15 ms·

KDE and GNOME seeks $100k to turn Flathub into a Store for the Linux desktop

405 points by evasb 4y ago

JohnFen 4y ago
This fills me with dread. I don't think the app stores we've seen have been good things for a number of reasons. I hope, if this succeeds, it turns out to be a good thing.
- jacooper 4y ago
  Unlike google play, apple's appstore and canonical's Snap, flatpak isn't limited to a single repo, apps from other repos will show up in the store ui just like any other app.
  - JohnFen 4y ago
    Yes, I understand that. That is orthogonal to my opinion of app stores, though.
    - yathaid 4y ago
      Are the margins on this website too small to note down your objections? :)
      - JohnFen 4y ago
        App stores are gatekeepers, and while they certainly can make things more convenient, they also encourage habits that I think are harmful. Such as thinking that app stores are the only way to install applications. I think that it has been a bad thing that users are conditioned to think that if it didn't come from an app store, it's dangerous or wrong somehow. It forces developers to use the app stores. I understand that many may not see this as a problem, but many developers (including myself) would very much prefer not to have to do that. So it's a disincentive to make software for others, at least for some. In the case of this one, I also am very nervous about the incorporation of a payment system. I fear that will discourage the creation of quality free software, and I think quality free software is a huge benefit. In short, I fear that this app store will resemble the Android Play store, or Apple's app store, and encourage the same problems and adverse impacts they have had.
ekianjo 4y ago
> we also reduce the ability for users to scrutinise the source in the Flathub build system that was used to build their application Wow.
sys42590 4y ago
Flathub could become the killer "app" for the Linux desktop. No need to juggle dependencies and third party repos. The software you need in an instant.
- heywhatupboys 4y ago
  >relevant xkcd comic on standards inserted here
  - tombert 4y ago
    I agree that it is "yet another standard", but I gotta say that Flatpak is pretty sweet, and does actually do a good job of making "one package manager to rule them all". I think part of the problem with a lot of "selling stuff on Linux" has been mucking around with different dependencies for the thousand different versions of Linux. Historically, this has led to a couple solutions: either a) Just officially support one distro (usually Ubuntu), or b) just don't release a Linux version. Flatpak has actually succeeded in making a system that kind of works everywhere, and I think it actually has a shot of being an equivalent to the Mac App Store.
    - input_sh 4y ago
      > and I think it actually has a shot of being an equivalent to the Mac App Store. This I agree with, but not this: > and does actually do a good job of making "one package manager to rule them all". That's not its goal. There are no terminal apps in it, so everyone that wants to run custom packages from a terminal is still going to need something like apt/dnf/homebrew.
      - tombert 4y ago
        Maybe I'm speaking a bit too broadly; at least in regards to GUI apps, it's been a pretty nice "unifying force" for me when I ran Linux (which has admittedly hasn't been a few years now).
      - zitsarethecure 4y ago
xen2xen1 4y ago
$100,000 to build up a system that totally ignores the system package manager? Sounds great!
- Gigachad 4y ago
  Good. The “system package manager” is good for updating the OS, it’s not good for packaging desktop applications, especially proprietary ones. If you use the gnome Software app, it merges flatpak, dnf, and the firmware updater in one “updates” page with a single button to update it all.
  - c-hendricks 4y ago
    I don't even know what I get out of the system package manager these days. Apps are mostly flatpak / appimages, dev tools I'm using Homebrew. I guess it's mostly the kernel and my DE these days.
    - Gigachad 4y ago
      Traditional package managers like dnf and apt are probably not even the best way to update the kernel and OS these days. Immutable images like what’s used in Fedora Silverblue (as well as android and iOS) are much more reliable and probably the way distros will move
  - crispinb 4y ago
    That very incoherence is probably why it rarely works.
    - Gigachad 4y ago
      I completely know what you are talking about, I’m used to the Software app virtually never working, although I came back a few months ago and it all seemed to be working perfectly fine. So perhaps there have been some major improvements in this space. At any rate, the problem is not unsolvable, it was mostly just bad UX where underlying errors were not surfaced and the app would get stuck in an endless loading spinner.
winrid 4y ago
how much to add thumbnails to the file picker?
- eptcyka 4y ago
  GTK4 is getting them.
  - awill 4y ago
    It's not GTK4, it's nautilus
    - PlutoIsAPlanet 4y ago
      The recent GTK4 release added them to the file picker. Apparently changes in GTK4 made it easier to add
- gp 4y ago
  Looks like there has been some progress on this front - https://gitlab.gnome.org/GNOME/gtk/-/commit/b0f65ead84c1ecd5f40683503ca972c6e1a95b3c https://gitlab.gnome.org/GNOME/gtk/-/commit/b0f65ead84c1ecd5...
  - winrid 4y ago
    Amazing! Thanks feaneron!
  - mouse_ 4y ago
    free desktop "making progress" on something Windows XP had no problems with from the get go is frankly embarrassing and probably a sign of, at best, destructively entitled maintainers, and at worst, controlled opposition.
    - winrid 4y ago
      I think it's just bad design and tech debt, and maybe leadership having trouble getting someone to take the risk to make the change. Looks like it's getting fixed, though.
mastazi 4y ago
I'm an Ubuntu user and the first thing I always do in a new system is removing the Ubuntu Store, completely removing snapd, and installing the Flathub Store.
- mesebrec 4y ago
  Honest question; why do you still use Ubuntu then? By now, Snap is such a fundamental part of Ubuntu that it begs the question whether Ubuntu is right for you if you want to avoid it. Why not use a derivative or upstream that makes different choices?
  - Shared404 4y ago
    I also have an Ubuntu desktop which I've ripped snap out of. In my case, it's because my options are pretty much Ubuntu or Windows for this machine, and there's no contest there.
  - awill 4y ago
    agreed. Ubuntu are trying to hard to differentiate themselves, and it usually just hurts them. I'm guessing they'll drop snap in the future and blame the industry (like they did with systemd and wayland)
  - cld8483 4y ago
    Ubuntu is an African word which means "Afraid of Debian" Seriously though, just install Debian. It's not hard, the netinstaller may be text-mode but it walks you through the simple steps one by one just like Ubuntu's GUI installer. Anybody who's comfortable using Ubuntu in the first place should be able to get through the Debian installer just fine.
    - wrycoder 4y ago
      Even better, install Devuan, which is Debian without systemd (the attempt to turn Linux into Windows). Many former Debian developers are now working on Devuan.
fooker 4y ago
Maybe Valve could fund them? Anyone have the connections to make this happen?
- PlutoIsAPlanet 4y ago
  I believe Valve already makes contributions to Flatpak and its backend container stack, bubble wrap. Valve actually uses bubble wrap on the Steam deck for proton.
wetpaws 4y ago
Why the hell do you need store when you have pacman/AUR
- Grimburger 4y ago
  How do I sell my software on pacman?
  - Gigachad 4y ago
    I’m not sure people will ever want to sell apps on a 3rd party store. Especially a Linux one. The entire industry has moved away from buying things directly on a single marketplace and moved to tying a payment or subscription to an account which works across OSs and store platforms. I’d be happy to pay for Linux software but there is no way I’d want to be tied to a particular distro/repo/storefront.
    - Grimburger 4y ago
      That's fair but some companies do want to sell their software and it's not particularly easy on Linux platforms. There's basically Steam or DIY.
      - worksonmine 4y ago
        Windows has existed for most of lifetime without a store or even central package management but it was still the biggest platform for commercial software. And recently the App and Play stores seem to cause more trouble to many companies than it's worth. If they used the royalties to hire people to audit the packages I might even consider paying for free software, but I'm afraid it will turn into walled gardens where small developers have no say and the big ones just deal with the problems because it's the only option. I hope it turns out to be better with KDE and Gnome that come from a FOSS background but money makes people greedy.
- skeaker 4y ago
  User adoption, I guess
Slighted 4y ago
Uh no, I wouldn't even hand over a penny to the GNOME project.
freedomben 4y ago
I haven't been the biggest fan of flatpak and generally wish software would either be packaged as an rpm or an AppImage, but the OP makes a pretty strong case for why it's a good idea (because existing options are too niche, and have no ability to incentivize developers who need to get paid for their work. This leads to Linux desktop having far fewer applications available to them compared to windows and mac.) I do hope the command-line UX around flatpaks (installing, updating, etc) improves a lot though as currently it leaves much to be desired.
