flatpak remote-add flathub-verified --subset=verified https://dl.flathub.org/repo/flathub.flatpakrepo
  • rollingflower@lemmy.kde.socialOPDeutsch
    23·
    3 months ago

    Fair point. But when apps are on Flathub and people say “I dont care I have the AUR” they need to know.

    • the AUR has no verification at all
    • the apps have no permission system at all, so you need to trust them 100%
    • they are installed on your system and might mess up updates, give dependency errors etc.
    • their solution does not apply to nontechnical people. If a solution is not scaleable, it is not a good solution
    • Skyflare@discuss.tchncs.de
      4·
      3 months ago

      All you need to verify an AUR package is to read the PKGBUILD file, which is something the AUR keeps on encouraging you to do (this assumes that you trust the upstream repo, which is something that even official packagers of most distros do)

      Also a lot of flatpak packages aren’t sand boxed enough to be safe and only ends up giving false sense of security to nontechnical users

      Your last point is extremely important though, AUR is horrible for nontechnical users (which is why the AUR discourages AUR helpers)

      • rollingflower@lemmy.kde.socialOPDeutsch
        2·
        3 months ago

        Okay having an easily readable build file is a bit missing. Flathub hides that a lot.

        I think their rating system, which is on the website and also GNOME Software, displays apps with home access as insecure.

        And somehow this seems to be general knowledge and an issue about a privilege escalation through a local override was just closed. Yay