Flatseal

Use flatseal with flatpak. https://github.com/tchx84/Flatseal

Try using Flatseal [1] which is a Flatpak app that helps manage permissions for other Flatpak apps. You can see exactly what permissions are enabled in each app's sandbox and expand/override everything from env vars to filesystem locations you want to enable access to. [1] https://github.com/tchx84/Flatseal

Flatpaks are awesome. If you need to tweak them, Flatseal is a great tool. https://github.com/tchx84/Flatseal

> Not sure from which perspective your comment comes from. dnf update or dnfdragora updates (if you prefer a GUI) are all done while the system is running. Fedora doesn't recommend doing updates that way :) See https://fedoramagazine.org/offline-updates-and-fedora-35/ > Sure, distribution upgrades nowadays are just like Windows update requiring a system reboot and a black screen with a useless progress bar to stare at (that's also a pretty annoying relatively recent addition). Silverblue doesn't have a black screen with a progress bar — it just boots straight into the updated version. I assume Kinoite (like Silverblue but with Plasma instead of GNOME) is the same. > And until flatpak delivers tangible finegrained software sandboxing (at least Android level sandboxing) Flatseal may provide what you want here: https://github.com/tchx84/Fla

From my subjective (user) point of view, flatpak is pretty fine. Yes, I do get annoyed whenever I run flatpak update and see 5-10 updates to drivers or runtimes in the range of ~100MB each. But I also want applications to be "just working". What kinda annoys me though is that file dialogs open in the background. Now I am used to check for it, but when the main window is still in front, yet blocked, because focus is in the file dialog modal, that can get confusing for a moment. AppImage is ok for me too, the application needs to be "complex" enough to justify the download size though. Precisely what the KCalc example from the article does not do. I didn't even know there is a daemon thingy that auto-integrates them, usually I put them in a folder, grab an icon somewhere and place it next to it with same name, then add an entry in OS manual

I read an article long time ago that flatpack packages are insecure and allow too often the access to the home directory or even the whole system. Now I learned that you can override the flatpack settings and that a gui application exists with which one can configure them: https://github.com/tchx84/Flatseal

Great article, thank you for sharing. I use Flatpak extensively and I fully agree with you and the author of the response that there is a need to balance practicality vs. idealism when it comes to (fully auditable) FlatPak apps, as well as FlatHub's overall approach and continual work within the desktop Linux ecosystem. What's more, the fact that an entire domain was devoted to what could have been a blog post gives credence to the responder's notion that this is FUD which, while valid for discussion, is most certainly not beneficial to the FOSS community writ large. Either way, from the article you linked TIL about Flatseal[0] so I'll be taking that for a spin! [0] https://github.com/tchx84/Flatseal

Confirming these settings at first launch is something that mostly annoys users. Remember: Most users just install software via Flatpak because this way they don't have to compile it themselves, deal with a tarball or use an outdated release their distribution ships. Also, if you want to review or change these settings, you can use Flatseal[0]. Arguably, it should be installed by default. The problem with flatkill.org is that it leads to users rather downloading a random deb off the internet or an AppImage than using Flatpak, which both have worse security stories. [0] https://github.com/tchx84/Flatseal