In GNOME Software I sometimes see a warning that an app (usually from Flathub) has stopped receiving updates.
How do you evaluate when, or whether, an app is problematic because it is no longer receiving updates?
In GNOME Software I sometimes see a warning that an app (usually from Flathub) has stopped receiving updates.
How do you evaluate when, or whether, an app is problematic because it is no longer receiving updates?
Threat models. I’m not going to care about an attacker both exploiting a niche app via a malformed file and also finding a 0day in the flatpak sandbox (which will be receiving continual updates). If someone can whip both of those up, while also predicting that I will open this file, or somehow feeding it to me, they are well resourced enough that it would take way, way more effort than just updating to stop them.
That’s your call if you want to do it or not. As long as you know the risks. Just because you don’t care doesn’t make it less risky.
Less risky than what? Many apps in flatpak are small hobby projects. Do you think most solo devs who do that for a hobby have a security process? Even if they release new versions weekly you have zero idea how they make use of third party libraries and if they keep them updated and you have no idea about their own code that probably no one audits.
That’s a different security issue you talk about, about a specific constructed case with hobby projects who don’t care or know security. What I’m talking about is a general security issue regardless of who or what it is, that is based on outdated and no longer supported applications. Don’t argument with something else, to justify your point, because I’m not arguing that everyone knows what they are doing. My point is only about updating and outdated stuff, that you are willingly use.