com.bitwarden.desktop

> One thing I don't know about (which maybe somebody can inform me/us about): the wiki states that PRs are reviewed by Flathub reviewers, but I see no sign of human review on e.g. https://github.com/flathub/com.bitwarden.desktop/pull/167 (or others in that repo). What's the actual process? In this case, I think the lack of human involvement is mostly a good thing. Flathub was criticised for having outdated packages[1]. Using automation to automatically update packages is mostly a good thing. Obviously, we want to see thorough review of new packages, but that's a separate issue. [1] I thought I read this in an LWN article, but I can't find it. But see e.g. https://github.com/flathub/org.qutebrowser.qutebrowser/issue...

I use Flathub, but I do not like that they support the ability for third parties to package commercial software on behalf of the publishers. https://flathub.org/apps/com.bitwarden.desktop - looks great, right? You have to click on "show more" to see "This wrapper is not verified by, affiliated with, or supported by 8bit Solutions LLC.", and prior to clicking "show more", everything looks like it is in fact published by 8bit Solutions. Because it's a third party packager, you end up with bugs like https://github.com/flathub/com.bitwarden.desktop/issues/147 (because they haven't used a particular flag to launch it, which the deb/rpm version apparently does use by default.) Yes, the attack surface is relatively minimal, but it's still there -- https://github.com/flathub/com.bitwarden.desktop/blob/master... One thing I don't know about (which