• 1 Post
  • 65 Comments
Joined 1 year ago
cake
Cake day: June 12th, 2023

help-circle












  • Distro maintainers are a lot better about keeping libraries up-to-date than random application developers. They will even patch applications to work on newer libraries, even when the app developers do not.

    There’s also auditability. If e.g. OpenSSL (or some other library) gets a high rated CVE and Debian ships a same-day patch, I know I am safe. I can verify that I have installed the patched version, and I know my applications use that patched version. Not with flatpak. Now I’m at the mercy of a dozen app developers, many of which probably value security less than the Debian Security team.

    IMHO it’s a mistake for Fedora to drop its own packages for flatpak. But Fedora appears just to be a RedHat experiments playground these days, not a user focussed distro.

    Don’t get me wrong, Flatpak is fine if you want to install stuff from Joe Random Developer off the internet, but I trust the Debian maintainers a whole lot more. If they ship it, i can trust it.



  • Distro native packages are:

    • Better integrated into the base system
    • No maintenance for the devs (they are usually maintained by distro package maintainers)
    • Better interoperability with other packages and dependencies, thanks to the package maintainers
    • No duplicate or outdated dependencies
    • More space efficient because they use system dependencies instead of packaging their own
    • Launch even quicker since they don’t go through flatpak
    • No missing or broken features due to flatpack limitations or sandbox issues (e.g. inter-process communication)

    If an application is new or niche or small then flatpak is definitely a good option. But if there’s a distro native package then that one is almost always the better option. Flatpak is nice for when there is no native package.