• ⸻ Ban DHMO 🇦🇺 ⸻
        link
        fedilink
        English
        1017 days ago

        It makes it obvious to people whether they are downloading Google Chrome as packaged by Google or as by someone else. That being said, Google Chrome is malware. That being said there is a lot more that needs to be done to truly prevent malware, which will be costly but will hopefully take effect when they’ve got the budget for it

      • @TheGrandNagus@lemmy.world
        link
        fedilink
        English
        316 days ago

        Because if you search Firefox and see a badge that says verified, you can be confident that it was Mozilla that packaged it and added it to FlatHub as opposed to some random scammer.

    • @Pantherina@feddit.de
      link
      fedilink
      -2018 days ago

      Verification doesnt help at all if the source is not trusted. All this says is “upstream developers maintain this package”. Unofficial packages can be safe too, like VLC.

      • @dsemy@lemm.ee
        link
        fedilink
        English
        6418 days ago

        It does help prevent actual malware from being downloaded, though, since upstream developers probably won’t publish malware on Flathub.

        But this is still a half-measure. I don’t understand why Red Hat and Canonical don’t treat this issue seriously; people on Linux are used to assuming software installed from the repos are safe, and yet Snap and Flatpak are being pushed more and more despite their main repositories being potentially unsafe.

        • @Pantherina@feddit.de
          link
          fedilink
          1418 days ago

          Flathub is doing more and more, but stuff like hiding --subset=verified is very bad.

          They simply need to gain critical mass until they can force changes like portals etc.

        • @Pantherina@feddit.de
          link
          fedilink
          1218 days ago

          If you create malware and publish it on flathub, you are the upstream dev. But for sure it helps against duplicate scams.

          • @dsemy@lemm.ee
            link
            fedilink
            English
            24
            edit-2
            18 days ago

            I can’t find it now, but I read that the verification process also includes human review (for the initial verification, not every update), so it should actually prevent “verified” malware (though it does nothing against unverified malware).

            Edit: Here’s an article with this and more info: https://lwn.net/SubscriberLink/966187/3ef48792e5e8c71d/

        • @pmk@lemmy.sdf.org
          link
          fedilink
          517 days ago

          Fedora has their own flatpak repo built from their own rpms and their own runtime. Flathub has more flatpaks though.

        • Billegh
          link
          fedilink
          517 days ago

          Because both Red Hat and Canonical are of the “pay us to care” mindset. If you aren’t paying for support, you’re a freeloader and need to do your own research.

          • @TheGrandNagus@lemmy.world
            link
            fedilink
            English
            2
            edit-2
            16 days ago

            I mean, that’s pretty much all open source software and isn’t specific at all to RH/Canonical.

            What’s provided to you is provided without warranty and you’re not automatically entitled to support, etc.

            • Billegh
              link
              fedilink
              116 days ago

              That’s not entirely true with Red Hat. There’s a lot of work that they’ve done in the open source community that they haven’t shared back. And canonical seems to think this is a good idea.

              • @TheGrandNagus@lemmy.world
                link
                fedilink
                English
                116 days ago

                I’m not really sure what you mean by that. What do you mean they’ve done a lot of work for the open source community that they haven’t shared back?

                And what does it have to do with providing software support free of charge?

        • @thingsiplay@beehaw.org
          link
          fedilink
          117 days ago

          This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.

          At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.

          • @dsemy@lemm.ee
            link
            fedilink
            English
            217 days ago

            I said it helps prevent malware from being downloaded, not that it stops it completely.

              • @dsemy@lemm.ee
                link
                fedilink
                English
                817 days ago

                It is reasonable to assume that a verified Flatpak will have a lower chance of containing malware, since initial verification includes manual review (by a Flathub maintainer), and certain changes (like default permissions) also require manual review.

                So the way I see it, it does help, but not in a meaningful way.

  • million
    link
    fedilink
    English
    64
    edit-2
    17 days ago

    This is a good step but I still feel like it’s pretty obscure where a package is actually coming from. “by Google” or for the Steam package “by Valve” is really confusing and makes it sounds like it’s coming directly from the company. Unverified tells the user to pay attention but there is no hover over to say what it actually means.

    • @conorab@lemmy.conorab.com
      link
      fedilink
      6318 days ago

      Wait… so the author displayed in “by <author>” is the supposed author of the software, not the one that put it on the store? That’s insane! Also sounds like you’d be open to massive liability since the reputation of the software author will be damaged if somebody publishes malware under their name.

      It should be:

      • Developed by: <author of software>
      • Uploaded by: <entity who uploaded to store>
    • @Pantherina@feddit.de
      link
      fedilink
      717 days ago

      Also maaany packages direct to issuetrackers of projects not supporting that flatpak.

      If someone knows where that flathub metadata is stored I would love to know, as the manifest is not it. I would like to fix those to link to their own bugtrackers

  • Captain Beyond
    link
    fedilink
    1916 days ago

    Traditional GNU/Linux distributions (as well as F-Droid) are not “app stores” even though they are superficially similar. Traditional distributions are maintained and curated by the community, and serve the interests of users first and software developers second, whereas an “app store” has minimal curation and serves the needs of software developers first and users second.

    I point this out because there’s an annoying meme that traditional distributions are obsoleted by the “app store” model. I don’t think that’s the case. “Verification” is essential for an app store but pointless for a distribution.

            • @AProfessional@lemmy.world
              link
              fedilink
              English
              114 days ago

              There is no such thing as a “package”. It is a repository of binary data with references to data in it (ala git). The whole repo and all data is gpg signed.

