this post was submitted on 28 Mar 2024
421 points (98.4% liked)
Linux
46758 readers
3224 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I still don't understand why a central repository for AppImages exist. The moment you are using a repository (and possibly version management), the format looses its reason to exist.
I don't see how that's true. The main point of AppImage is it 'just works' on any distro. If you have one primary place to distribute them to any distro - it's still meeting AppImage's vision.
To be fair, after some thinking I think you are right and I was a bit in a tunnel vision logic. My previous statement looks a bit foolish now.
No. Appimages are selfcontained and thus useful for archiving software or carrying it around in random ways. Flatpak could do this too but not as easy.
Still, don't use Appimages
I personally use a few AppImages, but want replace them with Flatpaks. Flatpaks have their own issues, and because I did not want to troubleshoot in case I encounter another issue, just carry on using AppImages for these selected applications. Also I was not able to archive Flatpak easily, its very complicated with keys and not. Compared to it, I just have the AppImages included in my regular backup process with regular files.
My point was not if AppImages are useful (they clearly are and I use them), but was talking bout repositories. However after some other replies I thought about it and indeed such a repository makes sense even for AppImages. I personally just don't have to use them.
Even with such a repo they are highly insecure by design.
Not really. AppImages are as much secure as any other executable you run on your system. If you download it from a trusted source, like you download trusted Flatpaks or your systems repository, then they are not worse. If you say AppImages are highly insecure, because you run executable code, then you have to take that logic to any other executable format. The problem is not the format itself that makes it insecure, it's the source.
No they arent. Please read the linked post.
I read that page and there is nonsense included too. Just because I read that page does not make it correct. If you think that AppImages insecure, then you did not understand my point that its not the format thats insecure, but the source where you get the files. Every packaging system is insecure if you get it from bad source.
That's not even a question. AppImages are fine and not insecure if you download it from a secure place you trust (like your system packages, you trust your distro maintainer fully). Would you trust every distribution maintainer on every distribution? Let's say a Chinese Linux distribution, that maintains Flatpaks and native packages. Let's say they are flaky. See? It's the source you don't trust, not the file format or packaging system.
Read my replies (just like you said I should read the linked post). And understand the issues.
Shit missing internet got my comment deleted...
Appimage is not a neutral packaging format. Of course "an app packaged as .zip is as secure as packages as .tar.gz". But the format causes all the things mentioned in the post.
So it is way less secure than Flatpak, thats a fact. It may not be worse than tarballs, but if those dont include the libraries even less secure than them.
I partly agree. But your tone changed a lot from "highly insecure" to "less secure", which is a complete different statement. An application does not need to be in a sandbox to be secure, so I don't accept that as an argument against trusted applications. I only accept your arguments if we talk about random downloads from random places.
Also the argumentation that AppImages are usually run from random locations doesn't make them unsecure, it's a feature. BTW I have a dedicated folder where I put them, but that's my personal organization. Did you know that you can unpack an AppImage back to its original folder (like an archive)? You need appimagetool for that.
The only thing I fully agree with you and is a weak spot about the AppImage format is, that it can or will include outdated and not updated libraries (or executables). Which is the point of the format on the one hand, but a curse on the other hand. Normally it is recommended to build on the oldest supported LTS Ubuntu, because of older libc. libc is the root of many problems in Linux (for compatibility).