Hi, there!
Newbie question here: basically, the title. Perhaps what I’m asking is pretty obvious, but I’d like to double-check with the community on this.
I use Discover on my Debian KDE Plasma set-up, with Flatpaks enabled (but not Snaps). Sometimes, I come across apps (I did just yesterday, searching for translation apps to replace DeepL), that have according to its page, an unknown author and, sometimes, even an unkown licence, but which do require access permission to the whole system (this latter requirement applying specifically to Deb packages, from what I’ve seen).
Under these circumstances, is it safe to assume that such apps will still be safe because of the fact that they appear listed on Discover (in other words, is Discover a guarantee of safety for the apps it shows, as in, some type of checked or proved content), or should I still be wary of potentially malicious software included on it?
Thank you very much in advance :)
Thanks for joining the conversation and help make things clear. This does help; so, basically, not having manually enabled anything else than Flathub/Flatpaks on Discover, and having Debian’s repository already, I am fine as long as I install programmes from either of those two.
I would say you are more than likely fine, malicious code does occasionally sneak into Debian distributed apps but you’ll likely never encounter something that is outright fraudulent or a scam.
Do you have an example of this? The xz utils backdoor did not make it into debian stable, only unstable.
Debian stable essentially forks every package, maintaining a custom codebase. They then cherry pick security updates only (ignoring feature updates or minor bugfixes), and applying those. This makes it extraordinarily resilient to any form of supply chain attack.
Yes, you’ve got it 👍
You can basically just treat everything available in Discover as good, because everything there will either be from Debian or from Flathub.
I’m on Debian 13 too but have the GNOME desktop environmet.