More emphasis on immutable distributions

[jonaharagon]

If a person can exclusively use Flatpaks (which, face it, most desktop users can) I think we should be encouraging them to use Fedora Silverblue. It's actually better for less technical users because it eliminates common headaches with desktop Linux (updates failing or breaking other packages, and the ease with which you can screw up your system).

Silverblue kind of exists in this weird state where it's great for non-technical people (mainly web browser usage), not so great for people with some Linux experience (who probably like to tweak their machine or run more advanced software and would be better served by Fedora Workstation), and then great again for very Linux experienced users (for entirely different reasons). But personally, if I were installing Linux on my mom's computer for example, I'd probably go with Silverblue. It also has a security model more similar to Android than traditional desktop operating systems, which is good.

Basically I'd probably want to rearrange the Linux page to display them first, and include some of the above information highlighting the benefits for less technical users. Thoughts?

[TommyTran732]

There are problems with this.

1. Flatpak sandboxing is weak and cannot compare to Android. Access control with it is not granular at all, and the default permissions most Flatpak packages have are extremely laxed. To make matters worse, a malicious maintainer can just add filesystem=host after an update and if the user is not on the look out for it and update their overrides, it will automatically grant the Flatpak package access to the entire filesystem. There is also the problem with hard coded /proc access and a weak syscall blacklist as well.
2. As far as I have heard, Flatpak prevents the Chromium sandbox from working properly, so they have to switch Zypak, which is Flatpak's own sandbox and is weaker than the original Chromium sandbox that it replaces.
3. You can't reasonably expect new users to know what things like the pulseaudio socket, freedesktop secrets dbus, x11 socket even mean to configure their Flatpak overrides properly. There are also a lot of nuances that goes into whether to grant an app filesystem access at all, because some apps do work nicely with portals and don't need direct filesystem access.
4. Using Silverblue requires the user to know how to use Fedora first. There are some basic operations that cannot be done using rpm-ostree at all (like package look up), so the user has to use a Toolbox container for that instead. To use a Toolbox container, the user must at least have some vague idea of how Fedora workstation works in the first place. NixOS on the other hand seems rather complicated and I don't think your mom could use it at all.
5. Even a Silverblue + Flatpak combo is still more traditional desktop operating systems than Android. It is not even nearly as good as macOS, IMO.

[d4rklynk]

Basically I'd probably want to rearrange the Linux page to display them first, and include some of the above information highlighting the benefits for less technical users. Thoughts?

Let's face it, if I needed to install an OS on my parent's computer it will be totally Windows.

• First of all, most people don't care about privacy.
• Second of all, IMHO most people that come on PG - and really read it - are already into privacy (so not really less-technical users).
• Last thing last, if someone really wanna try linux, he'll google "Best Linux ever" and find Linux Mint, Pop_OS, Ubuntu, and probably Fedora. What I mean is as a regular human living on earth you will always choose the most obvious and well-known choice. Which is Fedora in that case.

I think Fedora should stay at the exact same place on this page.

About Flatpaks, I use it a lot with Fedora and IMO they're not always working really well, for example discord is kinda slow. I prefer RPM.
If I would be a less-technical, I would choose the default one which is RPM, because RPM is meant for Fedora.

[dngray]

I disagree with giving immutable distributions a higher place on the page.

There are some drawbacks to using them one example I can think of currently is compatibility with VPN apps mullvad/mullvadvpn-app#1570 ivpn/desktop-app#86.

Currently only ProtonVPN works properly.

There can also be issues related to signing of binary driver kernel modules such as NVIDIA.