The Flaws of Flatpak - What do you think about Flatpak Security?

YES. I don't understand this delusion people keep perpetuating. Flatpak has a MILD form of container sandboxing. For a real security sandbox we have Firejails or Bubble wrap.

Flatpak is, at it's core, a software development and distribution packaging format. NOT a security implementation.

Yeah, Flatpak was never meant to be a security mechanism. It is a convenient way to add security to userland though.

In addition to own new code, bundled copies of libraries in packages introduces net new attack surface which isn't patched via the regular distribution security patch process. The image decoding lib that allows remote code execution now exists in flatpaks independently from the one in /lib. Every flatpak vendor that contains it has to build and ship their own patched version of it. This is even more valid for any other libraries flatpaks include that don't exist on the system. The most widely used Linux OSes come with security patching processes, expectations and sometimes guarantees. This new attack surface breaks those and the solution is security sandboxing. This approach has been proven in mobile app packaging and distribution systems. Android is a great example where apps are not trusted by default and vulnerable ones rarely cause collateral damage on otherwise up-to-date Android systems. This is an objective problem with the out-of-band distribution model allowed by flatpak and snap or any similar system, whether you care about it or not personally. It's a well understood tradeoff in software development. It has to be addressed as adoption grows or we risk reducing Linux security to the levels of Windows where apps regularly bundle dependencies with no sandboxing whatsoever.

This is generally good advice. Would you run the program without a sandbox? No? Then you probably shouldn't run it inside a sandbox either.
You can never be sure that the program isn't using a flaw in the sandbox to break out or is just piggybacking onto a whitelisted action that is required for the program's basic functionality.

And if some program requires r/w for your entire home directory and network access then you might as well not use a sandbox in the first place because it can already do everything useful that it needs to do.

I would love to install a browser, and a password manager through flatpaks but they won’t talk with each other.

I would get an IDE like visual studio code, through flathub, but it doesn’t talk with the system software I want to develop on.

I would love to get Steam or any other games as flatpaks but having to redownload mesa and other system files just for that uses a lot of space and feels like a second OS.

So yeah, I agree with you. It’s awesome! But it has some flaws right now (that I’m sure they’re being worked on)

FWIW I figured out how to get a password manager (Browserpass, not KeePassXC) to communicate with flatpak Chrome if you want some advice on how to get it to work.

But yes, it was way more difficult than it should have been (which is "should work out of the box, just like a regular package"). So if you're just listing some of the shortcomings of flatpak, never mind.

flatpak create-usb backs up an app and all dependencies for offline use.

Even if you have trust. There can be security vulnerabilites in apps we are using. Flatpak seems to not really help in any way.

The Flatpak experience on Ubuntu is piss poor on purpose fwiw, Canonical kneecapped Flatpak in favour of Snaps. Try it on Fedora!

AppImages offer zero protection or containerization, it's just a distribution format.

It means you can run apps without trusting their developer will full access to your computer and your files.

Just like on mobile, you only allow apps to access what you know they need. Nothing more.