Choosing safer apps experience on Flathub

1

Hi guys, how it’s going on?

As a simple user, in the use of Snaps, I got the habit of installing packages packaged: by reliable projects, by Snapcrafters community, and by famous developers. Smaller apps, maintained by unknown developers, are the kind of apps I tend to install only when necessary.

I wonder how can I transfer, as a user, these requirements of choice to my use of Flathub. In Snaps, if the package is maintained by a company or a reliable community, they put a green dash on it. If it’s packaged by the community of Snapcraft, they put “Snapcrafters” on it, and if it’s developed by a famous Linux community developer, I can clearly see his name.

When it comes to Flathub, I can see when the publisher is the original community, but in any other case, as a simple user, I just feel lost. I can click on “See details” to see pieces of information about the package maintenance on Github, and sometimes I realize there are Flathub guys involved there, but I don’t actually know if they are observing the commits, or “leading” the maintenance of that package or something.

While I was writing this, I realized the text sounded a little bit like a feedback, but that’s was not the original intention, the original intention was to just ask for personal help. That being said, if anyone could enlighten me, on recommend me documentation on how the whole commit/security maintenance works, I would appreciate, since this would make me feel more comfortable using Flathub.

Ty, guys! A good day for you.

1 Like
2

Hey @RLFontana!
I agree somewhat with what you said, but I’d like to show my point of view on the issue.

  1. Regarding package submission - From personal experience I know that Flathub maintainers make sure to check on flatpak builder files to make sure that your app is only using the permissions needed to run, this should make the packages safe (at least on the first version)

  2. The green dash verification - I have mixed feelings about this one… I understand why users would like to use software from ‘verified’ developers , but I think this would create an unnescessary division (similar to twitter). I’d much rather have a per app solution “verified app”, but that’s also a bit unrealistic seeing Flathub’s size.

  3. Security concerns - As already said, on upload it’s almost guaranteed that the app is safe (with only the permissions required to run allowed). My biggest concern is regarding updates, even though it works fairly well:
    1- A bad developer transforms his softwares into a malware (in this example, the app will delete all folders inside the home folder)
    2- The app isn’t verified within the 24 hours that Flathub waits before redistributing the app
    3- Users grant permission to the home directory by accepting the update
    4- Users lose their files

Generally speaking, I agree with your concerns, but I’d like to believe that all apps on flathub are secure for the time being.

My personal tip:
It’s okay not to install apps because you think they might cause harm in the future, but just like any software installation, you have to trust the developers.

My personal improvement proposal:
MAKE PERMISSIONS MORE CLEAR!
I guess this is more of an GNOME Software/Discover issue, but I think it would be nice to have on every update and software installation an >easy to find< dialog (maybe even a popup) asking for permission (similar to Android/iOS, but on the store frontend)

2 Likes
3

I agree completely. While it’s nice that it shows you some permissions upon flatpak install, they are not very understandable, and there’s no way for a user to easily deny excessive permissions during install. Many apps want access to your entire home folder, which IMO should be very difficult for an app to get, and it seems to defeat much of the purpose of running flatpaks.

It would also help if flathub would show the permissions. As it is now, the only way I can find to see permissions outside of flatpak install is to click the “See Details” under publisher, then cut off the last two directories from the URL, then try (and sometimes fail) to find the yaml or json file that configures the flatpak security options.