Is it safe to assume that all apps from the software store (Discover in my case) are safe?
2026-03-21 10:33 UTC
Replies (13)
-
@Oinks@lemmy.blahaj.zone 2026-03-21 11:19
Discover itself doesn’t guarantee anything. Flathub (the Flatpak repository you are presumably using) requires a human review for new applications but not updates (and the human review doesn’t include a full audit of the app). I’m not aware of malware being distributed via Flathub in the past, but that doesn’t mean it can’t happen.
-
@jpicture@lemmy.zip 2026-03-21 13:49
Just to clarify what others are saying: the ‘software store’ (Discover in your case) is just the graphical application that you use to manage the software installed on your computer. The repositories, aka ‘repos’ are the sources of that software. There are people whose job it is to vet the software in those repositories and make sure that it’s safe. Flatpak is a packaging format. The biggest repository (and what you likely have enabled) for flatpaks is Flathub. If you’re installing software from the Debian repo and Flathub you should be fine. You should be able to verify which repositories are enabled via the Discover app. You have the freedom to add other repositories too, but it will be your own responsibility to evaluate whether those sources are trustworthy if you do. Long story short, if you just use Debian as it is, you are fine.
-
@ardorhb@discuss.tchncs.de 2026-03-21 10:47
Stuff from the repository of your distribution generally can be considered save but everything involving a third party might not be. This counts for both other Apt repositories as well as Flatpak. You likely have Flathub as an Flatpak source and while they have some checks and controll instances it is possible for untrusted third parties to upload packages including non-free ones there. I do not now of any incidents but some suspicion for packages with full system access can't harm.
-
@DataCrime@lemmy.dbzer0.com 2026-03-21 20:07
Uhhhhhhhh… Bruh. It’s not safe to assume any software from anywhere is safe… that’s kinda the essence of Zero Day exploits. Even if you wrote it there have been Linux exploits that hid a root kit, and patched the gcc compiler and linker to create a level of persistence that is just other worldly. IIRC what that fucker was called, but it won’t be hard to find. You can probably still count Linux root kits on one hand. Hell, I’ll look it up after I’m done with my morning duce… _that_ shit was epic. And like, also, theoretically, you could be Mr. Robot, so… you know… it’s just a good idea not to trust yourself anyway.
-
@lemmyreader@lemmy.ml 2026-03-22 18:04
With Deb packages you're safe. With Flatpak I would be a little careful because with Debian apps that have been abandoned get some maintainer love or will be removed, while with Flatpak you can install apps that have not been updated for years, not very often but I've seen a few of them. Because of that I prefer to check the Flathub page of a Flatpak app before installing.
-
@moonpiedumplings@programming.dev 2026-03-22 09:24
Debian repos are basically guaranteed safe: https://programming.dev/comment/22863237 Flathub is much, much safer than say, the google play store, but it ultimately does follow a model of app developers submitting packages which get reviewed and approved. In theory, someone could sneak malware past that, although there haven't been any incidents (perhaps flathub's review is very effective?). But the snap store, which follows a similar model has had malware. But canonical hasn't been the best steward of that one. In addition to this, not all stuff on flathub is open source, which is definitely concerning. Thankfully, flatpak has a built in sandboxing system, which lets you limit what the appps have access to. KDE has a UI for it, and there is also the GUI app flatseal.
-
@unwarlikeExtortion@lemmy.ml 2026-03-21 13:18
Discover itself doesn't care about security - it's the underlying package manager(s) that do. Flatpak is perfectly safe IMO, as are the built-in repositories. Both Flatpak reviewers and Debian maintaniers do their due diligence when auditing the software they distribute. When using distros/repos which are less FOSS purist (such as Ubuntu), you could run primarily into privacy issues. When using smaller ones, the risk of a backdoor or voulnerability is a bit larger, as less eyes are on the code. That being said, the only way to be immune to untargeted cyberattacks is to be offline, which isn't reasonable in this day and age. As long as you stick to your distro's repo and Flatpak you should be *perfectly* fine, save for the "normal" voulnerability or two that unfortunately slip through every now and then. You could think of this as a kind of digital "herd immunity". As long as you don't add repos willy-nilly but think about who you trust, you should be fine. So yeah - you can assume Flatpaks and the Debian repos are safe. They have good security policies about adding stuff in and do do their due dilligence. Though, this might change in the future, alrhough it doesn't seem likely. But for now - you'll be fine. The only real risk is if a backdoor like the recent one in xz-utils *does* slip through the cracks, but then you'll be one of millions of affected machines which, while not mitigating the vulnerabilities per se will at least mean the problem will get fixed sooner once it *does* get found.
-
@Patch@feddit.uk 2026-03-23 01:05
All Discover is is a graphical front end to your repositories, so the real question is "is everything in my repositories safe?". There are no guarantees in life, but if you're using only the default official Debian repos you're just about as safe as you can get. If you add extra repos, whether deb based or flatpak, Discover will only be as safe as whatever you've hooked it up to.
-
@DataCrime@lemmy.dbzer0.com 2026-03-21 20:12
Also… not that any risk mitigation strategy is going to save you 100% of the time. But a translation app sounds like something you could run in a VM to effectively isolate. Hell, if it’s lightweight enough and you have $100 you could run it on a light weight SBC like a Pi and physically air gap it.
-
@captain_aggravated@sh.itjust.works 2026-03-21 20:41
I look at it this way: The repository is hosted by, or endorsed by, the developers of the distro. If you don't trust their software repository, why would you trust the distro itself?
-
@DataCrime@lemmy.dbzer0.com 2026-03-22 05:20
Spot on, thanks for finding that. I wonder if there was ever a proof of concept or something like that. I installed my first copy of Slackware some time in the early 90… Maybe late 80s… it’s getting a bit fuzzy, I want to say that the kernel was pre 0.9. One of the scariest things I had ever done, but I learned so much more about computers than I would have otherwise. Point being there was definitely some years between Ken’s article… still very much the era of viruses for the same of proving you could create something novel and powerful. We kept collections of them like weirdos that keep poisonous snakes 🐍 Anyway, it’s past grandpas bed time. Thanks again for finding the article, I’ll definitely have to do a bit more research… It was a super fun time in my life and I enjoyed remembering.
-
@regedit@lemmy.zip 2026-03-22 09:37
The YT channel _Veritassium_ recently did a video going into more depth about the SSH thing. Was interesting!
-
@DataCrime@lemmy.dbzer0.com 2026-03-23 08:30
ROFL… I think there’s a quotable from _Fight Club_ about his dad going around setting up “franchises…” Honestly hoping to meet Patrick Vol… nope —not even going to take a swing at trying to spell his last name. But I seriously owe that guy a beer and pancakes. On a semi related note, I think it took me a solid week of effort to get audio going (on Linux) just so I could be more confused about how to properly pronounce it. I want to say the file name was linux.au and it’s Linus saying something like “This is Linus Torvalds introducing UNIX as Linux.” Back in the day we had to spell UNIX with an asterisk because AT&T owned the trademark and aggressively enforced it. All of this went down while I was working at a shitty little outfit called Los Gatos Computer Corporation. We built IBM PC clones in half the warehouse, the other half was full of old SGI computers. The scam there was that the business owners told SGI they were recycling the old hardware, but what they actually did was cobble together working systems from the broken bits. Basically one brilliant guy sat in a 10x10 room chain smoking and patching the busted SGI stuff back together. He hand soldered upwards of a hundred hair fine bodge wires, motherboards taped together… it was mental, but somehow they made enough cash to keep the whole crazy operation alive for a year or two.