0

Can I trust the (official?) GnuCash Flatpak on Flathub, linked from here to here?

Following up on this Q&A I'm asking myself if I can trust this, bearing in mind this.

Other options would be to use a PPA, compile from source myself or wait for a long time until Ubuntu includes a more recent version of GnuCash in its repos.

I would guess that PSD2's two-factor authentication itself adds quite a bit of security, but am still unsure whether to trust a flatpak or, alternatively, a PPA.

Related link(s):

schroeder
  • 123,438
  • 55
  • 284
  • 319
nutty about natty
  • 143
  • 7
  • So basically, you ask if flatpak itself is trustwothy –  Apr 30 '20 at 21:44
  • 1
    Safe against what? Those reasons don't make Flatpak any less secure than just installing the application like normal. – multithr3at3d Apr 30 '20 at 23:33
  • @MechMK1 Yes… essentially. If it were an app **without** PII (personally identifiable information) I wouldn't have any concerns installing a Flatpak, Snap or AppImage - the latter of which appears to be endorsed by Linus Torvalds himself ("This is just very cool."), but here with GnuCash it clearly handles quite sensitive stuff: **online banking**. – nutty about natty May 01 '20 at 07:52
  • @multithr3at3d Safe in the sense that financial data downloaded from the bank into GnuCash won't be in danger of being siphoned off - or worse, that a financial transaction will be performed - by some malicious code (by virtue of being in a flatpak - rather than from code of GnuCash checked by Ubuntu). Crudely put. – nutty about natty May 02 '20 at 06:54

1 Answers1

2

As mentioned by others, I think the question boils down to "can I trust Flatpak as an entity providing software?"

Flatpak "Security Issues"

Barring any severe, currently unknown vulnerabilities in Flatpak itself (e.g. privesc), those linked "issues" with Flatpak don't seem to apply to your concerns, and can be debunked.

  • Many Flatpak apps have filesystem write permission
  • Most Flatpak apps do not run in a sandbox

Yes, unless you are using precisely configured SELinux or AppArmor profiles, all of your apps built/installed from source or through the package manager have these issues as well.

  • Slow/no critical security updates to apps and runtimes

Depends on who provides/maintains the application. No different than many regular projects and sometimes even distributions.

Since your concern seems to be regarding the integrity of the app itself, I do not believe that these issues apply.

Can you trust GnuCash provided by Flatpak?

I think that this is the core of the question. My answer is very similar to your first provided AskUbuntu link.

Since the Flatpak is linked to from GnuCash's website, it seems to be more or less official, plus the developer is listed as "GnuCash Project". In theory, the code running in the Flatpak image should be nearly the same as that in the official releases. The build process is fairly open; you can see how GnuCash is packaged on GitHub.

This is assuming that Flatpak/Flathub is not malicious (or compromised). I suppose if you wanted, you could verify that the binaries inside the package match "trusted" ones, but it may be quite an undertaking. Entities like Flatpak are likely under a lot of scrutiny from the community, so any major mistakes (especially for a project like GnuCash) will likely not go unnoticed.

But, the question "can I trust vendor XYZ" cannot be answered definitively. We make this decision every time we download software from anywhere.

TL;DR: It is ultimately up to you what software/vendors you trust, but I see no issue with using GnuCash provided through Flatpak.

multithr3at3d
  • 12,355
  • 3
  • 29
  • 42
  • 1
    Thank you so much for this thoughtful answer; much appreciated! Begs the question: can I take your answer as (leaning towards) a "Yes" ? If so, maybe you could edit / conclude your thoughtful answer accordingly? --- PS: Given that GnuCash is open source and pretty alive and kicking / active ("community scrutiny") I feel I can trust it; given your elaborations I take it that consequentially I could also trust GnuCash's flatpak (almost 1:1), right? – nutty about natty May 02 '20 at 20:05
  • 1:1 meaning *if I trust X then I can/should (almost equally) also trust Y*, where X = GnuCash and Y = GnuCash's official Flatpak on Flathub. – nutty about natty May 02 '20 at 20:19