🛡️ "Stop Subverting Sandboxes"
with Michael Catanzaro at #GUADEC2025
📅 25 July 🕒 13:40 CEST 📍 Brescia
🔒 Flatpak can protect users—but not if we keep bypassing it. Michael calls for stronger sandboxing, better portals, and shares GNOME’s new security bounty program.
🔗 events.gnome.org/event/259/con…
#Flatpak #GNOME #Sandboxing #Security #FOSS
GUADEC 2025
Welcome to GUADEC 2025 GUADEC is the GNOME community’s largest conference, bringing together hundreds of users, contributors, community members, and enthusiastic supporters for a week of talks and workshops.GNOME Events (Indico)
HyperSoop
in reply to GNOME • • •violetstone
in reply to HyperSoop • • •HyperSoop
in reply to violetstone • • •@violetstone yea
you already get the choices presented to you in a fairly straightforward manner if you install flatseal but even then you have to go out of your way to change the settings from the typically insane defaults
violetstone
in reply to HyperSoop • • •Cassidy James
in reply to violetstone • • •@violetstone @soop Flatpak and GNOME do rely on runtime permissions in the form of Portals, similar to the permissions model on iOS and Android. There are a number of static permissions that had to exist to transition from an entirely unsandboxed model to a permissions model where we actually provide an API and user control over what apps can do.
flatpak.github.io/xdg-desktop-…
XDG Desktop Portal
XDG Desktop PortalCassidy James
in reply to Cassidy James • • •@violetstone @soop for more background on the reality of the Flathub security model, I recommend reading this blog post; I wrote it to help explain it pretty in depth:
docs.flathub.org/blog/app-safe…
Flathub Safety: A Layered Approach from Source to User
Cassidy James Blaede (docs.flathub.org)GNOME
in reply to Cassidy James • • •@cassidy @violetstone @soop there is a talk happening at GUADEC in a couple of hours about exactly this! 😊
floss.social/@gnome/1148970708…
GNOME
2025-07-22 13:16:07
GNOME
in reply to GNOME • • •GUADEC 2025 - Day 2 - Track 1
YouTube