You have written tests for your code and now feel safe because your code is tested. But test quality is really hard to measure. The idea seems to be to introduce “vulnerabilities” (whatever that means…) and see if your tests catch them. If they do that’s supposed to show that the tests are good and vice versa.
Similarly, there’s System Admin Girl★まんがでわかるLinux シス管系女子 Imported a physical edition just for the quirky factor of a Linux Admin manga, but it is pretty well made and does explain pretty well some bits (even if from the first episode, they explain how to do VNC if i remember, from a Ubuntu 16.04 LTS desktop, so fairly easy and old) but it still on-going !
Oficial repositories, unoficial repositories, flatpak, snap… What happened to just donwload the app from it’s own creator and install on your machine? Why do we need every app being touched by some rando before I can install it on my box?
Your wanted option is not gone, you can still download the binaries if the author presents them; or you can compile it from source. This is just another, more convenient way to distribute the program.
If you are looking to get your programs Windows-style, to download a binary or “install wizard”, then you can look into appimages.
Like any form of distribution however: someone has to offer this, be it the author or “some rando”.
If you mean downloading random stuff from random websites, yes.
But they dont have installers, so no verification, no moving to locations where executing is allowed (on Linux the entire home is executable which is a huge security issue) no desktop integration, no context menu, no file associations.
A matter of perspective I think. It’s a flaw in my opinion. Just downloading anything from anywhere sets one up for failure/malware.
Code Signing on its own is useless, I think. If there is no distribution structure or user-validated trustchain, of course. But then you don’t really need Code Signing, a simple hash is enough.
My personal preference are the distro repos, to a point where I even dislike additional package managers like pip, npm or cargo.
Just downloading anything from anywhere sets one up for failure/malware.
Reducing the size of the OS helps a ton here.
And mounting home read-only. I think Android and ChromeOS do that. I will experiment with that too, it is really interesting. You mainly need a different place to store user scripts, and appimages are broken (how sad), the rest should be fine.
Then a few more core concepts help too:
KISS (keep it stupid simple)
Unix philosophy (everything does one thing and stays transparent)
and the concept of least privilege (seccomp, MAC (mandatory access control, SELinux/Apparmor, sandboxes, jails, etc).
Flatpak helps a ton centralizing the packaging efforts. And it works. There are tons of officially supported packages. And I guess many of them will be maintained upstream.
But you still have a secure system, sandboxing, verification and packagers that keep an eye on it, kind of.
On a secure system you would need to pay a lot of people, like the typical 3-5 people that package most apps. For doing security analyses, opting-in to every new update etc.
I’m sorry, I don’t think I can see the point you are making. Are you saying that one can get around the 3-5 people by using flatpaks, ro home directories and other mitigations?
You still have to give the exec permission to the appimage.
True, but this only prevents against stuff executing itself.
Mandatory access controls and sandboxes only protect the core system. Like installing packages with root.
You put things there privileged, so you know what you run comes from a protected area.
Running things from random directories (like ~/Applications which AppimagePool uses) destroys that.
Suddenly you rely on an executable home dir, which means any regular software (including appimages which are nearly impossible to sandbox) can write to the area where your programs are.
That concept is so broken that it needs to go.
I am against flatpak install --user for that reason, because no program should come from an unprivileged directory.
The issue especially is if it doesnt follow standards. ~/.local/bin is a standard, and with SELinux confined users you may be able to protect that directory. But random ones like ~/Applications that dont follow any standards, will not work.
Maybe no context menu depending on what you mean exactly
The “open with” and “create new” things. Actually,
Flatpaks cannot create “create new” entries too. I am currently experimenting with these, as it sucks to not be able to “create new Libreoffice writer document”. And the xdg-templates directory doesnt do anything lol, you still need desktop entries.
but the rest are fully possible and I do it on a regular basics
The concept of an installer is that the app does that on its own. That is pretty bad and the kind of Windows crap we absolutely dont want.
But on good operating systems, a privileged package manager does all that. Puts the stuff where it belongs. Flatpak for example links the desktop entry that the app itself contains in a sandboxed directory, to the export directory where the OS sees it.
And some portal or whatever deals with the “standard apps” stuff, like that Okular Flatpak will be shown to support opening PDFs.
If apps do this on their own that means a single app can mess up your entire system, also malicious.
Appimage may have tools, I only tried AppimagePool for curiosity and the experience was pretty bad and incomplete.
But the issue is that they were just thrown out there, “here devs, do the same shit you do on Windows, it is totally normal for people to double click an executable, not have any sandboxing, deal with updates on their own, dont have any cryptographic verification, …”.
And only afterwards came the managers, the daemons, which cover a part of it.
