flathub / io.freetubeapp.FreeTube

https://flathub.org/apps/details/io.freetubeapp.FreeTube
15 stars 10 forks source link

Idea: Moving to nightly Freetube builds #98

Open JoshuaMacklin opened 9 months ago

JoshuaMacklin commented 9 months ago

With respects to Electron 22.3.25 / Chrome 108 being pretty out of date and the security implications of running said older versions.

Would there be interest in moving the flatpak over to the Nightly builds where updates are much more frequent? or maybe perhaps a new Freetube(Nightly) Flatpak.

bbhtt commented 9 months ago

Flathub has a no nightly policy since late 2021-22. Nightly flatpaks are best suited to be served and hosted by the project.

efb4f5ff-1298-471a-8973-3d47447115dc commented 9 months ago

Upstream issue: https://github.com/FreeTubeApp/FreeTube/issues/2225

absidue commented 7 months ago

@JoshuaMacklin I don't want to downplay the security implications, but the only way you would have an issue with FreeTube is if your computer was already infected or if you decided to manually configure FreeTube to use a malicious Invidious server, that some how managed to run unsafe code in FreeTube. I'm not saying there is no risk, just that you would have had to have screwed up something outside of FreeTube or go out of your way to mess something up for yourself, to have a security issue with FreeTube.

Also the nightly builds are pre-release/testing versions, they are not meant to be used by most users, they are only intended to be used by people that want to test stuff before it is released and are willing to accept that things could break completely from one nightly to another, including data loss. So I would personally be against making it easier for people to install the nightly versions.

So TL;DR flatpak should keep using the normal FreeTube releases, as that is what most users should be using. The nightlies are very much a "use at your own risk" thing.

boredsquirrel commented 6 months ago

Yes, using a prerelease is not a good option to get newer Electron. They should simply update their stable one