this post was submitted on 22 Jun 2024
319 points (96.8% liked)

Linux

48344 readers
533 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

Imagine your friend that does not know anything about linux, don't you think this would make them not install the firefox flatpak and potentially think that linux is unsafe?

I ask this because I believe we must be careful and make small changes to welcome new users in the future, we have to make them as much comfortable as possible when experimenting with a new O.S

I believe this warning could have a less alarming design, saying something like "This app can use elevated permissions. What does this mean?" with the "What does this mean?" text as a clickable URL that shows the user that this may cause security risks. I mean, is kind of a contradiction to have "verified" on the app and a red warning saying "Potentially unsafe", the user will think "well, should I trust this or not??"

top 50 comments
sorted by: hot top controversial new old
[–] savvywolf@pawb.social 149 points 5 months ago (3 children)

I like flatpaks and flathub, but this is just something they do badly. I think as well they also have "probably safe" which is just as unhelpful... And what does "access certain files and folders" even mean!?

I think they should just follow the example of every other app store; list the permissions in an easily understandable list and let the user decide whether or not they are comfortable with it.

[–] federino@programming.dev 51 points 5 months ago

I think they should just follow the example of every other app store; list the permissions in an easily understandable list and let the user decide whether or not they are comfortable with it.

Totally agree. The "verified" label will give new users enough comfort, and the ones who wish to know more will read the permissions.

[–] Onihikage@beehaw.org 17 points 5 months ago

When I look at Firefox in Discover, it only shows the list of permissions the flatpak will be given out of the box, with no warning of it being "potentially unsafe." This certainly does seem like the better way to handle it.

Also, the warning on the Flathub website is clickable - it expands into the full permissions list. Why it defaults to "no information except maybe dangerous" is beyond me.

[–] Bitrot@lemmy.sdf.org 5 points 5 months ago

That is a clickable menu that explains exactly what the permissions are.

[–] JubilantJaguar@lemmy.world 41 points 5 months ago (2 children)

Completely agree. Training normies to click OK on warnings like this is a no-good terrible idea.

[–] IronKrill@lemmy.ca 6 points 5 months ago (1 children)

Training users to click on this shit is the same reason people wipe their desktop by ignoring "Yes I know what I am doing" warnings.

[–] refalo@programming.dev 3 points 5 months ago

someone is not a fan of LTT

load more comments (1 replies)
[–] brochard@lemmy.world 40 points 5 months ago* (last edited 5 months ago) (1 children)

In my opinion, those warnings are not used to help users but to shame developpers for not trully sandboxing and verifying their apps. Developpers know that having this warning will decrease the number of users downloading it. The goal in the long run is to improve app sandboxing and security.

[–] MonkderDritte@feddit.de 15 points 5 months ago* (last edited 5 months ago) (1 children)

By not letting the user import/export addon settings, bookmarks?

Btw, i hate the opinion that the dev must babysit his users. It makes software worse, not better, look at Firefox's profille folder for an example. If you have to, make an intro to train them.

[–] Sethayy@sh.itjust.works 12 points 5 months ago (2 children)

I'm not 100% confident but I thought you could use portals to access individual files outside of the sandbox

[–] UserMeNever@feddit.nl 8 points 5 months ago (3 children)

You could but where is fails is when you open one html file that then needs to loads the other files that are needed by the first.

You can not allow chain loading like this, it would bypass the sandbox.

One way of working around this would to allow the option of passing a whole folder and sub folders to the program.

The other and much harder option would be a per program portal filter that can read the html file. then workout what files that html file needs and offer that list of files to the user.

The lazy work around is allow read access to $HOME and deny access to some files and folders like .ssh

load more comments (3 replies)
load more comments (1 replies)
[–] schwim@lemm.ee 37 points 5 months ago* (last edited 5 months ago) (1 children)

Yes but surely you're aware that even the most new-user-friendly distros and their tools aren't necessarily aimed at new users.

That warning is a perfect example of how Linux developers choose which hill to die on. They post a warning for an app that everyone knows can deliver bad times to two camps of users; those that know and don't care and those that don't understand the warning. If we could quantify the helpfulness of that warning, odds are that it saved 0 users from malicious action from that avenue of attack.

Never expect Linux as a whole to be "helpful" to the new crowd.

[–] orcrist@lemm.ee 17 points 5 months ago (2 children)

Isn't this why we'd expect new users to use a built-in package manager? Because it avoids this exact problem?

load more comments (2 replies)
[–] PlantPowerPhysicist@discuss.tchncs.de 21 points 5 months ago* (last edited 5 months ago)

In defense of this warning, when I first put my application on Flathub, I had it because of how file i/o worked (didn't support XDG portals, so needed home folder access to save properly). It did actually motivate me to get things working with portals to not request the extra permissions and get the green "safe" marker.

A lot of apps will always be "unsafe" because they do things that requires hardware access, though, so I could see them wanting something more nuanced.

[–] lolcatnip@reddthat.com 17 points 5 months ago

To be fair, if a naive user is going to get a virus, there's a very high chance a browser will be involved.

[–] mactan@lemmy.ml 16 points 5 months ago (1 children)

those warnings on mint and flathub are so ridiculous, there's no difference between those and official ones, somebody could just as easily put something nefarious in any flatpak

[–] Bitrot@lemmy.sdf.org 2 points 5 months ago

Firefox on flathub is an official one, that’s not what this warning is.

