• thingsiplay@beehaw.org
    link
    fedilink
    arrow-up
    0
    ·
    7 months ago

    I read that page and there is nonsense included too. Just because I read that page does not make it correct. If you think that AppImages insecure, then you did not understand my point that its not the format thats insecure, but the source where you get the files. Every packaging system is insecure if you get it from bad source.

    That’s not even a question. AppImages are fine and not insecure if you download it from a secure place you trust (like your system packages, you trust your distro maintainer fully). Would you trust every distribution maintainer on every distribution? Let’s say a Chinese Linux distribution, that maintains Flatpaks and native packages. Let’s say they are flaky. See? It’s the source you don’t trust, not the file format or packaging system.

    Read my replies (just like you said I should read the linked post). And understand the issues.

    • Pantherina@feddit.de
      link
      fedilink
      arrow-up
      0
      ·
      edit-2
      7 months ago

      Shit missing internet got my comment deleted…

      Appimage is not a neutral packaging format. Of course “an app packaged as .zip is as secure as packages as .tar.gz”. But the format causes all the things mentioned in the post.

      • libraries are often the oldest non-EOL possible to support old kernels
      • no transparency about used libraries and possible vulnerabilities
      • no upgrades of libraries, always just the wanted app and then passively also the libraries
      • no sandboxing without firejail (which is a root binary and thus can lead to privilege escalation of rootless processes if it has a vulnerability which it had in the past)
      • no GUI sandboxing
      • even with a repo no cryptographic signature verification like on Android (not sure about Flatpak which uses OSTree)
      • requires users to execute code in random locations

      So it is way less secure than Flatpak, thats a fact. It may not be worse than tarballs, but if those dont include the libraries even less secure than them.