Nice
Good to see one of the two big packaging hubs do something against malware
Next step, display the "potential unsafe"-badge next to verified or unverified, that can be found on the same page. In example https://flathub.org/apps/io.github.shiiion.primehack is marked as verified, but if you scroll down you can see the application has full system and data access and is marked as potential unsafe.
How does that Help against Malware?
It makes it obvious to people whether they are downloading Google Chrome as packaged by Google or as by someone else. That being said, Google Chrome is malware. That being said there is a lot more that needs to be done to truly prevent malware, which will be costly but will hopefully take effect when they've got the budget for it
Apt has done this forever
Verification doesnt help at all if the source is not trusted. All this says is "upstream developers maintain this package". Unofficial packages can be safe too, like VLC.
It does help prevent actual malware from being downloaded, though, since upstream developers probably won't publish malware on Flathub.
But this is still a half-measure. I don't understand why Red Hat and Canonical don't treat this issue seriously; people on Linux are used to assuming software installed from the repos are safe, and yet Snap and Flatpak are being pushed more and more despite their main repositories being potentially unsafe.
This is a good step but I still feel like it's pretty obscure where a package is actually coming from. "by Google" or for the Steam package "by Valve" is really confusing and makes it sounds like it's coming directly from the company. Unverified tells the user to pay attention but there is no hover over to say what it actually means.
Wait… so the author displayed in “by <author>” is the supposed author of the software, not the one that put it on the store? That’s insane! Also sounds like you’d be open to massive liability since the reputation of the software author will be damaged if somebody publishes malware under their name.
It should be:
- Developed by: <author of software>
- Uploaded by: <entity who uploaded to store>
Also maaany packages direct to issuetrackers of projects not supporting that flatpak.
If someone knows where that flathub metadata is stored I would love to know, as the manifest is not it. I would like to fix those to link to their own bugtrackers
Traditional GNU/Linux distributions (as well as F-Droid) are not "app stores" even though they are superficially similar. Traditional distributions are maintained and curated by the community, and serve the interests of users first and software developers second, whereas an "app store" has minimal curation and serves the needs of software developers first and users second.
I point this out because there's an annoying meme that traditional distributions are obsoleted by the "app store" model. I don't think that's the case. "Verification" is essential for an app store but pointless for a distribution.
great, when appimage hub begin doing this
I still don't understand why a central repository for AppImages exist. The moment you are using a repository (and possibly version management), the format looses its reason to exist.
No. Appimages are selfcontained and thus useful for archiving software or carrying it around in random ways. Flatpak could do this too but not as easy.
What app is that GUI from?
This screenshot is from the Flathub website. The only good GUI for Flatpaks...
This is misleading at best. "verified" only means that Flathub knows who did the upload. It doesn't tell you anything about the safety of the app, and it doesn't mean the app is affiliated with who you think it is.