They (could) solve:
being privileged, placing apps in not user-writable directories
having access to integration locations, that apps should never touch
downloading from defined, maintained locations (instead of letting people click on random internet malware ads)
running in the background, notifying about updates
centrally managing these updates
verifying signatures before allowing updates
doing the actual update process (instead of deleting a file and placing a new one)
And they often dont even do that. There are no signatures, as devs were never told “either you add a signature, or people will not install your app”. So there is zero verification
But they dont solve the core issues that are:
devs were told they dont need to care about…
creating metadata
creating a real repository
signing their apps
using a standardized build system
transparently declaring used dependencies (i.e. using a given set of them), thus deduplicating them
declaring opt-in permissions, so users know if the app is insecure (appimages are impossible to sandbox with bubblewrap, and hard with firejail (which is a setuid binary and had security issues), dont know about nsjail, crabjail, minijail or others)
Flatpak is similar to Android. On Android you still have a package manager but the APKs are signed individually, updates just allowed if the signatures match. So you can sideload how you want, it is still secure.
And using Obtainium, which is kind of like an AppimagePool, you can get all the apps from independend developers.
But they were told they need to follow all these rules, Appimage developers can do whatever they want.
It isn’t perfect though, right now its biggest limitation is that a sandboxed appimage can’t launch another sandboxed appimage. But dbus, pipewire, vulkan, themes, etc works.
The “open with” and “create new” things. Actually,
You can totally do that with appimages once they are integrated into the system by the previously mentioned tools, those menus rely on desktop entries in $XDG_DATA_HOME/Applications.
That concept is so broken that it needs to go.
Good thing we have choices on linux, you can make your entire home not executable if you want to.
I like to keep all the software that I need in my home, because that way I don’t depend on what my distro provides. I can just drop my home anywhere (besides a musl distro) and I’m ready to go, I even have my window manager as an appimagebecause I couldn’t compile it statically.
But the issue is that they were just thrown out there, “here devs, do the same shit you do on Windows, it is totally normal for people to double click an executable, not have any sandboxing, deal with updates on their own, dont have any cryptographic verification, …”.
AppImage is just a format, same as a deb or rpm, you decide how you handle it afterwards.
doing the actual update process (instead of deleting a file and placing a new one)
On Android you still have a package manager but the APKs are signed individually, updates just allowed if the signatures match. So you can sideload how you want, it is still secure.
You mean the APK itself does the signature verification or what? With appimage it is AppImageUpdateTool that does the verification.
(appimages are impossible to sandbox with bubblewrap, and hard with firejail (which is a setuid binary and had security issues), dont know about nsjail, crabjail, minijail or others)
You still have that github repo saying that appimages bloat the system when that is a total lie. they can even use less storage than native packages let alone comparing it to flatpak…
~/Applications is no a random place, it comes from macos.
Hahaha I would call that VERY random. It is problematic that the default xdg directories are hidden.
And I just learned that you can just source scripts into bash and thus being executable or not doesnt matter. What an incredible design flaw… at least this just works with some binaries, I guess?
You mean appimagetool
No the Flatpak Appimage Pool. But a solution to easily package a bunch of files sounds really awesome. I miss that for RPMs, sddm2rpm did this kind of.
appman
Very interesting tool. So this is for appimages but also binaries?
I am a bit confused, especially as they state to prefer official releases, which for me means tarballs.
But a very good concept.
Interesting set of apps you have there. And ironically I have to agree they are small. Flatpak libraries are too huge and the deduplication doesnt work if it us not used for downloads and if there are dozens of runtimes.
A modular approach would be very much needed, instead of a damn KDE runtime that is nearly the entire desktop.
But I have some questions.
Yes that’s aisap sandbox
Thats not a sandbox, its a nice wrapper for firejail, at least what they write. I only knew some Github issue where they discussed this, and because Appimages require fuse they couldnt be sandboxed with bubblewrap.
Then they say “bubblewrap is used in Flatpak” but no comment if THEY also use it.
Firejail is the setuid binary I talked about, they likely have fixed their security issues but bubblewrap/bubblejail are probably better as they dont need setuid binaries.
If Appimages are possible to sandbox with bubblewrap, that would for sure be cool.
I also found rustysnakes crabjail, dont know the state it is in, but that is a possible candidate for replacing bubblejail.
right now its biggest limitation is that a sandboxed appimage can’t launch another sandboxed appimage.
No idea if Flatpaks can do that. But I would say the biggest issue is that the big vendors just put their appimage on some file server without any data on the sandbox.
Flatpak is way better here, where the sandbox is checked BEFORE apps are successfully submitted. And there are warnings etc.
And, of course, every app is sandboxed, not just a few.
those menus rely on desktop entries in $XDG_DATA_HOME/Applications.
Not the “create new” to my knowledge. That is in $XDG_TEMPLATES_DIR but I am currently struggling to make Flatpaks use that.
AppImage is just a format, same as a deb or rpm
Yes, so is Flatpak. But Appimages were introduced to be Windows-like. Sure there are companies that dont care and publish random rpms on their website too.
But with Appimages that is the only way as there is no real repo. AppMan is a cludge here, bundling together tons of different sources, kind of like Obtainium.
That tool is either completely finished or kind of abandoned.
Interesting, didnt know they have a signature builtin. That would also be useful.
That zsync2 thing explained in AppMan was just like delta updates. If a malicious actor has access to the old appimage and the fileserver, they can produce the correct zsync2 thing and the updates work, until signature verification is enforced.
