4

When you launch the Steam Deck in desktop mode, the UI by default contains a shortcut to something called "Discover Software Center". My experience with Linux-based system is very limited, but I am aware that most distributions have a sort of software center or package manager like this, comparable to an app store. I have read that each Linux distribution has its own repository of games and applications, so I'm assuming the same is true for SteamOS. What I don't understand however, is how these repositories are managed and curated. Does the team or company behind the OS manually verify everything on it, or could theoretically anyone pose as the developer of some popular software and submit something malicious to appear in there?

The specific case that brought this question up for me is when I wanted to install Discord on the Steam Deck. I found it in Discover, but the app's description says "This wrapper is not verified by, affiliated with, or supported by Discord Inc." This has me confused, and there doesn't seem to be any further clarification about this. I am aware of third party clients for apps like Discord existing, but how can I be certain this won't steal my login details, or secretly run other things in the background that I may not want? Similar concerns apply to other games and programs.

Can anything in the Discover center be blindly trusted to be safe? If so, why, and if not, how would you make sure?

2 Answers 2

3

The idea behind services like this is "crowd sourcing". People can share something others can use, and any users are expected to trust what they use. Well-organized crowd-sourced services tend to make it pretty easy to contribute though they usually have lots of rules about what can be submitted. And there's usually volunteer community policing of the content that's done by both regular users and those who are moderators or admins.

ClamAV (and likely others) can at least scan flatpaks after install. Consider this Reddit comment though (edited for clarity, length):

By default system folders are not accessible by the container that runs the flatpak app. You can customize permissions if you don't trust the maintainer (Flatseal is a useful tool for this). For instance, I create a strict policy (no network, only has access to a specific directory, etc). The other question this brings up is what is safer: An "official" package that has full access to your system, or an "unknown" package that lives by default in a container?

In the end it's up to each user to avoid, "trust but verify", or lock apps into their own little world and consider it "safe enough" if you can't verify whether they're trustworthy. There are communities like Flathub on Discourse and /r/flatpak on Reddit which would be good for discussing specific apps, and the Steam Deck communities could also be good as it concerns them in particular and there's going to be plenty of knowledgeable users with them who will be glad to help.

1

Are apps on Flathub legitimate and safe?

@l3l_aze answer is complete from my point of view and should be the accepted answer, but let's look at a few examples.

The Discord example

I'm trying to explain how this works to myself here, so let's see what we have.

What is a wrapper (function)?

Wrapper functions can be used to adapt an existing class or object to have a different interface. This is especially useful when using existing library code.

https://en.wikipedia.org/wiki/Wrapper_function#Adapting_class/object_interfaces

That looks like a precise and short explanation to me. What does that mean in practice for Flathub and the Flatpak packaging format in this case? Someone from the community took existing software and wrapped it in Flatpak bubblewrap padding. Sounds funny, but it is true. I could talk in more overused terms about sandboxing and containers, but let's keep it brief.

So Flatpak should wrap an object for us in bubblewrap, so we can carry it around safely. Where does the object come from? You can read the source: com.discordapp.Discord.json#L114 An automated build process fetches the software source code or binary objects directly from the manufacturer website and adds required dependencies, just like you would do. The other parts should only be metadata and helper functions.

An abandoned app example

Here is an anecdotal example about how Flathub---the crowd sourced community that Discover Software Center builds up on---publishing and packing works in practice, and with how much the team that runs Flathub burdens themselves: https://github.com/puddletag/puddletag/issues/735

In this case we have an app (a music tag editor) which has been abandoned by its original author. After some time a few members of the community stepped up to port it to a newer platform (Python 3 and newer Qt). Packaging it for Flathub and publishing it there would make it easier for a lot of users from my point of view, but the current project leads don't feel comfortable and don't have it on their roadmap yet. Another user stepped up to do most of the work, but Flathub refused to publish the app this way. Sounds a bit ambiguous at first when compared to the discord example. But not everyone can spin their own copy of a popular app and publish it on Flathub. This it as much as we have right now.

Software supply chain security, where is the industry now?

Well you started to ask the right questions, but you need to see where we are at this point with the software engineering industry. Free software and free software components have taken over but many people still don't understand what that means and what the risks are. Consumers will probably never understand, and people who learned doing it the wrong way to get things done will only unlearn over a long time. That is the baggage we are still carrying around from days when only very few people were software engineers and nobody really cared about security because most systems were not connected and thus less useful and less risky.

Requirements for a software bill of materials could improve the situation, but it will be a long road ahead.

From another point of view we need to also consider software preservation, which is where I see Steam and Wine/Proton playing a big part. The Discover Software Center as a whole, and how it is integrated at the moment looks like an afterthought. They knew they had to offer a way for traditional desktop experience and a way to get popular apps without reinventing the wheel like Apple and Google are doing and at which Canonical (Ubuntu) failed with their phone undertaking, so they choose Flathub, a good choice for people who know their way around things (it serves the community well) and how to read code, but out matched by the big competitors.

My opinions and observations:

  • I don't like walled gardens.
  • I don't like antivirus software packages.
  • Free software packaging which Linux distributions like Debian started in the 1990ies, and which JFrog, Sonatype and other competitors took to the next level makes a lot of sense from the professional point of view.
  • Implementing secure systems is very difficult, many developers are under constant pressure to deliver new features built up on code they thought they understood until it broke.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .