I was looking for applications which show detailed hardware / driver information, and Hardware Probe seemed to fit the bill. However, when I ran it, it appeared to do nothing. However, I tried flatpak run org.linux_hardware.hw-probe to see what would happen, and to my surprise, it did this in the terminal:
Executing hw-probe -all -upload
WARNING: run as root for better results
Probe for hardware ... Ok
Reading logs ... Ok
Uploaded to DB, Thank you!
Probe URL: https://linux-hardware.org/?probe=136c409f1a
Woah, that’s not cool. I didn’t expect that at all. I guess I should take that “unsafe” icon a little more seriously. I don’t think there is malicious intent here, but it is certainly misleading. It turns out the “screenshots” are images of the website, not of any application, and the automatic, silent -all -upload shouldn’t happen.
Flathub is primarily focused on graphical desktop applications and not CLI/TUI applications. The following requirements ensure effective desktop integration.
When that support is in place, this tool might indeed have a place. But the issue I am flagging here is that, as it is now packaged, it is intentionally masquerading as a desktop application in order to subvert that rule.
It’s not a grudge. It’s alarm. I found it on Flathub, thought it might be interesting and useful, but it appeared to do nothing when I ran it. It’s only because I decided to deeper investigation that I found out that it does do something: it instantly and without any indication, let alone permission, sends a profile of your system to a website where it is posted publicly.
And I’m mentioning it here because, as I said, this one has actual malicious intent, it’s easy to see that something else could. So it’s a systematic problem that Flathub should address.
I don’t understand how you can insist when we’ve already established there is no such rule to subvert in the first place. I am not discussing further on the topic of upstream’s intention to deceive if you don’t come forward with evidence other than “look at it”.
The problem with the app doing nothing when launched from GNOME Software is documented here.
Regarding the problem of uploading without user consent - someone reported the issue already https://github.com/linuxhw/hw-probe/issues/100 and while upstream didn’t fix it yet - they’ve admitted it’s a bug, expressed intention to fix and requested for help.
Working on adding interactive question to the app. Need to understand how it will work if not answering the question after hitting the Launch button multiple times. Can we disable the Launch button somehow and add a Tip? Can we launch the desktop app instead when hitting on the Launch button?
Updating the description is a good start. Have you considered shipping a rudimentary GUI tool? Maybe with wxPython?
But I think this really is a larger issue. Many users installing Flatpaks are not experts, and the command line esoteric and intimidating. If Flathub is going to allow command-line tools, they need to be clearly separated in some way, or else they’re going to have a bad experience. This may not be a Flathub policy, but it definitely is a GNOME Software design decision.