Don't use Appimages (a writeup about all the reasons they are a pain for users)
Post about homebrew by Jorge Castro
I am not sure how secure it is.
Have a look at GPU screen recorder, I think thats as much privileges as you need.
XDG-desktop portals are not yet complete. But for filesystem access and GPU de/encoding that should already work.
If the Davinci Resolve devs actually cared about Linux... I think the best way to run it is using uBlues image on Podman.
Have a look at GPU screen recorder, I think thats as much privileges as you need.
XDG-desktop portals are not yet complete. But for filesystem access and GPU de/encoding that should already work.
If the Davinci Resolve devs actually cared about Linux...
Thats flatpak with flathub. Also described in the post
So you prefer to not have any updates or secure verification, because you dont want a second package manager?
Dude you are the second package manager, and if you dont follow the whole gpg verification process I described in another comment, that is less secure.
Nextcloud, Balena Etcher, Lunar Launcher and more are exclusively supporting Appimage, thats the big problem.
I want to find a way to do this with flatpaks too.
A small GUI tool (a statically linked binary lol) that can be placed on that stick
- copy the flatpak app and runtime stuff to a folder
- copy the desktop entry over
- copy app data when chosen
And the same thing to copy it from the stick to a live system. Should work, probably not haha
Dont know where user installed tar archives (with statically linked binaries or including deps) would have dep conflicts, maybe if they are not statically linked.
The self updating stuff and desktop icons is personal opinion and not the common way on Desktop Linux, so I skip that.
you could do something like obtanium for android which could easily automate the process.
That is called a package manager, with a repo, with gpg signing etc. On Android (which I mentioned) updates are secure. Let alone the point that appimages are not updated in a regular way, they are just replaced.
I'd argue it makes little difference. But yes, Downloading things from the internet is more unsafe
No the difference is huge. If you are used to downloading software from websites, a faked website can easily lead to downloaded malware. Flathub can be added with a click and flatpak is included in distros, which means no hunting on the internet and no accidental clicks.
And as I said, until nobody downloads .flatpak packages online, and there may be an occasion where this is normal behavior, people will believe malware links are legit.
the risks seem blown out of proportion here. As long as you are downloading from the same place, the risks are significantly smaller in reality, not gone, but smaller.
Appimages are distributed everywhere, just as .exe files for Windows. This means they are favored by developers used to Windows and Mac, and those will not add them to a repo instead.
So a faked website of whatever etcher or something is easy.
The fact that Linux malware is not a thing, while Appimages clearly give the headstart for that, is a miracle.
I find this to be a benefit myself, I have had countless headaches with flatpak applications and their sandboxing. everything
Flatpaks are not secure because their sandboxes are weakened to not have such issues. This is due to apps not following secure standards, and until that is fixed they are insecure or broken or both. (Apps need to write configs in the container, they should use portals etc.)
I maintain a list of flatpak apps following modern standards, which is a small portion but getting better.
Linux is only somewhat secure because everything is FOSS and comes from repos.
This is broken by appimages, that can easily distribute malware and thus fix the "my malware is not running on that distro" issue.
Every software that can write to your .bashrc can easily catch your sudo password.
Another moot issue. $HOME/.local/bin is an XDG standard, so unless we pretend that XDG standards aren't "one of the major standards" this is just wrong.
Yes linux experts would put them there. As mentioned in that text malware would also install itself there, so on secure systems this should be only writable by root/ some elevated group privilege.
But apart from that users put them on the desktop, or in some random folder, I mean that dir is hidden for a reason.
Or put it in that PATH and then link to the desktop, resulting in a broken link when you remove the app.
When you need only a couple appimage files, space I find is smaller then flatpak, it only becomes when you need a lot of applications.
If something is not scaleable its not a good concept. The fact that you will only install a couple of appimage apps is enough proof.
On modern atomic distros users can rely purely on flatpak.
Btw see the linked dedup checker. You may download more dependencies but they are linked between each other and not actually take up so much space.
I don't need to worry about installing and uninstalling application when I just want to try it
We need to overthink those habits. You dont just "try an app", you run unsandboxed code from an unverified origin. As mentioned above, this could be totally fine, and also add a function to your bashrc that catches your sudo password (the next time you use it) and sends it to a server.
The secure way to do that is completely unpractical.
- Get a GPG app or use the cli, create a personal key. Secure the access permissions, as gpg always complains on Fedora for example.
- Hunt the internet for the gpg key of the dev
- Look for at least another source of that key like GrapheneOS does it
- Compare those keys hashes using cli or some app
- When correct, load the key into gpg/kleopatra/kgpg
- Verify the key with your internal key (yeah gpg is overcomplicated)
- Download the appimage, and a signed hash (most of the time its done like that)
- Verify the signed hash
- Sandbox the appimage using bubblejail (doesnt work) or firejail (no idea if it works, and its insecure)
- Repeat on every damn update (if it doesnt have a builtin updater)
This is unusable. And repositories do this automatically without anything you need to do. For sure you could "extra check the website" and say "
Also app data will be everywhere, often in its traditional location, while there is no package manager at all to delete them. Flatpaks store all their stuff (when devs care and not just ignore that, cough Cryptomator) in their container and data can be easily removed during uninstallation, GUI stores show a popup to delete data and I also made a small script to do that.
And that "try it out" app will either have no desktop entry or that entry needs to be manually and will be still there after uninstalling.
I don't need to muck about trying to get an app into flathub or starting my own repo, when a user has a problem, I can just tell them to run the new appimage instead of trying to get them to compile it.
This may be a reason, but this is only for testing then. But for sure, when its a small project, getting it on Flathub may be much efford.
I can imagine the developer experience is easiser. Flatpaks are simply very "defined" and need all that metadata and more to be complete. But needing to use available runtimes is a good thing mostly, its basically supporting a specific distro.
Flatpak through CLI is fine (I would like to have a standalone small store just for flatpak), Discover is nice too. The Linux Mint store also seemed fine but not much experience. (Linux Mint has some Wayland support now, so there is a secureblue Cinnamon spin, have to try that). The Cosmic store is just a stub currently, lets see!
Cheers!
Many if you combine the language files. AOSP for example, CalyxOS did some additions.
Heliboard is the best, Florisboard may get it.
Novacustom, System76. Doesnt tick everything but has Coreboot support.
F-droid is just one alternative. Do a quack for "f-droid repositories" and make sure to add izzyondroid.
That DDG app is interesting, so it records inter process communication without root? How?
I was looking for such a guide but could not find it back then.
Which may be overcomplex but it is complete and lots of things where not intuitive at all.
As I said, you could easily automate this step, instead of making it that manual. Or course I can do that, but why need to, if a sudo apt distro-upgrade would do it?
GearLever](https://github.com/mijorus/gearlever) solves all the problems mentioned.
Sceptical but I will try it for sure.
It makes appimages less worse than Flatpaks though, so its only "badness reduction" for me.
There are AppImages out there that self-update , but GearLever also solves the update issue. And if you don't want to use GearLever, there are other updaters like AppImageUpdate.
The first is what I mentioned, such updates can be perfectly done by a central package manager. Did you ever try to seal off a Windows install using Portmaster, where every installed app needed network access for their individual update services? Just no...
Ans to the repos, yeah maybe, havent looked if they are as secure as a linux repo. But the concept of "it is acceptable to download software from random websites" allows for malware to fit in there. Only if you will never find a .flatpak file it is possible to be sure its malware.
But there are other sandboxing options out there, such as using containers, and IMO, using a proper container is a better option for sandboxing. Or even better, use a VM if you're actually running an untrusted app.
All worse than bubblewrap. Containers are either manual af (like with bubblejail) or if you refer to Distrobox/Toolbox, unconfined by default. They have no portal integration and no GUI configuration apps. So it may work somehow but probably worse, more resource heavy and there simply already is something better.
Same for VMs. Keep an eye on Kata containers, but this is about least privilege, not some QubesOS system that will not run in a tablet, for example. Android uses containers, is damn secure, and runs on phones.
[non executable stuff]
This is about protecting against malware. Linux Desktops are built on a different logic. Any unconfined software can download a binary to localbin, copy a random desktop entry from usrshareapps to your local folder, edit the exec line and add that binary to it.
Or just manipulate your .bashrc, change the sudo command to read input, save to file, pipe input to sudo. Tadaa, sudo password stolen.
That concept of "users can change their home but not the system" is poorly pretty flawed. So any directory that is writable without any priveges is insecure, if you dont trust every single piece of software you run.
Agree that Snaps are a problem. Its only really problematic when repackaging is illegal though, of course annoying but the Spotify flatpak is a repackaged snap. Same as with appimages.
I should write the same about snaps, but I feel they are covered WAY better.
That native messaging portal is probably developed somewhere. But for sure, also apps installing themselves "partly" as an extension of another, like Zotero and Libreoffice. This could be done though, okay.
Themes generally just work on KDE at least. At least light/dark themes, which may not really be the fanciest of choices
Thanks. Also, afaik lots of software is not legal to redistribute as Flatpak.
Totally understand that. Development docs are so needed.
Oh nice!
Flatpak also works everywhere and appimages are not ported to fuse3...
I mean I want to think Appimages where nice, and they are kinda, but no.