@Bitrot @linux interesting, thank you for that information: I had been under the impression they did do manual verification of authors.

I did some checking: the closest I found to verification was this (so you’re right- no need to be the original author, but a bit of vetting does seem involved).

https://forum.snapcraft.io/t/manual-review-of-all-new-snap-name-registrations/39440

My takeaway here is to use whatever the authors recommend (assuming trusted authors)!

@pastermil @linux the attack surface for something that isn’t officially maintained by the developers, and that doesn’t have more vetting (e.g. distribution packages) opens up room for malicious actors.

e.g. #arch / #aur recommends verifying scripts manually before installing, and malicious scripts have been found and removed.

There are actors like #jiatan out there. An unofficial #flatpak needs manual verification before install - that’s why I just go with #snap if the flatpak isn’t official

@pastermil @linux I use both. There are packages where the website officially lists snap packages, no flatpaks.

Unless the project website has a link/install instruction recommending flatpak, I prefer either the distribution package where available, or snap otherwise - this is more from a supply-chain perspective - since snap requires the original developers of the package to package snaps.

If the developers have officially listed flatpak on their site, that however, is good enough for me.