Nice case study in why Arch types are adament that you should properly take the time to read your PKGBUILDs.
Malware Found in the Ubuntu Snap Store
11–20 of 223 posts
Re: Malware Found in the Ubuntu Snap Store
#12Apple's strategy for their store looks better and better every day.
I prefer the BSD port system.
Re: Malware Found in the Ubuntu Snap Store
#13There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…
I do tend to believe that the presence of a package in the Debian repositories is a limited representation of quality/review, as there is a package-maintainer and apparent community decision as to whether or not to keep it in the distro.
Is that perception correct?
Re: Malware Found in the Ubuntu Snap Store
#14There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…
> Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are?
As far as I know, Apple is the only company that manually reviews the code of apps, and even they let some (in my opinion) malware through [1]. Everybody else just does some heuristic anti-malware checking and then publishes the app.
1: Uber was permanently fingerprinting devices, even though Apple was disallowing this kind of tracking in their ToS.
Re: Malware Found in the Ubuntu Snap Store
#15Nice case study in why Arch types are adament that you should properly take the time to read your PKGBUILDs.
Arch makes it clear for users that AUR packages are not official.
Ubuntu snaps very easily installable, just a quick command away, which can give users a false sense of security.
Re: Malware Found in the Ubuntu Snap Store
#16The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…
The issues with X11 you mention is part of what Wayland tries to fix. And why early on seemingly benign things like screenshot tools broke.
Re: Malware Found in the Ubuntu Snap Store
#17There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…
I do tend to believe that the presence of a package in the Debian repositories is a limited representation of quality/review, as there is a package-maintainer and apparent community decision as to whether or not to keep it in the distro. Is that perception correct?
Every line of code should have been reviewed by at least one DD. But the system is self policing, so it's hard to guarantee that that's the case. But Debian certainly leans towards being a curated collection of software rather than a wild west.
Re: Malware Found in the Ubuntu Snap Store
#18There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…
Ever since I learned about it and then read up on it Anaconda has been my go-to way of using Python. Python packaging is a huge mess.
Re: Malware Found in the Ubuntu Snap Store
#19It's too bad there isn't some sinister cabal of trusted individuals within the Ubuntu project that can review packages for quality and package them securely and in an auditable fashion.
Re: Malware Found in the Ubuntu Snap Store
#20This is exactly why you should not run random docker images and snaps. Docker images are also run as root in many cases. It is better to build app images from scratch and understand what exactly goes into the image.
People tend to take docker images at roughly the same level of audit as a large open source package installed from their favorite repository without realizing that those two things are entirely different.
They feel it is a convenient binary distribution format for software.