GNOME has been something I have started to admire in a way. They have a clear vision for the things they are creating, and usually implement their ideas rapidly with a certain amount of polish being almost guaranteed. However, despite this, there is something that I simply don't get with one of their applications: GNOME Software and it's Security Reports

On paper, it sounds great! You get a quick glance at whether an app is safe — especially concerning your data — and can get more information on why it's showing you that rating simply by clicking on it. Though, it all begins to fall apart really quickly when apps like Element get flagged as insecure for information that is either outdated, or just incorrect.

I'll take Element as an example.

For the unaware: Element is an Open Source Matrix client which is relatively popular and should be known by most Matrix users — even if that means just having heard of it.

One thing that Element does well is support the Linux desktop, with native wayland support pretty much out of the box. This does include screensharing and a lot of other things that some other applications still haven't fixed at this point. (Talking about you, Discord.) However, on GNOME Software, it's marked as "using a legacy windowing system", or in other words: It supposedly only supports X11. Not only is this false, but also does this immediately mark the app as "Unsafe" in it's entirity, completely disregarding most other points.

Let's take another example: Firefox. Firefox is available on Flathub, and thus also has some metadata that gets fetched from GNOME about the app, but despite things like downloading files or joining a video call on your favourite chatting platform being functions of the program, and Firefox having in-built website permissions that allow you to control things like camera and microphone usage, GNOME immediately states it is "unsafe" again. They list "Device Access", "Download Files" and once again "Legacy Windowing System" as reasons for having it listed as unsafe, even though (again) Device access is controlled by the user and downloading files is core functionality of the app, and (again) the claim that it doesn't support Wayland by saying it uses a "Legacy Windowing System" is untrue as Firefox supports wayland just fine when MOZ_ENABLE_WAYLAND=1 is set on your system.

The Fix: More "dynamic" Security Reports

Now, to fix this, I propose "Dynamic" Security Reports.

Right now, GNOME takes it's security reports and other metadata from themselves, which is (as far as I'm aware) provided by contributors which put in the information using the "Add missing information" button within GNOME software.

However, I would find it much more useful if GNOME Software first queried Flatpak permissions that it uses by default to get a good sense of what the app could do, and then let contributors add context to the generated Security Reports. For instance, Firefox wouldn't immediately be regarded as "Unsafe" because it supports X11 or because it allows for Device Access, as those features can be regulated and are core functionality of the app. So a contributor would add context to the permission, which would give more info on why it is used, and that would also affect the rating the application would get and would be shown within the Security Reports dialog.
(I would put some sort of mockup here, but I really suck at mockups lol)

Of course, the context wouldn't have to be a custom string for each app, but could be chosen from a predefined set of options if that's desired.

---

Thanks for reading! I wish you a good rest of the day, evening, night, or whatever other time you're reading this!