- ekianjo 4y ago
  > This leads to Linux desktop having far fewer applications available to them compared to windows and mac.) There's far fewer applications because there's a very tiny market share compared to these two OSes. Not because of the lack of payment systems.
  - yjftsjthsd-h 4y ago
    I mean, it's probably both.
    - freedomben 4y ago
      Yes definitely, it's probably both. Both are in a feedback cycle as well. Less people means less attention. Less attention means less people. It's a hard cycle to break.
- panick21_ 4y ago
  AppImage has issues. The guy from Suse who does MicroOS, Richard Brown, a few years ago was literally walking around giving talk about how bad Flatpak was and how everybody should use AppImage. In his most recent talk he basically said, he was wrong, the Flatpak people did address most of the issue he had and AppImage was no viable. https://fosdem.org/2023/schedule/event/containerised_apps/ https://fosdem.org/2023/schedule/event/containerised_apps/
  - 4y ago
snshn 4y ago
[flagged]
throw_m239339 4y ago
I had to use flatpack to install Bottles, I'm on Porteus because it's the only distrib I found that would fit on a 15 year old 512MB USB stick and then in the RAM directly... Let just say it wasn't a seamless experience but I'm glad I managed to run Cinema4D R20 or MPC Software with Bottles without too many bugs. Anyway Bottles is just fantastic, I tried Wine before but it never worked properly, but having to install a package manager (flatpack) on top of another one (slackpkg) just felt absurd... What about appimage instead, like Krita? To me it's sounds like the best way to distribute a linux app in 202X... Managing to make things run on Linux gives a sense of accomplissement, at the same time, I can understand why most people won't move to Linux anytime soon given all the complexity involved... or it's just me and there was an easier way to install flatpack at first place?
- cld8483 4y ago
  AppImage is great, definitely the best of the bunch.
  - PlutoIsAPlanet 4y ago
    Said no one relevant AppImage solves the packaging problem in a bad way (ugh, loopback mounts), but does not solve the dependency problem, try run AppImages compiled for Ubuntu on Fedora..
    - cld8483 4y ago
      > Said no one relevant [Retort insult.]
    - Gigachad 4y ago
      The main use case for appimage imo is things you just want to run once quickly and easily. Trying beta builds from github releases for example. It's quite poor for anything you frequently use or want to keep updated. It's also completely lacking security iirc which Flatpak does well.
  - badsectoracula 4y ago
Liquix 4y ago
Opinions on Flatpaks/snaps notwithstanding, it's encouraging to see KDE and GNOME collaborating on projects like this. IMO desktop GNU/Linux has benefited greatly from moving away from offering LXDE/LXQT/Mate/Enlightenment/Cinammon flavors and towards a more digestible subset (GNOME only, GNOME/KDE/XFCE, etc) of polished desktop environments. Pipe dream, but it would be incredible to see all of the passionate, talented folks working together on one definitive GNU/Linux DE.
- themodelplumber 4y ago
  I'd prefer to see more easily-communicated DE standards and published levels of adherence, rather than moving to the uni-desktop. Like if you want to select a desktop and are kind of new to desktop environments, maybe aim for the (imaginary example here) DE-5 level of standards-adherence. DE-4 and lower might suck in various ways even though they could have cool new features. There are way too many benefits from the huge variety of DE approaches, including the benefit that Linux-critics often hide behind critique of a single desktop experience, which is lazy and attempts to steal focus from exactly this open, creative, diverse approach that is the jewel in the Linux ecosystem's metaphorical crown. It's definitely great to see the groups working together on these projects that benefit everybody.
  - reilly3000 4y ago
    I really think you are into something here. Some simple rating and standard icon would help users differentiate quickly. I know and love distrowatch and the rest, but it’s definitely inaccessible for most beginners and hard to discover what the best fit is for me.
  - derefr 4y ago
    > I'd prefer to see more easily-communicated DE standards and published levels of adherence, rather than moving to the uni-desktop. What's the difference? If everything works perfectly with everything else, and the standards adherence is so high that you can't tell the difference which apps are from which organization, then how is that not a "unified DE"?
jdoss 4y ago
I used to think Flatpaks were a huge pain the butt, but over the last few years, I moved to using them for all third party software that I run on my Fedora Linux workstation. Zoom, Slack, Spotify, Steam, Discord, Obsidian all run without issues and they get consistent updates. I am convinced now that they are one of the best ways to ship commercial software on to Linux desktop. Flatpak has been a key part of me becoming 100% Windows free for my PC gaming. Not having to run a desktop KVM to switch between my work workstation and my Gaming PC has been super great.
- silisili 4y ago
  I really like the idea. I think the only issue I ever had with them was the inability to inject files inside. Do you know if that's possible? I was trying to use a browser, I think Vivaldi, that had instructions for enabling widevine by copying a file to a certain directory, but I couldn't find a clean way to do so.
  - FeistySkink 4y ago
    If it's just a config file and the package is installed under a user, check .var/lib/flatpak/app
- jchw 4y ago
  One big tricky thing is plugins, such as for OBS. ABI incompatibility and sandboxing can make it tricky and confusing for end users. Flatpak itself could theoretically provide answers here.
  - sirsinsalot 4y ago
    I feel like you'd end up going full circle back to apt and npm and ...
  - viraptor 4y ago
    They'll have to do it at some point. There's just too many apps with plugins to ignore it. (Including basically all of audio production with their VSTs)
Darmody 4y ago
Meanwhile Ubuntu is making sure that none of its flavours has flatpak installed by default. Smells like that old MS attitude to me.
- sprash 4y ago
  Flatpak is essentially RedHat/IBM tech. Why should Canonical even think about supporting their competitors. Just because multi billion corps like RedHat/IBM have the audacity to ask for donations to develop their products doesn't mean Flatpaks are in any way neutral territory.
  - phendrenad2 4y ago
    Ah, refreshingly cynical. RedHat and Canonical would rather protect their smol kingdoms than expand the greater Linux ecosystem.
  - the_why_of_y 4y ago
    Flatpak is supported by Endless [1], SUSE [2], Codethink [3], Collabora [4], Igalia [5] ... none of these businesses have an issue with "supporting their competitors" because that's an inherent part of doing open source as a business. [1] https://support.endlessos.org/en/apps/flatpak https://support.endlessos.org/en/apps/flatpak [2] https://fosdem.org/2023/schedule/event/containerised_apps/ https://fosdem.org/2023/schedule/event/containerised_apps/ [3] https://www.codethink.co.uk/articles/2022/flathub-codethink-collaboration/ https://www.codethink.co.uk/articles/2022/flathub-codethink-... [4] https://www.collabora.com/news-and-blog/blog/2017/08/17/debconf-17-flatpak-and-debian/ https://www.collabora.com/news-and-blog/blog/2017/08/17/debc... [5] https://github.com/Igalia/webkit-flatpak-sdk https://github.com/Igalia/webkit-flatpak-sdk
- phatfish 4y ago
  Ubuntu is Microsoft's "favorite" distro, they do seem rather made for each other. The Azure dev tools on Linux i have tried are all Snap only, or a tar file and maybe an rpm/deb. At the moment they seem to avoid Flatpak like the plague.
dimaor 4y ago
I'm not sure if PopOs uses flathub by default for its PopShop, but I've always had some issues with it and they prevented me from using it and directly using flatpak CLI. - I don't know how to see running logs by default (if it's possible even) and it's a must when you have slow internet - sometimes it just hangs and I need to kill (probably leaving residue along the way) hopefully my issues are my own OR it will get resolved as well. other than that flatpak is amazing.
Octabrain 4y ago
I like Flatpak. I've even flatpaked some apps and made them available on Flathub. The only thing that dissapoints me is the fact that it integrates poorly with CLI apps. Off topic: An idea that came to my mind a few days ago is that would have been great to add support for desktop apps to Podman by adding some extension or plugin capabilities to it instead of creating a new whole technology. Probably a silly idea though.
- zozbot234 4y ago
  You can run generic sandboxes using Bubblewrap (bwrap) which is the underlying infrastructure for Flatpak. It's much lower level than Podman or Docker though, and closer to the basic reality of containerization as a usage pattern for Linux namespaces. You don't get compatibility with OCI specifications, so it's not the kind of containers that most people might be used to.
znpy 4y ago
love to see flatpak flourishing, it's really great. i like it because it actually solves problem (getting proprietary software like slack) instead of creating ones and/or getting in the way (i'm looking at you snap).
- Gigachad 4y ago
