How to be certain that games or other apps in the SteamOS Discover center are legitimate?
When you launch the Steam Deck in desktop mode, the UI by default contains a shortcut to something called "Discover Software Center". My experience with Linux-based system is very limited, but I am aware that most distributions have a sort of software center or package manager like this, comparable to an app store. I have read that each Linux distribution has its own repository of games and applications, so I'm assuming the same is true for SteamOS. What I don't understand however, is how these repositories are managed and curated. Does the team or company behind the OS manually verify everything on it, or could theoretically anyone pose as the developer of some popular software and submit something malicious to appear in there?
The specific case that brought this question up for me is when I wanted to install Discord on the Steam Deck. I found it in Discover, but the app's description says "This wrapper is not verified by, affiliated with, or supported by Discord Inc." This has me confused, and there doesn't seem to be any further clarification about this. I am aware of third party clients for apps like Discord existing, but how can I be certain this won't steal my login details, or secretly run other things in the background that I may not want? Similar concerns apply to other games and programs.
Can anything in the Discover center be blindly trusted to be safe? If so, why, and if not, how would you make sure?
Best Answer
The idea behind services like this is "crowd sourcing". People can share something others can use, and any users are expected to trust what they use. Well-organized crowd-sourced services tend to make it pretty easy to contribute though they usually have lots of rules about what can be submitted. And there's usually volunteer community policing of the content that's done by both regular users and those who are moderators or admins.
ClamAV (and likely others) can at least scan flatpaks after install. Consider this Reddit comment though (edited for clarity, length):
By default system folders are not accessible by the container that runs the flatpak app. You can customize permissions if you don't trust the maintainer (Flatseal is a useful tool for this). For instance, I create a strict policy (no network, only has access to a specific directory, etc). The other question this brings up is what is safer: An "official" package that has full access to your system, or an "unknown" package that lives by default in a container?
In the end it's up to each user to avoid, "trust but verify", or lock apps into their own little world and consider it "safe enough" if you can't verify whether they're trustworthy. There are communities like Flathub on Discourse and /r/flatpak on Reddit which would be good for discussing specific apps, and the Steam Deck communities could also be good as it concerns them in particular and there's going to be plenty of knowledgeable users with them who will be glad to help.
Pictures about "How to be certain that games or other apps in the SteamOS Discover center are legitimate?"
Do all games work on SteamOS?
Less than 15 per cent of all games on Steam officially support Linux and SteamOS. As a workaround, Valve had developed a feature called Proton that allows users to run Windows natively on the platform.What Steam games run on SteamOS?
- Baldur's Gate II: Enhanced Edition. $19.99. ...
- BioShock Infinite. $29.99. ...
- Borderlands 2. $19.99. ...
- Guacamelee!: Gold Edition. $14.99. ...
- Mark of the Ninja. $14.99. ...
- Out of the Park Baseball 2016. $39.99. ...
- Sid Meier's Civilization V. $29.99. ...
- Shovel Knight. $14.99.
What package manager does SteamOS use?
SteamOSSteamOS 3.0 "holo" with the default KDE Plasma 5 desktop running on the Steam DeckUpdate methodAPT (versions 1.0 and 2.0), RAUC (version 3.0)Package managerdpkg (versions 1.0 and 2.0), pacman, flatpak (version 3.0)Platformsx86-64Kernel typeMonolithic (Linux)13 more rowsIs SteamOS still a thing?
Is Steam OS Actively Maintained? Yes and No. SteamOS is based on Debian 8 for a long time now with no updates whatsoever. So, if you are looking to install it on your personal machine, the version available to the public (SteamOS 2.0) is not actively maintained.Steam Deck: How to run Windows exe games/applications in SteamOS
Sources: Stack Exchange - This article follows the attribution requirements of Stack Exchange and is licensed under CC BY-SA 3.0.
Images: Samson Katt, Samson Katt, Tatiana Syrikova, Hasan Albari