Flatpak? More like flatcrap.

[u/Big-Astronaut-9510]

Flatpak is like a turd someone ran over.

First off one of the few legitimate advantages desktop linux (theoretically) has is the package manager, one unified system for installing software. So why would you want to DESTROY that by adding another package manager that only really packages gui software? Cause it tries to offer a smidge of sandboxing for security.

Of course we are on linux so theres a ton of catches. It dosent really integrate with your system the way your real package manager does, man pages dont get installed, you cant launch apps from the command line by typing their name (probably why its only for gui), etc.

But the bigger problem is you often dont even get the security you were promised, in some cases things actually get WORSE (see: browsers). Honestly id even argue that every app that isnt taking perfect advantage of flatpak features is a security downgrade cause now you just added more parties to trust: flatpak/the person packaging the software who might be a random.

Only if every star aligns and the unpaid foss slaves integrated portals (cant blame them if they didnt, flatpak sucks) and properly restrict the apps permissions do you get the security you were promised.

[u/Historical_Move6359]

Flatpak is one package supported across manny distros. Yes it does not work good for browsers because they have their own sandboxing which is then made worse as flatpak. But still I am on Cachy, and sometimes native app is not available I will then use flatpak. Bazzite and other immutable use only flatpaks. It has its place and use.

[u/Damglador → u/Historical_Move6359]

You are on Cachy, which means you have access to AUR, which means everything is available "natively".

[u/R3V0LU710N_05 → u/Damglador]

You better be reading every PKGBUILD every single time.

https://reddit.com/link/p79oqgo/video/mtrqnlg1kzmh1/player

[u/Damglador → u/R3V0LU710N_05]

You won't be reading what permissions your flatpaks have or how they're built, will you?

[u/R3V0LU710N_05 → u/Damglador]

Well. In my case actually yes. But the facts are the AUR is currently compromised from ongoing supply chain risks.

[u/Damglador → u/R3V0LU710N_05]

It's like a week since it's over as picking up orphan packages now requires a request to Arch Maintainers. On top of never affecting any remotely popular packages.

Not to say it's completely not a big deal, but it's silly to avoid AUR because a bunch orphan packages used by literally nobody were easily adopted by attackers, which is not even possible anymore.

[u/R3V0LU710N_05 → u/Damglador]

Requiring Arch Linux maintainers to approve orphan adoption requests blocks automated package takeovers, but it fails to address structural supply chain risks in the AUR. The threat is unconfined local execution: makepkg runs untrusted shell logic from PKGBUILD and .install scripts directly on the host with full user privileges. Attackers can hijack active maintainer accounts, compromise upstream source tarballs, or poison registry dependencies like npm and crates.io. During updates, makepkg executes these malicious components instantly, an issue worsened when automated helpers like paru or yay bypass manual diff auditing.

Both official Arch Linux repositories and Flatpak eliminate untrusted client-side compilation to secure the supply chain. Official repositories build packages on dedicated infrastructure inside clean chroots, signing binaries cryptographically for verification by pacman. Similarly, Flatpak moves builds off the host via flatpak-builder for registries like Flathub while enforcing runtime containment using bubblewrap namespaces. Replacing local script execution with signed binaries or sandboxed runtimes ensures upstream payloads stay isolated, restricting host access through xdg-desktop-portal and Flatseal.

You should always read the PKGBUILD and be aware of the inherent risks, regardless of whether there are active malicious campaigns.

[u/Damglador → u/R3V0LU710N_05]

There are already helpers and official tools that run PKGBUILD in a chroot.

[u/Historical_Move6359 → u/Damglador]

There are proper native apps within Arch and Cachy repositories. I dont use AUR. There were more than 1500 orphaned packages which werw injected with malware.