  Sad to see so many people treat package management like a gatekeeper. "Oh, you don't have an employee dedicated to maintaining 20 versions of packages for every single distro and release of distro? Well we don't want you on linux" Flatpak enables people to publish a single package that just works on all distos and doesn't break every 6 months. It's removing the maintenance gatekeeping. I think it will be interesting to see if tech like WASM results in packages which work across CPU architectures as well as Linux on ARM is very painful currently, let alone more obscure ones like RISC-V.
synergy20 4y ago
maybe it's indeed time to let the system package management(apt,rpm,etc) just manage a solid BASE system, and let Flatpak etc to manage their own application sandboxes on top, kind of like dockers. Appimage is macos flavor, it never needs your sudo to install the package, which is nice. Flatpak is a redhat flavor(kind of), it needs sudo sometimes, but OK. Snap is a ubuntu flavor(kind of), it is like systemd that can overtake the whole system, it can install package and even the whole system I was told, too much as a package manager for me. I don't use Snap. Appimage is not as widely adopted as the rest two? I think Flatpak is a great middle ground. It will be really cool if KDE and Gnome work together to build this.
- johnny22 4y ago
  > maybe it's indeed time to let the system package management(apt,rpm,etc) just manage a solid BASE system, and let Flatpak etc to manage their own application sandboxes on top, kind of like dockers. This is kind of how immutable systems like fedora's silverblue, and suse's microos are setup. The base systems are still built with rpm, but for user packages you either use flatpak or stuff in containers via toolbox or distrobox. It's still possible to layer stuff on to the base image if necessary though.
- twblalock 4y ago
  It's been time for that for a while now. Sandboxing and distro-agnostic packaging are definitely the way to go. They have some pain points but it's better to fix those than to go back to the older way of doing things.
- notepalf 4y ago
  > it's indeed time to let the system package management(apt,rpm,etc) just manage a solid BASE system It totally is! Why does a distro maintainer need to pack every known application into the OS and make sure it works? This kind of work does not scale.
- gjadi 4y ago
  Like *BSD, with base + ports.
canadaduane 4y ago
Richard Brown, who's been working on this problem for 10 years at Suse, says he was wrong in 2017. Flatpak is now the clear way to go, if you care about security, app updates, licensing, and multi-distro support (runtime dependencies). https://ftp.fau.de/fosdem/2023/UA2.114%20(Baudoux)/containerised_apps.mp4 https://ftp.fau.de/fosdem/2023/UA2.114%20(Baudoux)/container...
- davexunit 4y ago
  Flatpak offers convenience but it could never offer the security that the distros it is circumventing offer. Application bundling is just inherently insecure.
- ekianjo 4y ago
  > security Erm... > we also reduce the ability for users to scrutinise the source in the Flathub build system that was used to build their application I don't think so
- goodpoint 4y ago
  He's still wrong.
deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
voakbasda 4y ago
Interesting that this announcement comes concurrently with the news that Ubuntu now expects all official derivatives to drop Flatpak support [0]. Looking forward, can someone tell me how these two policies will play nice together? https://news.ycombinator.com/item?id=34912760 https://news.ycombinator.com/item?id=34912760
- gtirloni 4y ago
  Not very well. Canonical learned nothing from Unity's failure.
kibwen 4y ago
Can anyone comment on whether any of these new all-in-one distribution formats actually try to provide secure sandboxing that is designed to resist deliberate attacks from within, or is their sandboxing just docker-style best-effort sandboxing with a ton of holes that can't be relied upon for running untrusted executables securely?
- gtirloni 4y ago
  Which attacks exactly? The sandboxing features are documented: https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html
college_physics 4y ago
> Outside of the Linux desktop space, actors such as F-Droid provide a home for free and open source Android applications on mobile devices. Some convergence of desktop and mobile is plausible over the midterm so it might be worthwhile to think how that could be orchestrated
apatheticonion 4y ago
I'm very in favour of improving the state of application distribution on Linux. Targeting an abstraction like Flatpack seems like a no-brainer if there are no regressions in experience to the end user. I am not sure if this is the case, but in theory I love the idea that the app sandboxing can allow the Flatpak engine to be a source that can prompt users for permissions access (e.g. "app would like to access your location"). Last time I tried Flatpack I experienced a lot of integration issues, from GTK theming issues to applications missing features due to sandboxing. Would love to see a high level medium-dive explainer on how Flatpack works to alleviate some of my concerns; predominantly around the limitations of sandboxing. e.g. Can OBS have unimpeded screen recording access? How does OBS compare in Flatpak compared to natively installed. Can VSCode access any part of the FS without any performance overhead, what about language servers and that sort of thing? Can applications like Discord that feature a voice-activated mic work? Can Discord access what game you're currently playing on Steam and set that as its status? Originally, I thought Flatpack was much like old win32 applications where if you put a dll dependency next to the executable, it will use that rather than the system one. I got really scared of Linux app sandboxing engines when I tried Snapd and it started making virtual network devices and my system theme wasn't applied to the application - seemed very convoluted.
- creatonez 4y ago
  Flatpak used to have a lot of issues with sandboxing, but in recent years the situation has gotten better because of two things: 1. A strong push to help package maintainers fix sandboxing mistakes, expose the APIs that need to be exposed and lock down the APIs that are not needed. It used to be pretty bad but it's pretty rare to see sandboxing problems nowadays. 2. You can now use a tool called Flatseal, or in KDE a new builtin settings interface in Plasma 5.27, to modify sandboxing settings for applications in an intuitive way. If you're trying to use an IDE and just want to expose every permission to it, you can easily do that now. 3. Unrelated to Flatpak, Wayland is now getting a lot of the video capture and screen recording APIs that are needed.
- majewsky 4y ago
  > Can OBS have unimpeded screen recording access? How does OBS compare in Flatpak compared to natively installed. I'm livestreaming on a regular basis, and moved from OBS as compiled by Arch Linux to OBS Flatpak. Everything just works (esp. the browser source that uses an embedded Chromium, which I never got to work with the Arch packages). Most likely that particular Flatpak is very liberal in its sandboxing, because it was even able to write into $HOME/obs-recordings/ without any permission prompt. I don't care about the sandboxing part of Flatpak too much in this particular case, so I didn't dig further.
gtirloni 4y ago
Flatpaks are awesome. If you need to tweak them, Flatseal is a great tool. https://github.com/tchx84/Flatseal https://github.com/tchx84/Flatseal
gtirloni 4y ago
I've asked them about donations but they said it was not possible, a year or so again. I'd gladly donate or even keep a subscription to keep Flathub running.
SMAAART 4y ago
$100K? that's all. Do a kickstarter or a GoFund me and I will contribute too, and I am not a Linux user (yet).
fijiaarone 4y ago
I don’t think open source needs a walled garden, but I think people want the walls.
kytazo 4y ago
Well, the only part of flatpak I honestly like is bubblewrap, the only reason flatpak even makes any sense to me
mmphosis 4y ago
Linux Mint > Software Manager > Search for "Flatpak" > it's at the bottom of the list of results > Remove
fnord77 4y ago
> Our previous phase of implementing the Flathub appstore functionality was funded by a 50,000 USD grant from Dalio Philanthropies as in Ray Dalio?
jdlyga 4y ago
I wish gnu/linux devs would pool their efforts occasionally. We have competing flatpak and snap efforts, with neither being all that good currently. Can we agree on a standard?
- Vilian 4y ago
  Flatpak is the standard, the only distro/company that don't accept it is canonical/ubuntu, every other company and distro ships flatpak as standard(btw snap only work in ubuntu)
rookderby 4y ago
Flatpak has issues (size), but I think I can accept them as a part of the design and believe the other issues (crashes, security) will be solved as adoption grows. Personally, I still prefer my repos with shared libraries when possible. I'm also able to keep a mirror of the packages to cut down on bandwidth. I haven't figured out how to mirror the flatpaks yet, mostly due to lack of effort. I'm excited, it will be good to have a cross-distro app store.
tkuraku 4y ago
I think flatpaks are awesome. Especially for commercial software. I do think they are missing an important feature that snap has what snap referes to as classic confinement. For example vscode as a flatpak can't really interact with your normal system libraries/exectuables/etc. That being said I do hope that Flatpaks succeed and becomes the easy go-to option for commercial software to support linux distributions.
