Appimages, snaps and flatpaks, which one do you prefer and why?
Flatpaks are insecure by design as they don’t cryptographically verify their authenticity after download. Snaps too.
Install with a proper package manager that was designed doe security. Most OS package managers are designed with this.
Pacman > Flatpak > won’t use it
I’ve only used flatpak and I honestly see no reason to try anything else. The only issue I’ve encountered is that Steam games launched by the Steam flatpak occasionally act strange (sometimes they can’t locate graphics drivers or connect to online services).
none of them. I don’t like the idea of putting security updates in the hands of the developers of each individual application I use.
Oh your app only works with an old broken insecure version of the library? Fuck you then, you can’t just decide to install and use the insecure version.
Interesting idea, didn’t think about this before. Still you could argue because of the sandboxed nature, those outdated libraries should’nt be much of a problem?
example, suppose there was a bug in openssl’s prime number generation code. It will generate insecure keys.
No amount of sandboxing can help with that. The bug is discovered and the next day I run ‘pacman -Syu’ (I use arch, btw) and the problem is gone systemwide, except for any flatpaks or appimages etc. Those will only get updates (and stop leaking my data) if and only if its maintainer actually gives a fuck, is still alive and active. If not, you’re sol
I am very certain the most appropriate person to update the software would be the developer itself. So when suddenly for flatpaks & co the responsibility of updating libraries is put on the flatpak package maintainer for ANYTHING used in that container… it doesn’t sound optimal.
Still your example is a very edge-case scenario, because it would create a static vulnerability.
sandboxing protects apps from each other. If there’s a bug in some library that somehow leaks some security keys or something, sandboxing doesn’t help.
