this post was submitted on 21 Jan 2024
31 points (77.2% liked)

Linux

48216 readers
1320 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz
31
What software is best to have in a flatpak on tumbleweed? (sopuli.xyz)
submitted 10 months ago by CuttingBoard@sopuli.xyz to c/linux@lemmy.ml
29 comments fedilink hide all child comments
 

The title says it all. I would like to know what software you have in a flatpak. If you want to include your reasoning, go ahead.

you are viewing a single comment's thread
view the rest of the comments
[–] million@lemmy.world 2 points 9 months ago* (last edited 9 months ago) (3 children)

Is that due to flatpak sandboxing?

Edit: it’s interesting, this repo is saying the opposite, https://github.com/trytomakeyouprivate/Recommended-Flatpak-Apps/blob/main/Apps/Browsers.md

The Flatpak Sandbox restricts the Browsers abilities to isolate the processes from another, and also valuable internal data like your history or passwords.

Edit 2: since folks are asking further details are linked in the article. Keep in mind I am not personally making these claims, I am in learn mode just like a lot of other folks.

From https://seirdy.one/notes/2022/06/12/flatpak-and-web-browsers/:

When distributing browsers through Flatpak, things get a bit…weird. Nesting sandboxes in Flatpak doesn’t really work, since Flatpak forbids access to user namespaces

[–] henfredemars@infosec.pub 2 points 9 months ago* (last edited 9 months ago) (1 children)

I am not so sure this really establishes that Firefox in a Flatpak is less secure. From the linked bug:

You lose the namespace isolation, and by extension the chroot, but that's it. It's definitely nice to have, but to say it's "most" of the sandboxing seems a misrepresentation. Note that some distros disable the kernel support for them by default, so that's what they currently get regardless of Flatpak.

It might be more accurate to say that some per process isolation features don't work because flatpak uses them to isolate Firefox from the rest of the system. This could make it easier to smuggle data between processes in Firefox. It reads like a trade off to me and the impact depends on your security model -- whether you value interprocess isolation more than isolation between the app and the system.

Either way, interesting find! I didn't know some of Firefox's sandboxing is precluded by the Flatpak sandboxing. I edited my comment to dispell the claim that it's more secure.

[–] million@lemmy.world 2 points 9 months ago (1 children)

Yeah as they said it’s complicated, but in an unintuitive way more sandbox of apps can lead to apps being less effective at sandboxing themselves. Which, like you said, can be good bad or neutral depending on your threat model.

Personally I am leaning towards not using browser in Flatpaks since I trust the browser to sandbox itself. Not the position I started from initially where I would have assumed more sandboxing is a uniformly good thing.

[–] henfredemars@infosec.pub 2 points 9 months ago

Much respect for the discussion. I learned things.

[–] milicent_bystandr@lemm.ee 2 points 9 months ago

Huh, that is very interesting

[–] henfredemars@infosec.pub 1 points 9 months ago* (last edited 9 months ago) (1 children)

This resource makes a claim but presents nothing to back it up. I would like to learn more.