in the past I tried to avoid using Flatpak as I has security-concerns. That’s because a lot of flatpaks are not officially from the developers. It seems as if there was a change and there are much more packages coming from the developers, but still there are plenty that that are “untrusted” or seem to come from the official developer, but who knows if this developer ist trustworthy.
In the past I gave my trust to the maintainers of the distributions as they select which pachages to include in their repo and have a look over the packages if there are some changes.
How do you score the security-impact by switching the main-source for additional software to flatpaks, mainly flathub? I think for the developers of the distribution it brings advantages, as they don’t have to bother with all those packages, laying this to the user. The user (like me) not has this question how trustwothy is flathub?
In the past I installed packages from official repos without thinking about trusting the source, as I trusted my distribution…
That’s the key question. It’s also one you should be asking about distro packagers, too. Because in the end, both groups of people are doing the same kind of work: packaging up and distributing other people’s software.
The major difference is that with Flathub, the packaging and distribution tasks are more likely to be separated. The Flathub people take care of distribution, while the software’s developers can do the packaging, just on Flathub’s infrastructure.
In principle this is possible for traditional distro packaging, but in practice few developers do it because there are so many distros that it would be a ridiculous amount of work to get decent coverage.
For Flathub packages not made by their developers, it’s the exact same thing that every distro does, with some random person packaging up the software on behalf of the developers.
So it comes down to whether you trust the people behind Flathub. What are your specific concerns? Have they given you any reason to be suspicious?
One additional thing to consider is that the distribution package manager usually runs with root level access and some (if not all) of those package formats allow packages to provide scripts that run as part of the installation process.
A Flatpak/Snap/AppImage only executes code as the user starting it.