Appimage is not a neutral packaging format. Of course “an app packaged as .zip is as secure as packages as .tar.gz”. But the format causes all the things mentioned in the post.
libraries are often the oldest non-EOL possible to support old kernels
no transparency about used libraries and possible vulnerabilities
no upgrades of libraries, always just the wanted app and then passively also the libraries
no sandboxing without firejail (which is a root binary and thus can lead to privilege escalation of rootless processes if it has a vulnerability which it had in the past)
no GUI sandboxing
even with a repo no cryptographic signature verification like on Android (not sure about Flatpak which uses OSTree)
requires users to execute code in random locations
So it is way less secure than Flatpak, thats a fact. It may not be worse than tarballs, but if those dont include the libraries even less secure than them.
I partly agree. But your tone changed a lot from “highly insecure” to “less secure”, which is a complete different statement. An application does not need to be in a sandbox to be secure, so I don’t accept that as an argument against trusted applications. I only accept your arguments if we talk about random downloads from random places.
Also the argumentation that AppImages are usually run from random locations doesn’t make them unsecure, it’s a feature. BTW I have a dedicated folder where I put them, but that’s my personal organization. Did you know that you can unpack an AppImage back to its original folder (like an archive)? You need appimagetool for that.
The only thing I fully agree with you and is a weak spot about the AppImage format is, that it can or will include outdated and not updated libraries (or executables). Which is the point of the format on the one hand, but a curse on the other hand. Normally it is recommended to build on the oldest supported LTS Ubuntu, because of older libc. libc is the root of many problems in Linux (for compatibility).
Shit missing internet got my comment deleted…
Appimage is not a neutral packaging format. Of course “an app packaged as .zip is as secure as packages as .tar.gz”. But the format causes all the things mentioned in the post.
So it is way less secure than Flatpak, thats a fact. It may not be worse than tarballs, but if those dont include the libraries even less secure than them.
I partly agree. But your tone changed a lot from “highly insecure” to “less secure”, which is a complete different statement. An application does not need to be in a sandbox to be secure, so I don’t accept that as an argument against trusted applications. I only accept your arguments if we talk about random downloads from random places.
Also the argumentation that AppImages are usually run from random locations doesn’t make them unsecure, it’s a feature. BTW I have a dedicated folder where I put them, but that’s my personal organization. Did you know that you can unpack an AppImage back to its original folder (like an archive)? You need appimagetool for that.
The only thing I fully agree with you and is a weak spot about the AppImage format is, that it can or will include outdated and not updated libraries (or executables). Which is the point of the format on the one hand, but a curse on the other hand. Normally it is recommended to build on the oldest supported LTS Ubuntu, because of older libc. libc is the root of many problems in Linux (for compatibility).