Eg - https://flatkill.org/2020/

There's also Flatseal (https://flathub.org/apps/details/com.github.tchx84.Flatseal) as a user-friendly way of managing permissions for flatpak apps. This version of elementary OS comes with its own permission manager, but with my limited experience with both, it seems like it allows tweaking less permissions than Flatseal.

Everything in that reference basically says "yep the criticism is valid" and in a few cases the author expands on that with "but it's ok because..." and then lists various reasons why it's fine that it's still a problem but that's it's being worked on. They also had to correct a good chunk of just outright incorrect information they were supplying mid-post about system updates.

One item was addressed, which was that flatpak now notifies the user that sandbox escapes are possible based on the app's configuration.

As a response to the criticisms, it's not a great one.

Consider also, there are better ways that some of these issues could have been tackled. Why not have flatpak prompt for permissions as they're used, e.g.: "This app wants to open your home directory" rather than at install-time. That would make it abundantly clearer to the end users this is aimed at.

I'm going out on a limb and guessing that it is because that's what is done in mobile, and it's usage in mobile has re-taught everyone the lesson that constant dialog prompts just train users to click through dialog prompts without reading them. That's bad, and annoying.

I do still think there are better solutions to that problem, but it would require more effort from users to get applications working if they weren't designed with sandboxing in mind, which is the vast majority of applications, which in turn means that Flatpak probably wouldn't have grown as quickly.

As it stands though, flatpak out of the box has all the security issues of running old unpatched systems in order to mostly have compatible runtime environments, which, in my experience, don't actually buy me that much. The few times my distro hasn't already shipped a copy of an application, AppImage, Flatpak, or Snap haven't had the solution either.

This entire experiment we're doing with "ship the developer's box" as the new standard of software delivery and the different warring philosophies employed to turn that into a reality are interesting. My money is on the least secure, least safe, least functional, but best marketed thing winning out.

They essentially deny every such permission request and for the few they actually care about (getting notifications from 2 or 3 of the 50 apps that want notification access) they come and asked for assistance.

One of the nice things about the iOS ecosystem is that apps aren’t allowed to be nonfunctional if you deny them access to something.

The end result being that you can't get everything in any one of them, and often can't get a particular application in any of them.

Plus I find the general sandbox approach to be a LOT more stable - distro upgrades rarely causes issues, and dependencies are much easier to wrangle.

Definitely still some hiccups, but overall it feels like it's moving in a direction that I find easier to work with - both as a user and a developer.

Plus the markets are generally fairly large - sure I still dip into aur every now and then, but I mostly find the "Software I need at work" stuff available

I think that speaks to a particularly huge failure of Linux Desktop more than anything else.

This is the point I'm making though. There is fragmentation on the desktop (even if we just stick to window managers, display managers, desktop environments). But there's fragmentation EVERYWHERE. I can choose from thousands of distros, in numerous package formats, with different opinions on that collection of software and its default configuration.

Linux Desktop is fragmented but no worse, IMHO, than elsewhere. I'm not saying it's a good thing, but some people do like the choice otherwise those other choices wouldn't exist.

Android is also a prime example of the same thing.

If you compare Linux Desktop to other desktop operating systems it is catastrophically fragmented by comparison.

> Android is also a prime example of the same thing.

No, it really isn't, because I only have one package format that I have to package Android applications in and the only API I have to deal with is the Android API. Though of course that's a headache because of how new permissions and older APIs interact, but that's still a lot more straight-forward.

No snark intended, but how much did you pay for the software?

From my experience, most of the popular proprietary ones (think: Slack, Discord, Spotify, whatever) are distributed both as a flatpak and as a snap, while more niche desktop apps are usually flatpak-exclusive (out of those options).

Perhaps you just don't use that many things that aren't really popular or well known? I can't find PuTTY and KeePass (though obviously there are alternatives in those cases), applications that both have Linux versions and that I use every day (and aren't even that unknown).

Also, unfortunately the limitations of Flatpak mean even if what you want is there, say Wireshark, it often won't have full functionality because it is impossible to give it the permissions it needs. In Wireshark's case, it can't actually capture any packets. If you want to actually use it you'll still need to resort to a different installation method.

That being said, unless the flatpak has some features your distro version doesn't, for trusted software package is always preferred.

Flatpak is really for untrusted software/proprietary and projects that update with new features often.

https://github.com/flathub/org.wireshark.Wireshark/issues/4

For me this was a much bigger issue when I was on Windows, but also in Ubuntu which groups programs together similarly to the Windows taskbar. I'm on i3 now mostly and just use a normal terminal for ssh, but for quite some time I was using putty on linux specifically for window management.

It's been some time since I last read anything like that from you. Would you mind to comment if ebpf usage and the possible new futex2 syscall helps to close the gap between linux and NT with regards to async primitives?