Next step, display the “potential unsafe”-badge next to verified or unverified, that can be found on the same page. In example https://flathub.org/apps/io.github.shiiion.primehack is marked as verified, but if you scroll down you can see the application has full system and data access and is marked as potential unsafe.
Because if you search Firefox and see a badge that says verified, you can be confident that it was Mozilla that packaged it and added it to FlatHub as opposed to some random scammer.
Verification doesnt help at all if the source is not trusted. All this says is “upstream developers maintain this package”. Unofficial packages can be safe too, like VLC.
Because both Red Hat and Canonical are of the “pay us to care” mindset. If you aren’t paying for support, you’re a freeloader and need to do your own research.
That’s not entirely true with Red Hat. There’s a lot of work that they’ve done in the open source community that they haven’t shared back. And canonical seems to think this is a good idea.
This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.
At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.
Nice
Good to see one of the two big packaging hubs do something against malware
Next step, display the “potential unsafe”-badge next to verified or unverified, that can be found on the same page. In example https://flathub.org/apps/io.github.shiiion.primehack is marked as verified, but if you scroll down you can see the application has full system and data access and is marked as potential unsafe.
cough cough snap cough
Snap already marks unverified apps
Yet Ubuntu still recommends installing anything from the terminal if a command was found in a rando unverified snap.
How does that Help against Malware?
deleted by creator
Because if you search Firefox and see a badge that says verified, you can be confident that it was Mozilla that packaged it and added it to FlatHub as opposed to some random scammer.
You can’t just upload a App to Flathub. Everythng is reviewed.
Apt has done this forever
Verification doesnt help at all if the source is not trusted. All this says is “upstream developers maintain this package”. Unofficial packages can be safe too, like VLC.
deleted by creator
Flathub is doing more and more, but stuff like hiding
--subset=verifiedis very bad.They simply need to gain critical mass until they can force changes like portals etc.
If you create malware and publish it on flathub, you are the upstream dev. But for sure it helps against duplicate scams.
deleted by creator
Nice!
Add flathub with
--subset=verifiedand get apps you really need from their .flatpakref filesBecause both Red Hat and Canonical are of the “pay us to care” mindset. If you aren’t paying for support, you’re a freeloader and need to do your own research.
I mean, that’s pretty much all open source software and isn’t specific at all to RH/Canonical.
What’s provided to you is provided without warranty and you’re not automatically entitled to support, etc.
That’s not entirely true with Red Hat. There’s a lot of work that they’ve done in the open source community that they haven’t shared back. And canonical seems to think this is a good idea.
I’m not really sure what you mean by that. What do you mean they’ve done a lot of work for the open source community that they haven’t shared back?
And what does it have to do with providing software support free of charge?
Fedora has their own flatpak repo built from their own rpms and their own runtime. Flathub has more flatpaks though.
This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.
At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.
deleted by creator
That’s my point, it does not “help” preventing from malware from being downloaded.
deleted by creator