Open Source

31359 readers

643 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Posts must be relevant to the open source ideology
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago

MODERATORS

[email protected]

Why is Trilium so unknown? (github.com)

submitted 1 year ago by [email protected] to c/[email protected]

70 comments fedilink hide all child comments

I mean Trilium is fantastic app, lots of potential but the developer is struggling on his own, maybe it's because it's younger than logseq or maybe because is open source compared to obsidian. I think it's the best note-taking/knowledge-base/second-brain i know it virtually could link everything you posses toghter to create a gigantic wiki, so much potential. Plus it has its own self hostable syncing server and web app. Guys give it a look and tell me what you think

you are viewing a single comment's thread
view the rest of the comments

[–] [email protected] 2 points 1 year ago* (last edited 1 year ago) (1 children)

Hey, let's just have a discussion without calling each other misinformation. I have made my claim and you have made yours.

Now, it is true that apt packages are signed with GPG. However, the same is also true for Flatpak packages. https://docs.flatpak.org/en/latest/flatpak-builder.html#signing

You can see Flathub's GPG key by downloading https://flathub.org/repo/flathub.flatpakrepo and cating it.

When it comes to supply chain security, Flathub's centralized nature allows for additional security than traditional distro packaging, as packages can come directly from app developers. https://docs.flathub.org/docs/for-app-authors/verification

Of course, I would love to see also reproducible builds like nix, and/or SBOMs like Docker, but these are not very popular security tools at the moment.

[–] [email protected] 1 points 1 year ago* (last edited 1 year ago) (1 children)

I'm not calling you names, I'm calling you out on misinformation. There is such a thing as facts, and it's important that we don't misconstrue them.

Optional signing of commits in git is not the same thing as mandatory signing of all packages.

Fact: If I download software with apt in Debian, It's 100% going to verify the cryptographic authenticity of that package. If the signature doesn't match, it won't proceed with the install (unless I choose to override the warning).

Fact: If I download software with flatpak, it may download maliciously modified software and install it without verifying its authenticity.

I'm not aware of any way to configure flatpak to force it to verify the signature of releases between download & install (so if the signature is unavailable or invalid, it does not install the software). Again, flatpak is not a safe way to download software, and I don't think it's possible to configure it to be safe.

If I'm the one spreading misinformation, then show me the documentation from flatpak that indicates that all packages are verified by their PGP key after download.

I think it's a fairly reasonable expectation that a software repo won't download malicious software. Flatpak doesn't do that.

[–] [email protected] 1 points 1 year ago (1 children)

The first link I sent says that flatpak does not allow users to override GPG and allow unsigned flatpaks unless they are root.

[–] [email protected] 1 points 1 year ago

That's not users of flstpak, that's developers. This applies to developers uploading to flstpak. There isnot security for end-users downloading from flatpaks.