paletteOvO 4y ago
I would prefer AppImage or nix than Flatpak. It just seems to be yet another package manager but more difficult to use and much slower.
panick21_ 4y ago
I feel like one thing that is still holding Linux Desktop and any initiative like this back is that we don't have really high quality linux laptops on the market. We have some people like System76 doing great things, but not in Europe and for all their great work its not the highest quality stuff from China with some serious limitations. For all the things the European Union funds, from chip manufacture, HPC and many other project from large to medium to small. Why have we not seen a made in Europe Laptop/Desktop/Phone for the bureaucrats and engineers who do things like running states and building weapons and so on. A fair amount of EU money goes into a lot of these distributed system and internet projects. And I'm not complaining, but we are spending a lot of time trying to make our system secure from everything other then direct attack. The fireware in the new notebook doesn't seem better then in the one before, in fact worse in some way. We have most of the software, we have most of the things needed to do these things. An Open-Source computer for Europe (and anybody) would be a real counter-point to most of the other models out there. In such an environment a real AppStore for Open Linux desktop could actually be a really good thing.
- systems 4y ago
  Many things are holding Linux on the Desktop, but its more so that the competition is doing better and the Desktop market shifted First, Windows caught up, Linux used to have things that windows didnt in the late 90s and early 2000s, not most linux only app have windows ports, you can run any linux app on windows WSL , and now windows also have powershell Second, apple made a comeback, now many people who dont want windows use apple and get a unix experience if they wanted one Third, end users shifted to tablets and mobile phone The combination of all 3, leave little room for linux, no matter how good linux does , linux on the desktop only make sense for people who develop for linux on the server and want a similar environment on their laptop
  - alwayslikethis 4y ago
    Or for disgruntled slaveware users, who got pushed over the edge by the software companies ("Windows really trying to force you to use a micro$oft account these days", or "Apple rolling out their spyware to scan for photos on your phone and reporting to them despite saying not to"[1]). 1. https://sneak.berlin/20230115/macos-scans-your-local-files-now/ https://sneak.berlin/20230115/macos-scans-your-local-files-n...
phendrenad2 4y ago
If they can actually prevent piracy, maybe I'll actually package my app for Linux.
- yjftsjthsd-h 4y ago
  > If they can actually prevent piracy, maybe I'll actually package my app for Linux. ... Neither MacOS nor Windows do this; what are you targeting now?
  - phendrenad2 4y ago
    I mistyped. I should have said "provide a bare-minimum barrier to piracy".
yjftsjthsd-h 4y ago
> As we also open the ability for applications to be uploaded in binary form, which is essential for low-friction compatibility with popular language-specific build systems such as Electron/Node, Rust, Go, etc - we also reduce the ability for users to scrutinise the source in the Flathub build system that was used to build their application. ...and their solution is running an antivirus scanner rather than stepping back and realizing that they're shooting their own feet clean off. And it's based on an absurd premise! Seriously: > binary form, which is essential for low-friction compatibility with popular language-specific build systems What? No it's not! Worst case, build in a container with the official tools. Best case, package the build tools like every other distro and enforce source availability and build reproducibility. I mean, NixOS is a bunch of volunteers doing (a better version of) what you're claiming is impossible! (Granted, I assume the claimed reason is a lie and the real reason is to support proprietary software, which is... maybe reasonable, but pretending otherwise isn't.)
- sph 4y ago
  Is NixOS a cult? Every time someone posts about Linux packaging, there's a "you should just use NixOS" comment. Although it provides its own solution to the Linux packaging problem, it's a single solution that comes with a whole load of baggage with it. It is not the panacea its proponents wants us to believe it is.
  - teekert 4y ago
    I don't use NixOS, but from what I've read, you should just use NixOS. All kidding aside, I installed NixOS (it installs like any other distro, it's just that after that you are completely lost), but it's a real paradigm shift. I'm just hoping for Ubuntu Declarative Donkey at this point and hope someone addresses the learning curve and the specialist language and tools used. I'd hate to invest all this time and then all other distros finally respond and it was not really worth it after all. I mean it looks to me like one can just put a Yaml file at the heart of Ubuntu and make that work. At least as step 1. Why is there no response from the classic Linux vendors? There are atomic distro's yes (ie Fedora Silverblue), but no real NixOS-like product. I want my personal system to live in Git. Maybe I should just use NixOS.
nixpulvis 4y ago
I run Linux to avoid shopkeepers (or others in general). I run macOS when I need that help. I run Windows the rest of the time, which is currently not that often.
POPOSYS 4y ago
On a Linux system, how to secure a system so that users are not able to run binaries they downloaded from the internet? How can application whitelisting be achieved? Does Flathub come with any features that help with that?
devwastaken 4y ago
Flatpak and snap have proven to be ineffective and security theatre. Sandboxing all user apps doesn't work, often the applications are created to not be sandboxed, and the existing sandbox configs are improper. We don't need yet another store. What we need is a simple registry of applications that are installed with the scripts to uninstall. We already have this, it's a package manager. For soft that doesn't need a package manager, we have .appimage. Instead of making it more difficult to package apps for Linux, focus on having few methods that are robustly supported.
pabs3 4y ago
I wonder when the distros are going to start auto-converting their native package formats to Flatpak so you can use distro Flatpaks alongside Flathub ones.
coldblues 4y ago
Flatpak is a solution to package management as Docker is to servers. What's the predominant reason people use Docker? Because it's impossible to get a Python/NodeJS monstrosity working properly without it. On rolling release distributions, you don't ever need Flatpak. Its predominance is found in stable release distributions like Ubuntu and Fedora. Because they stall packages and their dependencies, it'll always be an issue to install new software. If anything, I prefer AppImage a lot more.
- Nasreddin_Hodja 4y ago
  > On rolling release distributions, you don't ever need Flatpak. What if I need older version of some software? Or what if I need multiple versions of the same software at once?
  - coldblues 4y ago
    I'd say that Nix has solved this problem way better than Flatpak.
    - AnIdiotOnTheNet 4y ago
      Call me when I don't have to learn a new language to use it effectively.
qwerty456127 4y ago
Why do we need this bullshit when we have apt, rpm, pacman and everything?
russianGuy83829 4y ago
while I like and use flatpaks, each time I try to use gnome software, I need to kill it and restart just too that it loads
iavaijreigje89h 4y ago
>As we also open the ability for applications to be uploaded in binary form, which is essential for low-friction compatibility with popular language-specific build systems such as Electron/Node, Rust, Go, etc - we also reduce the ability for users to scrutinise the source in the Flathub build system that was used to build their application. This is unacceptable. Open-source apps should always be built from source on a trusted infrastructure and ideally the builds should be reproducible. Otherwise, one of the main benefits of open-source software -- ability to verify its security -- is completely lost. Fortunately, Flatpak != Flathub. There is also Fedora's flatpak repository and that's what I'm using. It doesn't have as many apps as Flathub, but their number is growing. I prefer flatpaks to RPMs because of the sandboxing feature. While it's not perfect yet, I like that I can forbid most of my apps to access the network and to limit access to the filesystem and other system parts for apps that require network as much as possible. As a result, the trusted base of my system can be reduced significantly (and the base system can then use other method to confine its processes which on Fedora is SELinux). Another benefit of Flatpak over traditional packaging systems is that it's a cross-distro package manager and the apps can be installed on any Linux distribution. Even if we end up with multiple Flatpak repositories like Flathub and Fedora Flatpaks with different approaches and philosophies, users of any Linux-based OS can then install apps from any repository they like, and OS developers can focus on the base system. So in general I like Flatpak and I think it's a step in the right direction, but I can't say the same about Flathub. For me it's unacceptable to install anything from Flathub unless they fix their supply chain security flaws.

