{
  "id": 15558220,
  "title": "A response to claims about flatpak being insecure",
  "url": "https://urgent.news/2026/10/19/a-response-to-claims-about-flatpak-being-insecure",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-19T04:02:34.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://oro.gay/posts/flatpak-an-insecurity-nightmare/"
  },
  "original_language": "en",
  "account": "For over 20 years, Linux has been used in various systems, but it has struggled to gain a foothold in the desktop space. Windows and macOS have been the dominant players, with gaming primarily on Windows and content creation on macOS. However, the last decade has seen significant improvements in the Linux desktop, thanks to technologies like Flatpak, Wayland, Portals, PipeWire, and FreeDesktop. This discussion, however, will focus on Flatpak.\n\nIn server environments, it is common to find systems running outdated kernels and libraries. This is understandable, as long boot times and the risk of breakage on every system update can lead to valuable uptime being lost. To address this, containers were developed, allowing software to be isolated with its dependencies, limited access to the host system, and minimizing the impact of updates.\n\nFlatpak was introduced in 2015, taking containerization technology and applying it to the desktop. It introduced Portals and the Freedesktop SDK, creating a consistent and generic platform and API for developers. This was a substantial change from the previous landscape of varying dependency versions, core system libraries, and packaging formats. Initially, many developers and users resisted this change, preferring the old methods and manually repackaging software for numerous systems. Modern application developers, however, are designing apps with a confined environment in mind and shipping them to Flathub, providing a fast and secure way for end-users to access software.\n\nOlder applications, however, remain available on Flathub. Some have led to articles claiming that Flatpak is a security nightmare, with developers cherry-picking the worst offenders and suggesting that the Flatpak sandbox is not secure. This argument is misleading, as these applications were designed with an unconfined environment, and their APIs either didn't exist or were not updated to use the new Flatpak API. This does not reflect the security of the Flatpak sandbox itself.\n\nThe applications are not the only issue. Some newer applications may also rely on static permissions due to the maturity of the new APIs. While this is acceptable for most newer applications, older apps may struggle with the new system. Flatpak remains a sandbox, and it is secure. The problem lies with the applications, not the sandbox. It is essential to focus on improving these applications rather than dismissing the Flatpak sandbox. As the article notes, using PrismLauncher Flatpak and being cautious with permissions can provide a robust level of security on Linux systems.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}