• AMDIsOurLord@lemmy.ml
    link
    fedilink
    arrow-up
    5
    ·
    edit-2
    8 months ago

    People download and run completely opaque AppImages from god knows where and that’s better than Snap Store which is hit with malicious apps so rarely it’s actual news

    Flatpak also has a system where any scammer and malicious developer can just roll their own flatpak repo and voila, nobody can stop them. If it ever becomes mainstream, it’ll be a shit show worse than Google Play

    • Gamma@beehaw.org
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      8 months ago

      You’re pretty much just rehashing a possible apt repo “vulnerability,” but at least with flatpak they remember where each package was installed from.

        • Gamma@beehaw.org
          link
          fedilink
          English
          arrow-up
          3
          ·
          8 months ago

          Anyone can create an apt repo and the override your system packages with new versions.

          At least with flatpak only the applications you installed from the bad actor’s repo would be affected, though obviously they can still have a ton of malicious dependencies

    • jbk@discuss.tchncs.de
      link
      fedilink
      arrow-up
      2
      ·
      8 months ago

      Text files could theoretically contain malicious content. Why doesn’t the format have a built-in virus scanner??? Is this what you’re suggesting?

      • AMDIsOurLord@lemmy.ml
        link
        fedilink
        arrow-up
        1
        ·
        8 months ago

        No, but root-of-trust isn’t really established unless you ONLY take packages that the distro’s security maintainers actually maintain, Flatpak, Appimage and Snap are a bit of a no man’s land. You have to trust the developers to be cool, independent of the tool, unless you as mentioned before use only FOSS software from the distro’s main repositories. And yes, specifically main repos because any random dick can go and upload a PKGBUILD or make a PPA.