405 points by evasb 4y ago

This fills me with dread. I don't think the app stores we've seen have been good things for a number of reasons. I hope, if this succeeds, it turns out to be a good thing.

jacooper 4y ago
Unlike google play, apple's appstore and canonical's Snap, flatpak isn't limited to a single repo, apps from other repos will show up in the store ui just like any other app.
- JohnFen 4y ago
  Yes, I understand that. That is orthogonal to my opinion of app stores, though.
  - yathaid 4y ago
    Are the margins on this website too small to note down your objections? :)
    - JohnFen 4y ago
      App stores are gatekeepers, and while they certainly can make things more convenient, they also encourage habits that I think are harmful. Such as thinking that app stores are the only way to install applications. I think that it has been a bad thing that users are conditioned to think that if it didn't come from an app store, it's dangerous or wrong somehow. It forces developers to use the app stores. I understand that many may not see this as a problem, but many developers (including myself) would very much prefer not to have to do that. So it's a disincentive to make software for others, at least for some. In the case of this one, I also am very nervous about the incorporation of a payment system. I fear that will discourage the creation of quality free software, and I think quality free software is a huge benefit. In short, I fear that this app store will resemble the Android Play store, or Apple's app store, and encourage the same problems and adverse impacts they have had.

ekianjo 4y ago

> we also reduce the ability for users to scrutinise the source in the Flathub build system that was used to build their application Wow.

sys42590 4y ago

Flathub could become the killer "app" for the Linux desktop. No need to juggle dependencies and third party repos. The software you need in an instant.

heywhatupboys 4y ago
>relevant xkcd comic on standards inserted here
- tombert 4y ago
  I agree that it is "yet another standard", but I gotta say that Flatpak is pretty sweet, and does actually do a good job of making "one package manager to rule them all". I think part of the problem with a lot of "selling stuff on Linux" has been mucking around with different dependencies for the thousand different versions of Linux. Historically, this has led to a couple solutions: either a) Just officially support one distro (usually Ubuntu), or b) just don't release a Linux version. Flatpak has actually succeeded in making a system that kind of works everywhere, and I think it actually has a shot of being an equivalent to the Mac App Store.
  - input_sh 4y ago
    > and I think it actually has a shot of being an equivalent to the Mac App Store. This I agree with, but not this: > and does actually do a good job of making "one package manager to rule them all". That's not its goal. There are no terminal apps in it, so everyone that wants to run custom packages from a terminal is still going to need something like apt/dnf/homebrew.
    - tombert 4y ago
      Maybe I'm speaking a bit too broadly; at least in regards to GUI apps, it's been a pretty nice "unifying force" for me when I ran Linux (which has admittedly hasn't been a few years now).
    - zitsarethecure 4y ago

xen2xen1 4y ago

$100,000 to build up a system that totally ignores the system package manager? Sounds great!

Gigachad 4y ago
Good. The “system package manager” is good for updating the OS, it’s not good for packaging desktop applications, especially proprietary ones. If you use the gnome Software app, it merges flatpak, dnf, and the firmware updater in one “updates” page with a single button to update it all.
- c-hendricks 4y ago
  I don't even know what I get out of the system package manager these days. Apps are mostly flatpak / appimages, dev tools I'm using Homebrew. I guess it's mostly the kernel and my DE these days.
  - Gigachad 4y ago
    Traditional package managers like dnf and apt are probably not even the best way to update the kernel and OS these days. Immutable images like what’s used in Fedora Silverblue (as well as android and iOS) are much more reliable and probably the way distros will move
- crispinb 4y ago
  That very incoherence is probably why it rarely works.
  - Gigachad 4y ago
    I completely know what you are talking about, I’m used to the Software app virtually never working, although I came back a few months ago and it all seemed to be working perfectly fine. So perhaps there have been some major improvements in this space. At any rate, the problem is not unsolvable, it was mostly just bad UX where underlying errors were not surfaced and the app would get stuck in an endless loading spinner.

winrid 4y ago

how much to add thumbnails to the file picker?

eptcyka 4y ago
GTK4 is getting them.
- awill 4y ago
  It's not GTK4, it's nautilus
  - PlutoIsAPlanet 4y ago
    The recent GTK4 release added them to the file picker. Apparently changes in GTK4 made it easier to add
gp 4y ago
Looks like there has been some progress on this front - https://gitlab.gnome.org/GNOME/gtk/-/commit/b0f65ead84c1ecd5f40683503ca972c6e1a95b3c https://gitlab.gnome.org/GNOME/gtk/-/commit/b0f65ead84c1ecd5...
- winrid 4y ago
  Amazing! Thanks feaneron!
- mouse_ 4y ago
  free desktop "making progress" on something Windows XP had no problems with from the get go is frankly embarrassing and probably a sign of, at best, destructively entitled maintainers, and at worst, controlled opposition.
  - winrid 4y ago
    I think it's just bad design and tech debt, and maybe leadership having trouble getting someone to take the risk to make the change. Looks like it's getting fixed, though.

mastazi 4y ago

I'm an Ubuntu user and the first thing I always do in a new system is removing the Ubuntu Store, completely removing snapd, and installing the Flathub Store.

mesebrec 4y ago
Honest question; why do you still use Ubuntu then? By now, Snap is such a fundamental part of Ubuntu that it begs the question whether Ubuntu is right for you if you want to avoid it. Why not use a derivative or upstream that makes different choices?
- Shared404 4y ago
  I also have an Ubuntu desktop which I've ripped snap out of. In my case, it's because my options are pretty much Ubuntu or Windows for this machine, and there's no contest there.
- awill 4y ago
  agreed. Ubuntu are trying to hard to differentiate themselves, and it usually just hurts them. I'm guessing they'll drop snap in the future and blame the industry (like they did with systemd and wayland)
- cld8483 4y ago
  Ubuntu is an African word which means "Afraid of Debian" Seriously though, just install Debian. It's not hard, the netinstaller may be text-mode but it walks you through the simple steps one by one just like Ubuntu's GUI installer. Anybody who's comfortable using Ubuntu in the first place should be able to get through the Debian installer just fine.
  - wrycoder 4y ago
    Even better, install Devuan, which is Debian without systemd (the attempt to turn Linux into Windows). Many former Debian developers are now working on Devuan.

fooker 4y ago

Maybe Valve could fund them? Anyone have the connections to make this happen?

PlutoIsAPlanet 4y ago
I believe Valve already makes contributions to Flatpak and its backend container stack, bubble wrap. Valve actually uses bubble wrap on the Steam deck for proton.

wetpaws 4y ago

Why the hell do you need store when you have pacman/AUR

Grimburger 4y ago
How do I sell my software on pacman?
- Gigachad 4y ago
  I’m not sure people will ever want to sell apps on a 3rd party store. Especially a Linux one. The entire industry has moved away from buying things directly on a single marketplace and moved to tying a payment or subscription to an account which works across OSs and store platforms. I’d be happy to pay for Linux software but there is no way I’d want to be tied to a particular distro/repo/storefront.
  - Grimburger 4y ago
    That's fair but some companies do want to sell their software and it's not particularly easy on Linux platforms. There's basically Steam or DIY.
    - worksonmine 4y ago
      Windows has existed for most of lifetime without a store or even central package management but it was still the biggest platform for commercial software. And recently the App and Play stores seem to cause more trouble to many companies than it's worth. If they used the royalties to hire people to audit the packages I might even consider paying for free software, but I'm afraid it will turn into walled gardens where small developers have no say and the big ones just deal with the problems because it's the only option. I hope it turns out to be better with KDE and Gnome that come from a FOSS background but money makes people greedy.
skeaker 4y ago
User adoption, I guess

