Are packages from flathub always safe?
I usually trust my distro repos without checking. Can the same be applied to flathub without much worry?
You are viewing a single comment
I usually trust my distro repos without checking. Can the same be applied to flathub without much worry?
At https://blog.frehi.be/2023/04/23/the-security-risks-of-flathub/ someone has published an article about Flathub in which he addresses a few problems.
Therefore, the answer is that Flathub is not always safe to use. However, I do not know of any package source that is always safe to use. Is Flathub more insecure than other package sources? I can't answer that because I don't use solutions like Flatpak, AppImage etc. myself.
It's more about trust, than security. When you use a specific distro, you only have to trust the distro packagers. These packages are reviewed by multiple persons, tested thoroughly and (usually) built in a reproductible way. The packagers are usually different from the developers, so they can also review the code itself and eventually patch issues if needed to be in line with the distro's ideology.
With flatpak, snap and friends, anyone is a potential packager, so for each software you gotta trust this single entity, which is usually the developer itself.
I can: yes, Flathub is more unsafe than package managers that actually verify all packages signatures after they download software.