Verification doesnt help at all if the source is not trusted. All this says is “upstream developers maintain this package”. Unofficial packages can be safe too, like VLC.
Because both Red Hat and Canonical are of the “pay us to care” mindset. If you aren’t paying for support, you’re a freeloader and need to do your own research.
That’s not entirely true with Red Hat. There’s a lot of work that they’ve done in the open source community that they haven’t shared back. And canonical seems to think this is a good idea.
This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.
At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.
Verification doesnt help at all if the source is not trusted. All this says is “upstream developers maintain this package”. Unofficial packages can be safe too, like VLC.
deleted by creator
Flathub is doing more and more, but stuff like hiding
--subset=verifiedis very bad.They simply need to gain critical mass until they can force changes like portals etc.
If you create malware and publish it on flathub, you are the upstream dev. But for sure it helps against duplicate scams.
deleted by creator
Nice!
Add flathub with
--subset=verifiedand get apps you really need from their .flatpakref filesBecause both Red Hat and Canonical are of the “pay us to care” mindset. If you aren’t paying for support, you’re a freeloader and need to do your own research.
I mean, that’s pretty much all open source software and isn’t specific at all to RH/Canonical.
What’s provided to you is provided without warranty and you’re not automatically entitled to support, etc.
That’s not entirely true with Red Hat. There’s a lot of work that they’ve done in the open source community that they haven’t shared back. And canonical seems to think this is a good idea.
I’m not really sure what you mean by that. What do you mean they’ve done a lot of work for the open source community that they haven’t shared back?
And what does it have to do with providing software support free of charge?
Fedora has their own flatpak repo built from their own rpms and their own runtime. Flathub has more flatpaks though.
This unverified badge does not prevent from malware being downloaded. This is a false statement! An upstream developer can have malicious intention and be verified as the upstream developer. This unverified badge only helps identifying its not a modified version by someone else and is guaranteed to be from the original developer. It does not prevent anyone from downloading and installing unverified apps. If that was the goal, then why having unverified apps in the first place on the store? Yes, because its useful. Therefore people will download unverified apps or just blindly trust verified apps.
At the moment his is enough. But if the Flathub store grows, this can be an issue. Look at the Android and ios app stores; there are plenty of apps from original developers with malicious intentions.
deleted by creator
That’s my point, it does not “help” preventing from malware from being downloaded.
deleted by creator