Slighted 4y ago

Uh no, I wouldn't even hand over a penny to the GNOME project.

freedomben 4y ago

I haven't been the biggest fan of flatpak and generally wish software would either be packaged as an rpm or an AppImage, but the OP makes a pretty strong case for why it's a good idea (because existing options are too niche, and have no ability to incentivize developers who need to get paid for their work. This leads to Linux desktop having far fewer applications available to them compared to windows and mac.) I do hope the command-line UX around flatpaks (installing, updating, etc) improves a lot though as currently it leaves much to be desired.

ekianjo 4y ago
> This leads to Linux desktop having far fewer applications available to them compared to windows and mac.) There's far fewer applications because there's a very tiny market share compared to these two OSes. Not because of the lack of payment systems.
- yjftsjthsd-h 4y ago
  I mean, it's probably both.
  - freedomben 4y ago
    Yes definitely, it's probably both. Both are in a feedback cycle as well. Less people means less attention. Less attention means less people. It's a hard cycle to break.
panick21_ 4y ago
AppImage has issues. The guy from Suse who does MicroOS, Richard Brown, a few years ago was literally walking around giving talk about how bad Flatpak was and how everybody should use AppImage. In his most recent talk he basically said, he was wrong, the Flatpak people did address most of the issue he had and AppImage was no viable. https://fosdem.org/2023/schedule/event/containerised_apps/ https://fosdem.org/2023/schedule/event/containerised_apps/
- 4y ago

snshn 4y ago

[flagged]

throw_m239339 4y ago

I had to use flatpack to install Bottles, I'm on Porteus because it's the only distrib I found that would fit on a 15 year old 512MB USB stick and then in the RAM directly... Let just say it wasn't a seamless experience but I'm glad I managed to run Cinema4D R20 or MPC Software with Bottles without too many bugs. Anyway Bottles is just fantastic, I tried Wine before but it never worked properly, but having to install a package manager (flatpack) on top of another one (slackpkg) just felt absurd... What about appimage instead, like Krita? To me it's sounds like the best way to distribute a linux app in 202X... Managing to make things run on Linux gives a sense of accomplissement, at the same time, I can understand why most people won't move to Linux anytime soon given all the complexity involved... or it's just me and there was an easier way to install flatpack at first place?

cld8483 4y ago
AppImage is great, definitely the best of the bunch.
- PlutoIsAPlanet 4y ago
  Said no one relevant AppImage solves the packaging problem in a bad way (ugh, loopback mounts), but does not solve the dependency problem, try run AppImages compiled for Ubuntu on Fedora..
  - cld8483 4y ago
    > Said no one relevant [Retort insult.]
  - Gigachad 4y ago
    The main use case for appimage imo is things you just want to run once quickly and easily. Trying beta builds from github releases for example. It's quite poor for anything you frequently use or want to keep updated. It's also completely lacking security iirc which Flatpak does well.
- badsectoracula 4y ago

Liquix 4y ago

Opinions on Flatpaks/snaps notwithstanding, it's encouraging to see KDE and GNOME collaborating on projects like this. IMO desktop GNU/Linux has benefited greatly from moving away from offering LXDE/LXQT/Mate/Enlightenment/Cinammon flavors and towards a more digestible subset (GNOME only, GNOME/KDE/XFCE, etc) of polished desktop environments. Pipe dream, but it would be incredible to see all of the passionate, talented folks working together on one definitive GNU/Linux DE.

themodelplumber 4y ago
I'd prefer to see more easily-communicated DE standards and published levels of adherence, rather than moving to the uni-desktop. Like if you want to select a desktop and are kind of new to desktop environments, maybe aim for the (imaginary example here) DE-5 level of standards-adherence. DE-4 and lower might suck in various ways even though they could have cool new features. There are way too many benefits from the huge variety of DE approaches, including the benefit that Linux-critics often hide behind critique of a single desktop experience, which is lazy and attempts to steal focus from exactly this open, creative, diverse approach that is the jewel in the Linux ecosystem's metaphorical crown. It's definitely great to see the groups working together on these projects that benefit everybody.
- reilly3000 4y ago
  I really think you are into something here. Some simple rating and standard icon would help users differentiate quickly. I know and love distrowatch and the rest, but it’s definitely inaccessible for most beginners and hard to discover what the best fit is for me.
- derefr 4y ago
  > I'd prefer to see more easily-communicated DE standards and published levels of adherence, rather than moving to the uni-desktop. What's the difference? If everything works perfectly with everything else, and the standards adherence is so high that you can't tell the difference which apps are from which organization, then how is that not a "unified DE"?

jdoss 4y ago

I used to think Flatpaks were a huge pain the butt, but over the last few years, I moved to using them for all third party software that I run on my Fedora Linux workstation. Zoom, Slack, Spotify, Steam, Discord, Obsidian all run without issues and they get consistent updates. I am convinced now that they are one of the best ways to ship commercial software on to Linux desktop. Flatpak has been a key part of me becoming 100% Windows free for my PC gaming. Not having to run a desktop KVM to switch between my work workstation and my Gaming PC has been super great.

silisili 4y ago
I really like the idea. I think the only issue I ever had with them was the inability to inject files inside. Do you know if that's possible? I was trying to use a browser, I think Vivaldi, that had instructions for enabling widevine by copying a file to a certain directory, but I couldn't find a clean way to do so.
- FeistySkink 4y ago
  If it's just a config file and the package is installed under a user, check .var/lib/flatpak/app
jchw 4y ago
One big tricky thing is plugins, such as for OBS. ABI incompatibility and sandboxing can make it tricky and confusing for end users. Flatpak itself could theoretically provide answers here.
- sirsinsalot 4y ago
  I feel like you'd end up going full circle back to apt and npm and ...
- viraptor 4y ago
  They'll have to do it at some point. There's just too many apps with plugins to ignore it. (Including basically all of audio production with their VSTs)

Darmody 4y ago

Meanwhile Ubuntu is making sure that none of its flavours has flatpak installed by default. Smells like that old MS attitude to me.

sprash 4y ago
Flatpak is essentially RedHat/IBM tech. Why should Canonical even think about supporting their competitors. Just because multi billion corps like RedHat/IBM have the audacity to ask for donations to develop their products doesn't mean Flatpaks are in any way neutral territory.
- phendrenad2 4y ago
  Ah, refreshingly cynical. RedHat and Canonical would rather protect their smol kingdoms than expand the greater Linux ecosystem.
- the_why_of_y 4y ago
  Flatpak is supported by Endless [1], SUSE [2], Codethink [3], Collabora [4], Igalia [5] ... none of these businesses have an issue with "supporting their competitors" because that's an inherent part of doing open source as a business. [1] https://support.endlessos.org/en/apps/flatpak https://support.endlessos.org/en/apps/flatpak [2] https://fosdem.org/2023/schedule/event/containerised_apps/ https://fosdem.org/2023/schedule/event/containerised_apps/ [3] https://www.codethink.co.uk/articles/2022/flathub-codethink-collaboration/ https://www.codethink.co.uk/articles/2022/flathub-codethink-... [4] https://www.collabora.com/news-and-blog/blog/2017/08/17/debconf-17-flatpak-and-debian/ https://www.collabora.com/news-and-blog/blog/2017/08/17/debc... [5] https://github.com/Igalia/webkit-flatpak-sdk https://github.com/Igalia/webkit-flatpak-sdk
phatfish 4y ago
Ubuntu is Microsoft's "favorite" distro, they do seem rather made for each other. The Azure dev tools on Linux i have tried are all Snap only, or a tar file and maybe an rpm/deb. At the moment they seem to avoid Flatpak like the plague.

dimaor 4y ago

I'm not sure if PopOs uses flathub by default for its PopShop, but I've always had some issues with it and they prevented me from using it and directly using flatpak CLI. - I don't know how to see running logs by default (if it's possible even) and it's a must when you have slow internet - sometimes it just hangs and I need to kill (probably leaving residue along the way) hopefully my issues are my own OR it will get resolved as well. other than that flatpak is amazing.

