flatpak remote-add flathub-verified --subset=verified https://dl.flathub.org/repo/flathub.flatpakrepo
  • Skyflare@discuss.tchncs.de
    link
    fedilink
    arrow-up
    3
    ·
    7 months ago

    All you need to verify an AUR package is to read the PKGBUILD file, which is something the AUR keeps on encouraging you to do (this assumes that you trust the upstream repo, which is something that even official packagers of most distros do)

    Also a lot of flatpak packages aren’t sand boxed enough to be safe and only ends up giving false sense of security to nontechnical users

    Your last point is extremely important though, AUR is horrible for nontechnical users (which is why the AUR discourages AUR helpers)

    • rollingflower@lemmy.kde.socialOP
      link
      fedilink
      Deutsch
      arrow-up
      2
      ·
      7 months ago

      Okay having an easily readable build file is a bit missing. Flathub hides that a lot.

      I think their rating system, which is on the website and also GNOME Software, displays apps with home access as insecure.

      And somehow this seems to be general knowledge and an issue about a privilege escalation through a local override was just closed. Yay