Flatpaks don't necessarily aim to sandbox applications by default. They just give you the platform to DIY in the easiest way possible, esp when coupled with Flatseal. If we really want to criticize Flatpaks for allowing access to /home or x11 for compatibility reasons, then we should do the same to traditional applications which are packaged non-sandboxed with the same permissions anyways. And before you say that this is an issue because of unknown contributors to popular Flatpak applications, verified apps from the project owners themselves ship with these same "express" permissions.
As far as I am concerned, no general purpose OS will ever come hardened to max defaults; which seems to be the standard applied for security here.
Comments
Flatpaks don't necessarily aim to sandbox applications by default. They just give you the platform to DIY in the easiest way possible, esp when coupled with Flatseal. If we really want to criticize Flatpaks for allowing access to /home or x11 for compatibility reasons, then we should do the same to traditional applications which are packaged non-sandboxed with the same permissions anyways. And before you say that this is an issue because of unknown contributors to popular Flatpak applications, verified apps from the project owners themselves ship with these same "express" permissions.
As far as I am concerned, no general purpose OS will ever come hardened to max defaults; which seems to be the standard applied for security here.