Octabrain 4y ago

I like Flatpak. I've even flatpaked some apps and made them available on Flathub. The only thing that dissapoints me is the fact that it integrates poorly with CLI apps. Off topic: An idea that came to my mind a few days ago is that would have been great to add support for desktop apps to Podman by adding some extension or plugin capabilities to it instead of creating a new whole technology. Probably a silly idea though.

zozbot234 4y ago
You can run generic sandboxes using Bubblewrap (bwrap) which is the underlying infrastructure for Flatpak. It's much lower level than Podman or Docker though, and closer to the basic reality of containerization as a usage pattern for Linux namespaces. You don't get compatibility with OCI specifications, so it's not the kind of containers that most people might be used to.

znpy 4y ago

love to see flatpak flourishing, it's really great. i like it because it actually solves problem (getting proprietary software like slack) instead of creating ones and/or getting in the way (i'm looking at you snap).

Gigachad 4y ago
Sad to see so many people treat package management like a gatekeeper. "Oh, you don't have an employee dedicated to maintaining 20 versions of packages for every single distro and release of distro? Well we don't want you on linux" Flatpak enables people to publish a single package that just works on all distos and doesn't break every 6 months. It's removing the maintenance gatekeeping. I think it will be interesting to see if tech like WASM results in packages which work across CPU architectures as well as Linux on ARM is very painful currently, let alone more obscure ones like RISC-V.

synergy20 4y ago

maybe it's indeed time to let the system package management(apt,rpm,etc) just manage a solid BASE system, and let Flatpak etc to manage their own application sandboxes on top, kind of like dockers. Appimage is macos flavor, it never needs your sudo to install the package, which is nice. Flatpak is a redhat flavor(kind of), it needs sudo sometimes, but OK. Snap is a ubuntu flavor(kind of), it is like systemd that can overtake the whole system, it can install package and even the whole system I was told, too much as a package manager for me. I don't use Snap. Appimage is not as widely adopted as the rest two? I think Flatpak is a great middle ground. It will be really cool if KDE and Gnome work together to build this.

johnny22 4y ago
> maybe it's indeed time to let the system package management(apt,rpm,etc) just manage a solid BASE system, and let Flatpak etc to manage their own application sandboxes on top, kind of like dockers. This is kind of how immutable systems like fedora's silverblue, and suse's microos are setup. The base systems are still built with rpm, but for user packages you either use flatpak or stuff in containers via toolbox or distrobox. It's still possible to layer stuff on to the base image if necessary though.
twblalock 4y ago
It's been time for that for a while now. Sandboxing and distro-agnostic packaging are definitely the way to go. They have some pain points but it's better to fix those than to go back to the older way of doing things.
notepalf 4y ago
> it's indeed time to let the system package management(apt,rpm,etc) just manage a solid BASE system It totally is! Why does a distro maintainer need to pack every known application into the OS and make sure it works? This kind of work does not scale.
gjadi 4y ago
Like *BSD, with base + ports.

canadaduane 4y ago

Richard Brown, who's been working on this problem for 10 years at Suse, says he was wrong in 2017. Flatpak is now the clear way to go, if you care about security, app updates, licensing, and multi-distro support (runtime dependencies). https://ftp.fau.de/fosdem/2023/UA2.114%20(Baudoux)/containerised_apps.mp4 https://ftp.fau.de/fosdem/2023/UA2.114%20(Baudoux)/container...

davexunit 4y ago
Flatpak offers convenience but it could never offer the security that the distros it is circumventing offer. Application bundling is just inherently insecure.
ekianjo 4y ago
> security Erm... > we also reduce the ability for users to scrutinise the source in the Flathub build system that was used to build their application I don't think so
goodpoint 4y ago
He's still wrong.

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

voakbasda 4y ago

Interesting that this announcement comes concurrently with the news that Ubuntu now expects all official derivatives to drop Flatpak support [0]. Looking forward, can someone tell me how these two policies will play nice together? https://news.ycombinator.com/item?id=34912760 https://news.ycombinator.com/item?id=34912760

gtirloni 4y ago
Not very well. Canonical learned nothing from Unity's failure.

kibwen 4y ago

Can anyone comment on whether any of these new all-in-one distribution formats actually try to provide secure sandboxing that is designed to resist deliberate attacks from within, or is their sandboxing just docker-style best-effort sandboxing with a ton of holes that can't be relied upon for running untrusted executables securely?

gtirloni 4y ago
Which attacks exactly? The sandboxing features are documented: https://docs.flatpak.org/en/latest/sandbox-permissions.html https://docs.flatpak.org/en/latest/sandbox-permissions.html

college_physics 4y ago

> Outside of the Linux desktop space, actors such as F-Droid provide a home for free and open source Android applications on mobile devices. Some convergence of desktop and mobile is plausible over the midterm so it might be worthwhile to think how that could be orchestrated

apatheticonion 4y ago

I'm very in favour of improving the state of application distribution on Linux. Targeting an abstraction like Flatpack seems like a no-brainer if there are no regressions in experience to the end user. I am not sure if this is the case, but in theory I love the idea that the app sandboxing can allow the Flatpak engine to be a source that can prompt users for permissions access (e.g. "app would like to access your location"). Last time I tried Flatpack I experienced a lot of integration issues, from GTK theming issues to applications missing features due to sandboxing. Would love to see a high level medium-dive explainer on how Flatpack works to alleviate some of my concerns; predominantly around the limitations of sandboxing. e.g. Can OBS have unimpeded screen recording access? How does OBS compare in Flatpak compared to natively installed. Can VSCode access any part of the FS without any performance overhead, what about language servers and that sort of thing? Can applications like Discord that feature a voice-activated mic work? Can Discord access what game you're currently playing on Steam and set that as its status? Originally, I thought Flatpack was much like old win32 applications where if you put a dll dependency next to the executable, it will use that rather than the system one. I got really scared of Linux app sandboxing engines when I tried Snapd and it started making virtual network devices and my system theme wasn't applied to the application - seemed very convoluted.

creatonez 4y ago
Flatpak used to have a lot of issues with sandboxing, but in recent years the situation has gotten better because of two things: 1. A strong push to help package maintainers fix sandboxing mistakes, expose the APIs that need to be exposed and lock down the APIs that are not needed. It used to be pretty bad but it's pretty rare to see sandboxing problems nowadays. 2. You can now use a tool called Flatseal, or in KDE a new builtin settings interface in Plasma 5.27, to modify sandboxing settings for applications in an intuitive way. If you're trying to use an IDE and just want to expose every permission to it, you can easily do that now. 3. Unrelated to Flatpak, Wayland is now getting a lot of the video capture and screen recording APIs that are needed.
majewsky 4y ago
> Can OBS have unimpeded screen recording access? How does OBS compare in Flatpak compared to natively installed. I'm livestreaming on a regular basis, and moved from OBS as compiled by Arch Linux to OBS Flatpak. Everything just works (esp. the browser source that uses an embedded Chromium, which I never got to work with the Arch packages). Most likely that particular Flatpak is very liberal in its sandboxing, because it was even able to write into $HOME/obs-recordings/ without any permission prompt. I don't care about the sandboxing part of Flatpak too much in this particular case, so I didn't dig further.

gtirloni 4y ago

Flatpaks are awesome. If you need to tweak them, Flatseal is a great tool. https://github.com/tchx84/Flatseal https://github.com/tchx84/Flatseal

gtirloni 4y ago

I've asked them about donations but they said it was not possible, a year or so again. I'd gladly donate or even keep a subscription to keep Flathub running.

SMAAART 4y ago

$100K? that's all. Do a kickstarter or a GoFund me and I will contribute too, and I am not a Linux user (yet).

fijiaarone 4y ago

I don’t think open source needs a walled garden, but I think people want the walls.

kytazo 4y ago

Well, the only part of flatpak I honestly like is bubblewrap, the only reason flatpak even makes any sense to me

mmphosis 4y ago

Linux Mint > Software Manager > Search for "Flatpak" > it's at the bottom of the list of results > Remove

fnord77 4y ago

> Our previous phase of implementing the Flathub appstore functionality was funded by a 50,000 USD grant from Dalio Philanthropies as in Ray Dalio?

jdlyga 4y ago

I wish gnu/linux devs would pool their efforts occasionally. We have competing flatpak and snap efforts, with neither being all that good currently. Can we agree on a standard?

