Okay having an easily readable build file is a bit missing. Flathub hides that a lot.

I think their rating system, which is on the website and also GNOME Software, displays apps with home access as insecure.

And somehow this seems to be general knowledge and an issue about a privilege escalation through a local override was just closed. Yay

What points?

How come the other distros don’t seem to care?

Obviously because they are SO MUCH MORE BADASS.

No.

https://lmddgtfy.net/?q=why can ubuntu ship nonfree codecs

Which is not needed but a good bonus. VLC and others are still unverified, even though very well packaged.

But I dont care about VLC anymore haha, Celluloid has Wayland support, portals, MPV configuration and is better for watching movies. Not for music though.

Fair point. But when apps are on Flathub and people say “I dont care I have the AUR” they need to know.

• the AUR has no verification at all
• the apps have no permission system at all, so you need to trust them 100%
• they are installed on your system and might mess up updates, give dependency errors etc.
• their solution does not apply to nontechnical people. If a solution is not scaleable, it is not a good solution

Same. Ubuntu AND Fedora Libreoffice, SciDAVis and more where broken, not the Flatpaks.

Flatpak is really meant for the big GUI apps. No problem with small distro packages really. It just takes off the huge burdens of maintaining distro packages for like Libreoffice, which is as big as the Linux Kernel.

You need to be more specific.

You need to think about the background problem here.

When Google made Android, it was web based. Their “perfect sandbox” ironically has no internet toggle. They won tons of marketshare, and iOS is not different here, both restrict apps to containers and have permission systems to reach out of these containers to access sensors, files and other data.

Desktop operating systems are way older and have no such concept. We have mandatory access control with SELinux and Apparmor, but those are (I think) more complicated than Flatpak.

Flatpak is a solution for multiple problems of Desktop Linux Apps at once.

1. isolate apps with a real permission system
2. make apps run anywhere
3. have a single platform to target, so we dont need packagers anymore (for most GUI apps) and can file bugs upstream
4. separating apps from the system: stable distros can have modern apps (similar to Windows) and Apps dont affect the stability of the OS at all. Also config files of such apps are in their container, not bloating your “oh so good xdg basedir”

These are all extremely important points for a healthy, modern and secure Linux Desktop.

But there are also issues to every point:

1. most apps are not adapted to this model, which means they need broad static permissions like Pulseaudio, home or even host, allowing surveillance or trivial (even documented) privilege escalation. This is basically how apps like Flatseal work. Pulseaudio has no portal, do apps can listen to your mic whenever they want.
2. Apps that “run everywhere” will not have distro-specific optimizations. The system needs to run on old LTS kernels to be universal, which means you miss out on tons of optimizations. Developers could just not care, but this depends on the app.
3. Flatpak is more complicated than Snap (or even Appimage, if you leave the manual signing, monitoring vulnerable libraries and having a manual repo out). So it is not a great experience for “the Linux packaging model”. GNOME Builder is a good IDE for it but afaik only for GTK apps.
4. No issues here. This is the core princible of “immutable” distros like Fedora Atomic Desktops.

If you have issues with flatpaks, you need to be more specific. Maybe it is a packaging issue, or you expect an app to do stuff that is not

Uhm this is linuxmemes my guy

In emacs, nano

Wrong post?

https://ubuntuce.com/

Agree, fedora atomic is the best OS base there is. I am also testing COSMIC which is now under the ublue org.

discussion.fedoraproject.org is there for problems.

I agree that Fedora variants need more tweaking, but processes are so damn slow. For example setting up external repos would very well be possible, but they will add an intransparent “add external repos” page to Kinoite. At least that.

What is “overlays”? You can overlay packages with various package managers from many repos on many distros

The Arch repos, being quick, rolling, not restricted legally or being upstream of some corpo distro like Fedora or OpenSUSE etc

Idk ask Steam?

I can recommend a semi-rolling distro ;D wayblue has some defaults, but I have not tried it. There also is a hardened version of it under the secureblue images. Although I think the maintainer has horrible control issues, I cant deny that the product is near perfect (apart from opinionated Chromium enforcements and some hacky parts like LD_PRELOADing a different allocator) and use the kinoite variant daily.

Stacer for the win!

Agree on the Fedora problem, but the solution is pretty easy.

# install the RPM packages, your system is auto detected, the packages take care of updating the repos
sudo dnf install https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm

# enable cisco-openh264 to be sure
sudo dnf config-manager --enable fedora-cisco-openh264

# install ffmpeg with allowerase
sudo dnf install ffmpeg --allowerasing

# or, if you just want videos, without uninstalling anything
sudo dnf install libavcodec-freeworld

Thats basically it. On the Atomic variants, installing libavcodec-freeworld is just as easy, but allowerasing doesnt work so you need to uninstall everything manually to unbreak ffmpeg. Or you just use uBlue where it is already done and default (this will also avoid any rpmfusion incompatibilities to happen on your device and on the server instead)

Yes this is annoying, but you do that once and afterwards have a current release more stable than Arch, and an old-supported release that is even more stable.

I might have something shocking to tell you. There are distros with good defaults!

Free from religion

CDE (common desktop environment) was proprietary afaik. Crazy times