feat: Update FLATPAK with info about Flatpak Browsers.md

content/articles/FLATPAK.md

@@ -35,3 +35,8 @@ Note that this will not only undo the `ujust flatpak-permissions-lockdown` comma
 ```
 ujust harden-flatpak
 ```
+Part of flatpak's security model involves [denying user namespaces](https://forum.vivaldi.net/topic/33411/flatpak-support/191) [via SECCOMP-BPF](https://www.kernel.org/doc/html/v4.19/userspace-api/seccomp_filter.html) [to flatpaks, including flatpak browsers](https://discussion.fedoraproject.org/t/is-it-better-to-have-a-browser-sand-boxed-with-flatpak-or-not/162425/17). This is one way to isolate them from the system & other apps by preventing them from reaching certain kernel code paths that they would otherwise not be able to as unprivileged processes but breaks their sandboxing layer responsible for site and process isolation, leaving only [Zypak](https://github.com/refi64/zypak) + SECCOMP-BPF + [additional patches](https://github.com/flathub/org.chromium.Chromium/blob/master/patches/chromium/flatpak-Add-initial-sandbox-support.patch) in its place; or in the case of Firefox/Gecko-based browsers, [outright disables most sandboxing processes entirely by having no Zypak equivalent](https://bugzilla.mozilla.org/show_bug.cgi?id=1756236). The sole known exception to this being the GNOME Web/Epiphany flatpak, whose site isolation is [notably weaker](https://github.com/RKNF404/chromium-hardening-guide/blob/main/pages/BROWSER_SELECTION.md#epiphanywebkitgtk) in comparison to the implementations in native Chromium-based & Gecko-based browser packages.
+
+Therefore we've kept hidden flatpak browsers (aside from GNOME Web) from view on the software store frontends including [recently](https://github.com/secureblue/secureblue/pull/1898) on Bazaar to discourage their usage and directing the user to Trivalent.
+
+We have interest in shipping Trivalent as a flatpak in the future nonetheless for more availability but not until a solution like [nested namespaces](https://github.com/flatpak/flatpak/pull/6386) becomes usable to allow the browser to perform the necessary syscalls to execute its sandboxed processes properly.