt since 2005. Most package managers do not have signature verification.
Point me to where the docs say signatures are required to be verified after download.
You accused flatpak of being insecure. The burden to prove that is totally on you.
Nah, tech is insecure by default.
You have not provided a single link.
I'm am no expert on flatpak and just did some basic searching.
From reading the command reference it seems GPG-Verification is enabled for each remote and can't be disabled/enabled for each install. I can just find some issues where gpg verification fails
Documentation seems to be more user oriented and not developer oriented maybe someone more knowledgeble can go in the source code and tell us how it actually works.
Sorry here's the link
https://wiki.debian.org/SecureApt
So you linked to apt.
I guess good for anyone who finds this interesting…
But more on topic here is is a link to answer from 2020 from an flatpak maintainer:
Link me to the docs that say this
You are not arguing in good faith.
I have linked multiple times to the docs and to the GitHub repository of flatpak.
Now how about you link to something useful in the docs that proves your point or maybe just a random article as source to your misinformation.
You have failed to find a doc that say signatures are required to be valid on the client for everything it downloads.
This software isn't secure. You can live in la-la land, pretending it has features it doesn't, but that doesn't change the facts.