I like to keep all the software that I need in my home, because that way I don’t depend on what my distro provides.
As I said, as long as bash script.sh works with nonexecutable stuff, noexec home is pretty worthless. Just another layer of defence.
You mean the APK itself does the signature verification or what?
No, android APKs are like Distro packages, they can be sideloaded however you want and then are forwarded to the “session installer” (on modern android), which is the “package manager” of android.
That installer saves the signature somewhere, and from then on you can only update the APK if the signature was made with the same private key.
Found out you can also not sign APKs, which happened here. I honestly dont know if more developers dont sign their APKs.
I will update my repo text to get to the current state of facts.
Appimagelauncher, gearlever, AM, etc. Which is the same as a install wizard since it integrates the appimage into the system. AppImages do not need to be extracted into the system which is what windows install wizards do.
Appimages came before these tools, and the tools (forgot the name GearLever, AppimagePool is another one) came afterwards.
They are structurally better as they are external.
That verification is interesting. So it is another appimage, used to verify appimages? Are all Appimages using that, if not what percentage of the ones you know? And are tools like Gearlever enforcing or using that signature check?
Are all Appimages using that, if not what percentage of the ones you know?
Usually if the appimage has a github release with a zsync you have that verification.
And are tools like Gearlever enforcing or using that signature check?
I don’t use gearlever, as far as I know gearlever doesn’t even let you sandbox the appimage like AM does. I don’t think any of those forces signature verification besides AppImageUpdateTool and that’s because that’s part of the zsync update process.
Interesting, will look into this. The issue is of course that these tools are optional.
But if they work, they may fix nearly many issues. Some will remain, for example many proprietary apps dont use Github releases, while these may be especially targets of fakes.
!boinc flatpak also needs a flatpak maintainer! Your work would help people contribute their spare computational power to scientific research. If you are passionate about fighting cancer, mapping the galaxy, etc this is an awesome way to contribute to that effort in a very force multiplying way.
I’m new on Linux, and I don’t get nixos. I know about backups and how to keep all my stuff safe and ready to easy restore and have things running as fast as possible. And I don’t use to break the OS itself regularly .
It’s not for everyone. The idea is to have your entire system reproducible with a few configuration files, which you’d then ideally store in a VCS like git.
I haven’t messed with it, but there is something appealing about the ability to reboot to an older snapshot of the system if an update breaks something, or being able to use a config file to restore your system to the exact OS version and exact versions of whatever apps you use.
I see . Seems suitable for infras with thousand of servers and is not the same backing up configuration files than whole snapshots of the OS. Don’t know how works with installed apps like nginx and their configurations.
I guess that’s where the advantages come into play the most. I only use it for a handful of machines (2 notebooks, one workstation, an SBC and 2 VPSs) and it’s still a great solution, though there is quite the overhead for the first setup.
Anyhow, that doesn’t mean that it’s more work in total than other distributions. The module system catches a lot of configuration errors for you which means you basically never and up with a “broken” configuration, and even if you did, you could select an older generation (more correct way to say rolling back on NixOS). Sure, the configuration might not do want you intended, but it will most likely be functional.
This even goes so far that some modules detect common configuration pitfalls for applications, like headers not being inherited because they got redefined.
From my short time with proxmox, I had to dive into the command line to do configuration at the host level that couldnt be done with the UI. I think nixos will help replacd those ad hoc configurations with nix options. In the many articles I read about gpu passthru, and also doing harddrive passthru, I had to work in the host debian environment.
I dumped proxmox because I couldnt get gpu passthrough to work, and havent looked back. Nixos modules and docker have served me better than VMs for my usecase.
From the conversation it seems to be a similar situation to the project I’m with is in. The flatpak is essentially community maintained rather than being directly supported by the team. To become verified it needs to be done so by a representative of the maintainers of the software. To be verified it doesn’t have to have a team member involved in it but this is a requirement Inkscape seem to have imposed.
For us we just aren’t in a position to want to support it officially just yet, we have some major upgrades coming to our underlying tech stack that will introduce a whole bunch of stuff that will allow various XDG portals etc. to work properly with the Flatpak sandboxing model. To support it now would involve tons of workarounds which would need to be removed later.
But the lack of verification and validation is a huge risk to flatpaks. As someone formerly involved with securing OSes, this kind of thing was scary back then and doubly scary since it entered its “don’t confirm; just get in, loser” phase.
😱 so I guess install via appimage?? Package manager? 🤷 🤯 brain malfunction. Im thinking don’t download or install until you verify the download with a hash and hopefully signature if they exist 🤷 use fedora? Which has better security? 🤷🤯
Flatpak does verify the integrity of files as it is downloading/installing them. For ostree remotes this is done using GPG signatures (which are better than mere checksums). If you want to see the commit ID (which is like a checksum) for something on flathub use e.g. flatpak remote-info -c flathub org.gnome.Builder and for the local copy flatpak info -c org.gnome.Builder. For OCI remotes we at least check SHA256 sums and there might be more integrity verification mechanisms I’m unaware of.
github.com
Hot