                • @AProfessional@lemmy.world
                  link
                  fedilink
                  English
                  113 days ago
                  > ostree show flathub:runtime/org.kde.Platform/x86_64/6.6
                  commit a7443e846cf67d007fcecda5c9dc27844001cfb8929064395cfc25c6d71d9474
                  Parent:  23107550082daf3b2892a4a0db2543838578ca882340a756b988bc5c1614540c
                  ContentChecksum:  607ba9475d32a24c51509bc7919f5a93d401f8f7198c30ad93ad74051d966c41
                  Date:  2024-01-30 13:55:08 +0000
                  
                      build of org.kde.Sdk, Tue Jan 30 11:23:00 UTC 2024 (5998d2f3ef21414d14f066ab91fa44e5aef65b90)
                  
                      Name: org.kde.Platform
                      Arch: x86_64
                      Branch: 6.6
                      Built with: Flatpak 1.14.4
                  
                  Found 1 signature:
                  
                    Signature made Tue 30 Jan 2024 12:21:18 PM CST using RSA key ID 562702E9E3ED7EE8
                    Good signature from "Flathub Repo Signing Key <flathub@flathub.org>"
                    Primary key ID 4184DD4D907A7CAE
                    Key expires Mon 14 Jun 2027 08:19:40 AM CDT
                    Primary key expires Mon 14 Jun 2027 08:18:56 AM CDT
                  
    • @thingsiplay@beehaw.org
      link
      fedilink
      817 days ago

      I still don’t understand why a central repository for AppImages exist. The moment you are using a repository (and possibly version management), the format looses its reason to exist.

      • @GnomeComedy@beehaw.org
        link
        fedilink
        1017 days ago

        I don’t see how that’s true. The main point of AppImage is it ‘just works’ on any distro. If you have one primary place to distribute them to any distro - it’s still meeting AppImage’s vision.

        • @thingsiplay@beehaw.org
          link
          fedilink
          917 days ago

          To be fair, after some thinking I think you are right and I was a bit in a tunnel vision logic. My previous statement looks a bit foolish now.

        • @thingsiplay@beehaw.org
          link
          fedilink
          117 days ago

          I personally use a few AppImages, but want replace them with Flatpaks. Flatpaks have their own issues, and because I did not want to troubleshoot in case I encounter another issue, just carry on using AppImages for these selected applications. Also I was not able to archive Flatpak easily, its very complicated with keys and not. Compared to it, I just have the AppImages included in my regular backup process with regular files.

          My point was not if AppImages are useful (they clearly are and I use them), but was talking bout repositories. However after some other replies I thought about it and indeed such a repository makes sense even for AppImages. I personally just don’t have to use them.

            • @thingsiplay@beehaw.org
              link
              fedilink
              116 days ago

              Not really. AppImages are as much secure as any other executable you run on your system. If you download it from a trusted source, like you download trusted Flatpaks or your systems repository, then they are not worse. If you say AppImages are highly insecure, because you run executable code, then you have to take that logic to any other executable format. The problem is not the format itself that makes it insecure, it’s the source.

                • @thingsiplay@beehaw.org
                  link
                  fedilink
                  216 days ago

                  I read that page and there is nonsense included too. Just because I read that page does not make it correct. If you think that AppImages insecure, then you did not understand my point that its not the format thats insecure, but the source where you get the files. Every packaging system is insecure if you get it from bad source.

                  That’s not even a question. AppImages are fine and not insecure if you download it from a secure place you trust (like your system packages, you trust your distro maintainer fully). Would you trust every distribution maintainer on every distribution? Let’s say a Chinese Linux distribution, that maintains Flatpaks and native packages. Let’s say they are flaky. See? It’s the source you don’t trust, not the file format or packaging system.

                  Read my replies (just like you said I should read the linked post). And understand the issues.

      • @simple@lemm.ee
        link
        fedilink
        English
        2618 days ago

        The only good GUI for Flatpaks…

        Ain’t that the truth. I don’t know why KDE Discover is so sluggish when it comes to Flatpak, it takes me like 10+ seconds to load the landing page and see the popular apps.

          • 🌘 Umbra Temporis 🌒
            link
            fedilink
            English
            417 days ago

            First time I’ve heard someone call Gnome Software fast. In my experience that app feels like it’s on it’s last legs; the Flatpak CLI is far better than any desktop GUI.

            • Chewy
              link
              fedilink
              4
              edit-2
              17 days ago

              Gnome Software has received numerous updates over the last few years which make it considerable faster. Searching and viewing apps is now fast enough to be usable, compared to it taking many seconds to minutes for basic tasks.

              I’ve stopped removing Software on every system, altough I’m not usually using it. I’ve not tested it, but I feel like Discover is now slower than Software.

          • @russjr08@bitforged.space
            link
            fedilink
            English
            117 days ago

            My main issue with Gnome Software is if I queue something to install, and go back to browse for more apps, once something is done installing it “refreshed” and I lose the spot I was at. Makes me feel I can only install one thing at a time.

        • @stockRot@lemmy.world
          link
          fedilink
          116 days ago

          Likewise with Gnome in my experience. I’ve been using the CLI but am now realizing I might be missing out on some important information by doing that

          • @TheGrandNagus@lemmy.world
            link
            fedilink
            English
            116 days ago

            It’s definitely faster than it used to be. But yeah, searching for app updates is still more sluggish than through the terminal, at least on Fedora Workstation.

  • Butt Pirate
    link
    fedilink
    012 days ago

    This is misleading at best. “verified” only means that Flathub knows who did the upload. It doesn’t tell you anything about the safety of the app, and it doesn’t mean the app is affiliated with who you think it is.