In GNOME Software I sometimes see a warning that an app (usually from Flathub) has stopped receiving updates.
How do you evaluate when, or whether, an app is problematic because it is no longer receiving updates?
If it’s connecting to the internet - Yes
If it’s fully offline - No
If it’s fully offline - No
Offline apps can be hacked too. Otherwise there wouldn’t be a reason to update offline apps at all, when a vulnerability is found.
An offline app, running unprivileged in a flatpak sandbox is the last the you should be worrying about.
Offline apps are only concerning when they give the opportunity to pivot, such as SUID apps which would let someone escalate to root.
While code execution via say, a file that is parsed incorrectly is interesting, it would be mitigated by the flatpak sandbox.
Isn’t there a vector through using x11 to read/write keystrokes? An app that is abandoned is likely using x11.
Of course this is entirely hypothetical and requires multiple steps to exploit so, unless you’re doing something extremely sketchy, you shouldn’t worry about it.
Flatpak sandbox is a joke. Offline apps get hacked too. You should always update offline apps, regardless of Flatpak or not, if there is a vulnerability. Please don’t tell people not to update, because they think it would be secure to leave any vulnerability open.
Flatpak sandbox is more than enough to protect the average user against an app that is no longer receiving updates.
It’s not. If there is a vulnerability, the Flatpak sandbox is just an illusion. It does only work, if everyone plays with its rules, but if you want exploit it, you can exploit it regardless of a vulnerability. Its not a safe sandbox. And if your application needs a security patch, its even worse.
To be clear here, OP is mentioning that certain apps they are using no longer receive updates. Updating these apps are not an option. I’m not telling people not to update.
But I also think that telling people not to use apps that are no longer receiving updates is unreasonable, especially if those apps don’t touch the network and are confined within the flatpak sandbox.
If the app doesn’t receive updates, doesn’t make it less risky to use. I just ask not to tell people that its secure to use these apps. Anyone can judge themselves if the risk is worth it, but everyone should know its not secure.
Threat models. I’m not going to care about an attacker both exploiting a niche app via a malformed file and also finding a 0day in the flatpak sandbox (which will be receiving continual updates). If someone can whip both of those up, while also predicting that I will open this file, or somehow feeding it to me, they are well resourced enough that it would take way, way more effort than just updating to stop them.
That’s your call if you want to do it or not. As long as you know the risks. Just because you don’t care doesn’t make it less risky.
This is a very unsatisfying “it depends” situation. Is there any app in particular you’re looking at?
Some - yes. Others - no.
If it’s an internet-facing thing, it probably has security holes in it, so a trickle of fixes is reassuring.
If it’s a game, it might just be complete, finished and done (think chess), or it might get occasional content updates (moar different kinds of swords!) or it might get the occasional bugfix or a port to a new platform.
It’s OK, in my eyes, even desirable, to be feature complete, and to have no bugs.
Software is never finished, because the entire eco system is evolving. It could be problematic, if the libraries it depends on changes and the program doesn’t work correctly or doesn’t start. In worst case vulnerabilities need to be patched could leave a door open to be attacked.
If it’s an internet-facing thing, it probably has security holes in it, so a trickle of fixes is reassuring.
Offline tools can have security issues too.
You’re delving into the unpleasant realm of risk assessment. How likely is the app going to be targeted by a threat actor, and how badly could they use it to damage your data or system?
If it’s a public facing service, I’d immediately check if I have alternative applications I could migrate too. Any hold an outsider gets through the public facing app could be used to pivot further into my network.
If it’s something that doesn’t interact with the network at all, then I wouldn’t worry nearly as much, but might look for alternatives any just because I know this isn’t going to get improved at all. Somewhere in the middle, you need to decide how much risk you can accept.