Vilian 4y ago
Flatpak is the standard, the only distro/company that don't accept it is canonical/ubuntu, every other company and distro ships flatpak as standard(btw snap only work in ubuntu)

rookderby 4y ago

Flatpak has issues (size), but I think I can accept them as a part of the design and believe the other issues (crashes, security) will be solved as adoption grows. Personally, I still prefer my repos with shared libraries when possible. I'm also able to keep a mirror of the packages to cut down on bandwidth. I haven't figured out how to mirror the flatpaks yet, mostly due to lack of effort. I'm excited, it will be good to have a cross-distro app store.

tkuraku 4y ago

I think flatpaks are awesome. Especially for commercial software. I do think they are missing an important feature that snap has what snap referes to as classic confinement. For example vscode as a flatpak can't really interact with your normal system libraries/exectuables/etc. That being said I do hope that Flatpaks succeed and becomes the easy go-to option for commercial software to support linux distributions.

paletteOvO 4y ago

I would prefer AppImage or nix than Flatpak. It just seems to be yet another package manager but more difficult to use and much slower.

panick21_ 4y ago

I feel like one thing that is still holding Linux Desktop and any initiative like this back is that we don't have really high quality linux laptops on the market. We have some people like System76 doing great things, but not in Europe and for all their great work its not the highest quality stuff from China with some serious limitations. For all the things the European Union funds, from chip manufacture, HPC and many other project from large to medium to small. Why have we not seen a made in Europe Laptop/Desktop/Phone for the bureaucrats and engineers who do things like running states and building weapons and so on. A fair amount of EU money goes into a lot of these distributed system and internet projects. And I'm not complaining, but we are spending a lot of time trying to make our system secure from everything other then direct attack. The fireware in the new notebook doesn't seem better then in the one before, in fact worse in some way. We have most of the software, we have most of the things needed to do these things. An Open-Source computer for Europe (and anybody) would be a real counter-point to most of the other models out there. In such an environment a real AppStore for Open Linux desktop could actually be a really good thing.

systems 4y ago
Many things are holding Linux on the Desktop, but its more so that the competition is doing better and the Desktop market shifted First, Windows caught up, Linux used to have things that windows didnt in the late 90s and early 2000s, not most linux only app have windows ports, you can run any linux app on windows WSL , and now windows also have powershell Second, apple made a comeback, now many people who dont want windows use apple and get a unix experience if they wanted one Third, end users shifted to tablets and mobile phone The combination of all 3, leave little room for linux, no matter how good linux does , linux on the desktop only make sense for people who develop for linux on the server and want a similar environment on their laptop
- alwayslikethis 4y ago
  Or for disgruntled slaveware users, who got pushed over the edge by the software companies ("Windows really trying to force you to use a micro$oft account these days", or "Apple rolling out their spyware to scan for photos on your phone and reporting to them despite saying not to"[1]). 1. https://sneak.berlin/20230115/macos-scans-your-local-files-now/ https://sneak.berlin/20230115/macos-scans-your-local-files-n...

phendrenad2 4y ago

If they can actually prevent piracy, maybe I'll actually package my app for Linux.

yjftsjthsd-h 4y ago
> If they can actually prevent piracy, maybe I'll actually package my app for Linux. ... Neither MacOS nor Windows do this; what are you targeting now?
- phendrenad2 4y ago
  I mistyped. I should have said "provide a bare-minimum barrier to piracy".

yjftsjthsd-h 4y ago

sph 4y ago
Is NixOS a cult? Every time someone posts about Linux packaging, there's a "you should just use NixOS" comment. Although it provides its own solution to the Linux packaging problem, it's a single solution that comes with a whole load of baggage with it. It is not the panacea its proponents wants us to believe it is.
- teekert 4y ago
  I don't use NixOS, but from what I've read, you should just use NixOS. All kidding aside, I installed NixOS (it installs like any other distro, it's just that after that you are completely lost), but it's a real paradigm shift. I'm just hoping for Ubuntu Declarative Donkey at this point and hope someone addresses the learning curve and the specialist language and tools used. I'd hate to invest all this time and then all other distros finally respond and it was not really worth it after all. I mean it looks to me like one can just put a Yaml file at the heart of Ubuntu and make that work. At least as step 1. Why is there no response from the classic Linux vendors? There are atomic distro's yes (ie Fedora Silverblue), but no real NixOS-like product. I want my personal system to live in Git. Maybe I should just use NixOS.

nixpulvis 4y ago

I run Linux to avoid shopkeepers (or others in general). I run macOS when I need that help. I run Windows the rest of the time, which is currently not that often.

POPOSYS 4y ago

On a Linux system, how to secure a system so that users are not able to run binaries they downloaded from the internet? How can application whitelisting be achieved? Does Flathub come with any features that help with that?

devwastaken 4y ago

Flatpak and snap have proven to be ineffective and security theatre. Sandboxing all user apps doesn't work, often the applications are created to not be sandboxed, and the existing sandbox configs are improper. We don't need yet another store. What we need is a simple registry of applications that are installed with the scripts to uninstall. We already have this, it's a package manager. For soft that doesn't need a package manager, we have .appimage. Instead of making it more difficult to package apps for Linux, focus on having few methods that are robustly supported.

pabs3 4y ago

I wonder when the distros are going to start auto-converting their native package formats to Flatpak so you can use distro Flatpaks alongside Flathub ones.

coldblues 4y ago

Flatpak is a solution to package management as Docker is to servers. What's the predominant reason people use Docker? Because it's impossible to get a Python/NodeJS monstrosity working properly without it. On rolling release distributions, you don't ever need Flatpak. Its predominance is found in stable release distributions like Ubuntu and Fedora. Because they stall packages and their dependencies, it'll always be an issue to install new software. If anything, I prefer AppImage a lot more.

Nasreddin_Hodja 4y ago
> On rolling release distributions, you don't ever need Flatpak. What if I need older version of some software? Or what if I need multiple versions of the same software at once?
- coldblues 4y ago
  I'd say that Nix has solved this problem way better than Flatpak.
  - AnIdiotOnTheNet 4y ago
    Call me when I don't have to learn a new language to use it effectively.

qwerty456127 4y ago

Why do we need this bullshit when we have apt, rpm, pacman and everything?

russianGuy83829 4y ago

while I like and use flatpaks, each time I try to use gnome software, I need to kill it and restart just too that it loads

iavaijreigje89h 4y ago

>As we also open the ability for applications to be uploaded in binary form, which is essential for low-friction compatibility with popular language-specific build systems such as Electron/Node, Rust, Go, etc - we also reduce the ability for users to scrutinise the source in the Flathub build system that was used to build their application. This is unacceptable. Open-source apps should always be built from source on a trusted infrastructure and ideally the builds should be reproducible. Otherwise, one of the main benefits of open-source software -- ability to verify its security -- is completely lost. Fortunately, Flatpak != Flathub. There is also Fedora's flatpak repository and that's what I'm using. It doesn't have as many apps as Flathub, but their number is growing. I prefer flatpaks to RPMs because of the sandboxing feature. While it's not perfect yet, I like that I can forbid most of my apps to access the network and to limit access to the filesystem and other system parts for apps that require network as much as possible. As a result, the trusted base of my system can be reduced significantly (and the base system can then use other method to confine its processes which on Fedora is SELinux). Another benefit of Flatpak over traditional packaging systems is that it's a cross-distro package manager and the apps can be installed on any Linux distribution. Even if we end up with multiple Flatpak repositories like Flathub and Fedora Flatpaks with different approaches and philosophies, users of any Linux-based OS can then install apps from any repository they like, and OS developers can focus on the base system. So in general I like Flatpak and I think it's a step in the right direction, but I can't say the same about Flathub. For me it's unacceptable to install anything from Flathub unless they fix their supply chain security flaws.