[–] KindaABigDyl@programming.dev 16 points 5 months ago (5 children)

They should be worried. We don't want them comfortable.

So many negative things have entered our culture bc people don't care about dangers. Nearly every app should have a warning

[–] AeonFelis@lemmy.world 15 points 5 months ago (3 children)

Nearly every app should have a warning

No. If you put a warning on every app (except for the most trivial ones that don't actually do anything useful) then the warnings mean nothing. The become something more than ass-covering legal(ish) BS.

load more comments (3 replies)
[–] alphafalcon@feddit.de 6 points 5 months ago

They should not be worried, they should be educated.

If you worry a new user enough they'll go back to Windows or Apple because there's less scary warnings there.

We need to make the transition as pain free as possible. Learning about the joys of kernel compilation and SELinux can come later.
The first step is "Hey, this is as usable as Windows, without stupid ads in the start menu.

[–] lolcatnip@reddthat.com 5 points 5 months ago

Nearly every app should have a warning

So it would be how in the US half of all products have a warning saying they cause cancer thanks to California proposition 65? No thanks.

load more comments (2 replies)
[–] Synnr@sopuli.xyz 15 points 5 months ago* (last edited 5 months ago)

This should have been much more well thought out The wording, image, buttons, specific wording for each page.

They really screwed the pooch.

Another 4-6 months minimum before release. But quarterly numbers must be met.

[–] Roopappy@lemmy.ml 14 points 5 months ago (2 children)

If you use Debian-based linux (Ubuntu, Minut, others), Mozilla recommends getting the package directly from their respository rather than flatpak or other repos.

Personally, I saw a major performance increase on my low-powered laptop when I switched from flatpak to the Mozilla package.

https://blog.mozilla.org/en/products/4-reasons-to-try-mozillas-new-firefox-linux-package-for-ubuntu-and-debian-derivatives/

load more comments (2 replies)
[–] tearsintherain@leminal.space 12 points 5 months ago

Just reminding folks that just because it's flatpak'd, doesn't mean it's sandboxed. But they probably should add some general click here for more info.

[–] chris@lem.cochrun.xyz 12 points 5 months ago (2 children)

Yes, but also... It's true. Browsers are the number one way folks get viruses.

[–] refalo@programming.dev 18 points 5 months ago (7 children)

Which is hilarious because desktop apps have always had the capability to spy on all other apps and steal all your data.

load more comments (6 replies)
[–] federino@programming.dev 6 points 5 months ago* (last edited 5 months ago) (3 children)

It's not specific to browsers, but to every flatpak that is verified and has the potentially unsafe warning.

load more comments (3 replies)
[–] Jocker@sh.itjust.works 12 points 5 months ago

Yesss! It's too aggressive

[–] bloodfart@lemmy.ml 11 points 5 months ago (5 children)

Good.

People need to view out of channel software with a hairy eyeball.

Hell, I run Debian all over and it’s absurd that the main repositories don’t do checksums on downloaded packages!

[–] Nisaea@lemmy.sdf.org 5 points 5 months ago (2 children)
load more comments (2 replies)
load more comments (4 replies)
[–] raspberriesareyummy@lemmy.world 8 points 5 months ago (4 children)

isn't flatpak by definition relying on a second software source, hence 2x as much risk as relying on a single source (your OS repo)?

[–] rotopenguin@infosec.pub 10 points 5 months ago* (last edited 5 months ago) (1 children)

How much sandboxing is your distro generally doing?

load more comments (1 replies)
load more comments (3 replies)
[–] AceFuzzLord@lemm.ee 7 points 5 months ago

I'm a firm believer that regardless of operating system that a warning message saying that installing something could cause harm to your device definitely makes people think twice about installation if they're not tech savvy (AKA know more than the bare minimum anymore). It's definitely intentional that the large companies responsible scare you away from doing the things you want because they want you locked into doing things the way they want.

[–] cholesterol@lemmy.world 6 points 5 months ago (2 children)

What does 'user device access' mean?

[–] Bitrot@lemmy.sdf.org 11 points 5 months ago

Clicking the potentially unsafe item lists the exact permissions.

It can access hardware devices, like your webcam or game controller. Likely --device=all in flatpak speak but I haven’t looked.

load more comments (1 replies)
[–] lambalicious@lemmy.sdf.org 5 points 5 months ago (3 children)

To be fair, the fact that browsers are allowed to do so much that this warning has to be shown is more an indictment on the current state of browsers (which at this point are almost like installing VMWare and a virtual machine on your computer!) than on something something Firefox or something something Flatpak.

load more comments (3 replies)
[–] chrash0@lemmy.world 3 points 5 months ago* (last edited 5 months ago) (2 children)

pretty standard compared to OSs like Android and iOS. i think the mobile OSs, at least recently, have done better at this; they don’t ask for permission until they need it. want to import bookmarks? i need file system access for that. want to open your webcam? i need device access. doing it all upfront leads to all the problems mentioned in this thread: unclear as to why, easy to forget what access you’ve given, no ability to deny a subset of options, etc.

load more comments (2 replies)
[–] rotopenguin@infosec.pub 3 points 5 months ago* (last edited 5 months ago)

I just typed "xdg-download:𝗰𝗿𝗲𝗮𝘁𝗲" into flatseal, my browser is safe af now.

load more comments
view more: next ›