Hi, there!
Newbie question here: basically, the title. Perhaps what I’m asking is pretty obvious, but I’d like to double-check with the community on this.
I use Discover on my Debian KDE Plasma set-up, with Flatpaks enabled (but not Snaps). Sometimes, I come across apps (I did just yesterday, searching for translation apps to replace DeepL), that have according to its page, an unknown author and, sometimes, even an unkown licence, but which do require access permission to the whole system (this latter requirement applying specifically to Deb packages, from what I’ve seen).
Under these circumstances, is it safe to assume that such apps will still be safe because of the fact that they appear listed on Discover (in other words, is Discover a guarantee of safety for the apps it shows, as in, some type of checked or proved content), or should I still be wary of potentially malicious software included on it?
Thank you very much in advance :)
I look at it this way: The repository is hosted by, or endorsed by, the developers of the distro. If you don’t trust their software repository, why would you trust the distro itself?
Uhhhhhhhh…
Bruh. It’s not safe to assume any software from anywhere is safe… that’s kinda the essence of Zero Day exploits.
Even if you wrote it there have been Linux exploits that hid a root kit, and patched the gcc compiler and linker to create a level of persistence that is just other worldly. IIRC what that fucker was called, but it won’t be hard to find. You can probably still count Linux root kits on one hand.
Hell, I’ll look it up after I’m done with my morning duce… that shit was epic. And like, also, theoretically, you could be Mr. Robot, so… you know… it’s just a good idea not to trust yourself anyway.
Also… not that any risk mitigation strategy is going to save you 100% of the time. But a translation app sounds like something you could run in a VM to effectively isolate. Hell, if it’s lightweight enough and you have $100 you could run it on a light weight SBC like a Pi and physically air gap it.
Just to clarify what others are saying: the ‘software store’ (Discover in your case) is just the graphical application that you use to manage the software installed on your computer. The repositories, aka ‘repos’ are the sources of that software. There are people whose job it is to vet the software in those repositories and make sure that it’s safe. Flatpak is a packaging format. The biggest repository (and what you likely have enabled) for flatpaks is Flathub. If you’re installing software from the Debian repo and Flathub you should be fine. You should be able to verify which repositories are enabled via the Discover app. You have the freedom to add other repositories too, but it will be your own responsibility to evaluate whether those sources are trustworthy if you do.
Long story short, if you just use Debian as it is, you are fine.
Thanks for joining the conversation and help make things clear. This does help; so, basically, not having manually enabled anything else than Flathub/Flatpaks on Discover, and having Debian’s repository already, I am fine as long as I install programmes from either of those two.
I would say you are more than likely fine, malicious code does occasionally sneak into Debian distributed apps but you’ll likely never encounter something that is outright fraudulent or a scam.
Yes, you’ve got it 👍
You can basically just treat everything available in Discover as good, because everything there will either be from Debian or from Flathub.
I’m on Debian 13 too but have the GNOME desktop environmet.
Stuff from the repository of your distribution generally can be considered save but everything involving a third party might not be.
This counts for both other Apt repositories as well as Flatpak. You likely have Flathub as an Flatpak source and while they have some checks and controll instances it is possible for untrusted third parties to upload packages including non-free ones there. I do not now of any incidents but some suspicion for packages with full system access can’t harm.
Thank you for your insightful comment. If I may incur once again in noobieness, what precisely do you mean when you say the “repository” of my distribution? Do you mean the pieces of software than come preinstalled with the OS itself?
I think others have answered your question here quit well, I hope you’re not overwhelmed by all of this.
A repository (or repo) is a server that hosts program files for your distribution. Distributions host their own repositories from which you can install software with your package manager, like APT or DNF or others. If you only install software from your distribution’s repository, there’s likely no clashes with software versioning and dependencies, and the packages are about as reliable as they can be (which doesn’t mean there’s never malware). If you add third party repositories for software not available from your distribution’s repository, it’s more likely there will be issues, because the distribution doesn’t guarantee the packages work well together.
