this post was submitted on 30 Oct 2026
32 points (100.0% liked)
Linux
68475 readers
431 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
If it's connecting to the internet - Yes
If it's fully offline - No
As soon as it reads files etc. it can be impacted as well.
Offline apps can be hacked too. Otherwise there wouldn't be a reason to update offline apps at all, when a vulnerability is found.
An offline app, running unprivileged in a flatpak sandbox is the last the you should be worrying about.
Offline apps are only concerning when they give the opportunity to pivot, such as SUID apps which would let someone escalate to root.
While code execution via say, a file that is parsed incorrectly is interesting, it would be mitigated by the flatpak sandbox.
Isn't there a vector through using x11 to read/write keystrokes? An app that is abandoned is likely using x11.
Of course this is entirely hypothetical and requires multiple steps to exploit so, unless you're doing something extremely sketchy, you shouldn't worry about it.
Flatpak sandbox is a joke. Offline apps get hacked too. You should always update offline apps, regardless of Flatpak or not, if there is a vulnerability. Please don't tell people not to update, because they think it would be secure to leave any vulnerability open.
Flatpak sandbox is more than enough to protect the average user against an app that is no longer receiving updates.
It's not. If there is a vulnerability, the Flatpak sandbox is just an illusion. It does only work, if everyone plays with its rules, but if you want exploit it, you can exploit it regardless of a vulnerability. Its not a safe sandbox. And if your application needs a security patch, its even worse.
To be clear here, OP is mentioning that certain apps they are using no longer receive updates. Updating these apps are not an option. I'm not telling people not to update.
But I also think that telling people not to use apps that are no longer receiving updates is unreasonable, especially if those apps don't touch the network and are confined within the flatpak sandbox.
If the app doesn't receive updates, doesn't make it less risky to use. I just ask not to tell people that its secure to use these apps. Anyone can judge themselves if the risk is worth it, but everyone should know its not secure.
Threat models. I'm not going to care about an attacker both exploiting a niche app via a malformed file and also finding a 0day in the flatpak sandbox (which will be receiving continual updates). If someone can whip both of those up, while also predicting that I will open this file, or somehow feeding it to me, they are well resourced enough that it would take way, way more effort than just updating to stop them.
That's your call if you want to do it or not. As long as you know the risks. Just because you don't care doesn't make it less risky.
Less risky than what? Many apps in flatpak are small hobby projects. Do you think most solo devs who do that for a hobby have a security process? Even if they release new versions weekly you have zero idea how they make use of third party libraries and if they keep them updated and you have no idea about their own code that probably no one audits.
That's a different security issue you talk about, about a specific constructed case with hobby projects who don't care or know security. What I'm talking about is a general security issue regardless of who or what it is, that is based on outdated and no longer supported applications. Don't argument with something else, to justify your point, because I'm not arguing that everyone knows what they are doing. My point is only about updating and outdated stuff, that you are willingly use.
Technically yes, but the access someone would need to make use of that vulnerability would be pretty significant I'd think, and at that point you're probably hosed in many other ways too.
Doesn't matter. It's a vulnerability and if you want to use out of date programs that could be used to attack, its a choice YOU make. The important thing is, that any reader here comes away knowing that. I'm not making judgement of you using it or not, just clarifying, because this is important.