On: Flatpak: A security nightmare – two years later

[AnIdiotOnTheNet]

Not just the software vendor, but also the third party package maintainer, often an unpaid volunteer.

[sergeykish → AnIdiotOnTheNet]

It is not that simple [1], one need to earn trust. Distribution maintainers have much better record than browser addons authors.

Maybe we can trust big names, just like on Android — Google, Amazon. We may think that it is safer with paid software — they have something to loose. But free - I'd bet on maintainers.

[1] https://wiki.archlinux.org/index.php/Trusted_Users