173
Inkscape Flatpak is looking for a maintainer!
(github.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 25 Jun 2024
173 points (95.8% liked)
Linux
45457 readers
1427 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
Wait till you learn that your flatpak client doesn't verify anything it downloads
*'til
But the lack of verification and validation is a huge risk to flatpaks. As someone formerly involved with securing OSes, this kind of thing was scary back then and doubly scary since it entered its "don't confirm; just get in, loser" phase.
😱 so I guess install via appimage?? Package manager? 🤷 🤯 brain malfunction. Im thinking don't download or install until you verify the download with a hash and hopefully signature if they exist 🤷 use fedora? Which has better security? 🤷🤯
Many developers sign their AppImages, but its up to you to verify it
For checksums: https://github.com/flathub/flathub/issues/1498#issuecomment-649098123
But for signatures: https://github.com/flatpak/flatpak-builder/issues/435
Checksums are not for authenticity, and link me to the docs that indicates that ostree's optional encryption is enforced in flatpak
I didn't say they were. Hence the second link.