I’ve been involved with Linux for a long time, and Flatpak almost seems too good to be true:
Just install any app on any distro, isolated from the base system and with granular rights management. I’ve just set up my first flatpak-centric system and didn’t notice any issues with it at all, apart from a 1-second waiting time before an app is launched.
What’s your long-term experience?
Notice any annoying bugs or instabilities? Do apps crash a lot? Disappear from Flathub or are unmaintained? Do you often have issues with apps that don’t integrate well with your native system? Are important apps missing?
My experience with flatpak has been stellar from a technical perspective has been stellar.
Where it currently falls short for me personally is trust. With my distro I am putting my trust into the maintainers, but with flatpak its… random people for most apps?
It is tough when it is not a primary channel of distribution for most devs, but I am optimistic that will change in the future.
It’s sandboxed though. Running an app from a developer already implies trust on your part. So if it’s sandboxed away from your other stuff, what’s the issue?
Sandboxed just means an app can’t reach out to the rest of the OS. What about the information I am entrusting to it to process?
If my browser is a flatpak, it likely has access to most of the information I care about. If I am using a chat app that is a flatpak, it can read my most personal communications. Why do I care if it can read what is in /etc?
Relevant: https://xkcd.com/1200/
You totally missed my point. My point was that a lot of flatpaks are packaged by unknown third parties. I would love it if the devs would package things as flatpaks directly, but that is mostly not the case.
Looking at flathub right now. 1567 applications are from unverified publishers vs 789 verified. Unverified apps include chrome, edge, chromium, brave, BITWARDEN and signal. All of those applications process highly sensitive information.