Linux

48655 readers

483 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
No misinformation
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago

MODERATORS

[email protected]

Are packages from flathub always safe? (lemmy.ml)

submitted 1 year ago by [email protected] to c/[email protected]

23 comments fedilink hide all child comments

I usually trust my distro repos without checking. Can the same be applied to flathub without much worry?

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 7 points 1 year ago (2 children)

At https://blog.frehi.be/2023/04/23/the-security-risks-of-flathub/ someone has published an article about Flathub in which he addresses a few problems.

Therefore, the answer is that Flathub is not always safe to use. However, I do not know of any package source that is always safe to use. Is Flathub more insecure than other package sources? I can't answer that because I don't use solutions like Flatpak, AppImage etc. myself.

[–] [email protected] 2 points 1 year ago

It's more about trust, than security. When you use a specific distro, you only have to trust the distro packagers. These packages are reviewed by multiple persons, tested thoroughly and (usually) built in a reproductible way. The packagers are usually different from the developers, so they can also review the code itself and eventually patch issues if needed to be in line with the distro's ideology.

With flatpak, snap and friends, anyone is a potential packager, so for each software you gotta trust this single entity, which is usually the developer itself.

[–] [email protected] 1 points 1 year ago

I can: yes, Flathub is more unsafe than package managers that actually verify all packages signatures after they download software.