I found a flatpak available for ffs, but afraid to use it because it's unclear if it's official (trustworthy). The username associated with it suggests it's official. But, the lack of reference to it as an available download on ffs's download page generates reasonable caution (I suppose anyone could register on flathub with that username?).
If you're going to go to the trouble of creating a flatpak version of ffs, why not show that on the downloads page so it's more discoverable? But, for me, it's a trust thing. I have no way of knowing if the randomly found flatpak is legit. (I've seen pretexts of other things, so this raises flags for me.).
The reason this is an issue for me is that I use MX linux. That distro is different than others in discouraging the customary "ppa" installation of 3rd-party software. That can break MX. You distribute ffs as a .run file which is safe(r) in this context. I think the flatpak would be even safer for MX's more-curated install environment. If I were on another distro, I wouldn't give it a second thought (I'd use the available .run download). Since I'm on MX (which is more curated, susceptable to breakage by app installs outside their "package manager"), this disconnect between available downloads stands out to me.
It would be useful if the flatpak were listed as an available install. I remember there was a bout of accusations that ffs contained malware. I can see how a rogue flatpak download could be the source of something like that. Since ffs has experienced that reputational damage, it seems like ffs would not put users in a position to trust the flatpak (if it's indeed trustworthy).
Thank you for your consideration.
Please add flatpak to downloads page
- Posts: 14
- Joined: 20 Oct 2016
-
- Posts: 2982
- Joined: 22 Aug 2012
- Posts: 14
- Joined: 20 Oct 2016
I think it would be helpful if it said that on the downloads page (or on the flathub page where the flatpak is).
Something seems amiss when you find a flatpack on flathub with ffs's owner's username (seemingly official), but not an official download here. Given the period I mentioned (when there were reports of malware being distributed in ffs), it raises some concern. I'm still unclear if that's counterfeit or legit (just not supported here).
It would help if the flathub page warned that it's not supported (that would be the most direct place to say it). But, I think it would also help to list it on the official downloads page as legit, but not supported. The way it is now, there's no way to know either question. That doesn't seem good (especially the previous history of people receiving malware somehow). It would be easy to clear up just with some information.
Something seems amiss when you find a flatpack on flathub with ffs's owner's username (seemingly official), but not an official download here. Given the period I mentioned (when there were reports of malware being distributed in ffs), it raises some concern. I'm still unclear if that's counterfeit or legit (just not supported here).
It would help if the flathub page warned that it's not supported (that would be the most direct place to say it). But, I think it would also help to list it on the official downloads page as legit, but not supported. The way it is now, there's no way to know either question. That doesn't seem good (especially the previous history of people receiving malware somehow). It would be easy to clear up just with some information.
- Posts: 4914
- Joined: 11 Jun 2019
It says unverified on Flatpack for a reason, who knows the real source
-
- Posts: 2982
- Joined: 22 Aug 2012
FreeFileSync or Zenju (the author and site-admin of THIS site) are not responsible for whatever is placed on the flathub site (or any other site, for that matter).It would help if the flathub page warned that it's not supported (that would be the most direct place to say it).
So you should direct your complaint there, not here.
- Posts: 14
- Joined: 20 Oct 2016
Oh, now I understand. That's exactly the sort of problem I was worried about. Someone created a flathub ID as Zenju. The appearance is that it's official, but it's not. That's how complaints of malware happen. (If you don't mind me saying so, the response should've been "that's not ours" instead of "that's not supported here." The latter implies that's really Zenju, but there was no intent to support it. Just a "maybe it will work for you." The latter implies "that's how malware gets attributed to us.").
Personally, I think Zenju should ask Flathub to take it down since it's obviously impersonating him (trying to gain cred as being posted by him). Or, put something on the download page saying "if you find something else somewhere else, like this flatpak claiming to be posted by the owner of ffs, it's not legit."
I don't know how far is far enough to protect users. But, there's been complaints (rumors?) in the past of malware. It seems like it would be good to avoid more such confusion. (The take on it here seems "no big deal." If it was a username "Fred Smith" I could kind of understand being dismissive of it. But, this looks sketchy AF when the user name is Zenju. I think that deserves some calling out either to flathub or on the download page.).
I hope this topic helps. Thanks!
Personally, I think Zenju should ask Flathub to take it down since it's obviously impersonating him (trying to gain cred as being posted by him). Or, put something on the download page saying "if you find something else somewhere else, like this flatpak claiming to be posted by the owner of ffs, it's not legit."
I don't know how far is far enough to protect users. But, there's been complaints (rumors?) in the past of malware. It seems like it would be good to avoid more such confusion. (The take on it here seems "no big deal." If it was a username "Fred Smith" I could kind of understand being dismissive of it. But, this looks sketchy AF when the user name is Zenju. I think that deserves some calling out either to flathub or on the download page.).
I hope this topic helps. Thanks!