For example, Debian and Arch don’t retrieve and install their software from the same source. They have their own servers (repositories) hosting software compiled to work with their particular distro and to be used by their chosen package manager.
Flatpak (or Snap or Guix) is a separate package manager that handles it’s own dependencies and doesn’t clash with your distribution’s own software manager.
Does this help?
Hi! Thank you for your reply. So, if I understood correctly, whenever I click on “Install from Debian/GNU Linux” on Discover I am getting software directly from Debian’s repository (thus, a “repository” in the sense that it’s a place where this software is stored and can be retrieved); same thing when clicking on “Install from Flathub” for a Flatpak from Flathub. This does seem like the safest approach in the sense that it’s the less risky one and, if malware did slip through, such as the XZ backdoor, at least it would not have been due to a personal mistake of mine, but a general one which would’ve affected much more people too.
This, in turn, is different from APT, which is not Debian’s repository, but Debian’s package manager. So, technically, I could write “sudo apt install (anything)” to get any piece of software from Debian’s repository indeed, but I could also use that command to get software from somewhere else also in the form of a Deb package but which would not have come from Debian itself.
Did I get this right?
Thanks a bunch.
This, in turn, is different from APT, which is not Debian’s repository, but Debian’s package manager. So, technically, I could write “sudo apt install (anything)” to get any piece of software from Debian’s repository indeed, but I could also use that command to get software from somewhere else also in the form of a Deb package but which would not have come from Debian itself.
With apt (and discover which uses apt/dpkg at the background) you can install anything from repositories configured on your system. So, if you want to use apt to install packages not built by Debian team you’ll need to add those repositories in your system, so they don’t just appear out of nothing.
Some software vendors offers .deb packages you can install which then add their own repository on your system and then you can ‘apt install’ their product just like you would on native Debian software and the same upgrade process which keeps your system up to date will include that ‘3rd party’ software as well. Also some offer instructions on how to add their repository manually, but with a downloaded .deb it might be a bit easier to add repository without really paying attention to it.
Spotify is one of the big vendors who have their own repository for Debian and Ubuntu and with Ubuntu there’s “ppa” repositories, which are basically just random individuals offering their packages for everyone to use and they are generally not going trough the same scrutiny than official repositories.
It may be a lot to take in at first, but seems to me you’ve got it!
Thanks to you all for helping me understand it :)
Discover itself doesn’t care about security - it’s the underlying package manager(s) that do.
Flatpak is perfectly safe IMO, as are the built-in repositories.
Both Flatpak reviewers and Debian maintaniers do their due diligence when auditing the software they distribute.
When using distros/repos which are less FOSS purist (such as Ubuntu), you could run primarily into privacy issues. When using smaller ones, the risk of a backdoor or voulnerability is a bit larger, as less eyes are on the code.
That being said, the only way to be immune to untargeted cyberattacks is to be offline, which isn’t reasonable in this day and age. As long as you stick to your distro’s repo and Flatpak you should be perfectly fine, save for the “normal” voulnerability or two that unfortunately slip through every now and then. You could think of this as a kind of digital “herd immunity”.
As long as you don’t add repos willy-nilly but think about who you trust, you should be fine.
So yeah - you can assume Flatpaks and the Debian repos are safe. They have good security policies about adding stuff in and do do their due dilligence. Though, this might change in the future, alrhough it doesn’t seem likely. But for now - you’ll be fine.
The only real risk is if a backdoor like the recent one in xz-utils does slip through the cracks, but then you’ll be one of millions of affected machines which, while not mitigating the vulnerabilities per se will at least mean the problem will get fixed sooner once it does get found.
Thank you! Honestly, it’s quite amazing that I can enjoy such complex pieces of software made by and taken care of by the community while not trying to sell me anything or sell my data in return. I love Debian and FLOSS in general.
Discover itself doesn’t guarantee anything. Flathub (the Flatpak repository you are presumably using) requires a human review for new applications but not updates (and the human review doesn’t include a full audit of the app). I’m not aware of malware being distributed via Flathub in the past, but that doesn’t mean it can’t happen.
Thank you; this helps me to better understand it.
