Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Found in the Ubuntu Snap Store

linuxuprising.com

Post reply on HN
Print view View original

91–100 of 223 posts

Re: Malware Found in the Ubuntu Snap Store

#91

Post by matthewbauer »

dtx1 wrote: post #75
eat_veggies wrote: post #24

Earlier quoted context omitted.

I like Arch's package management model, where sources are split into the official repositories, which are manually approved, and the AUR, which everyone knows are not officially endorsed or reviewed, and to check the sources and PKGBUILDS for anything sketchy before installing. The processes for installing from the two are also different enough that the user can't mistake one for the other: official packages are a pa…

Well as a lazy arch user i installed pacaur and just use official and AUR sources without much checking. It's just convenient that there's an AUR for everything

Be warned that malware like this is in the AUR all the time. It's so common it's not even newsworthy. They are usually pretty good at handling it though.

Re: Malware Found in the Ubuntu Snap Store

#92

Post by fjsolwmv »

scarface74 wrote: post #55
colejohnson66 wrote: post #47

Earlier quoted context omitted.

I remember the Facebook app being less than 20 megabytes in size half a decade ago. Now it’s almost half a gigabyte

And for the life of me I can't understand why people use the Facebook app. The mobile web page loads faster, it's automatically sandboxed by being just a browser page and it can do almost anything that the app can do. Besides on iOS at least, if you click on a link from the Facebook web page, you can take advantage of whatever content blocker you have installed.

If you log into Facebook on web, then visit any other site, they send your browsing info to Facebook via Like button.

The Facebook app is more sandboxed, since it can't snoop on your web browsing.

Re: Malware Found in the Ubuntu Snap Store

#93

Post by ChristianBundy »

AsyncAwait wrote: post #77
dtx1 wrote: post #75

Earlier quoted context omitted.

Well as a lazy arch user i installed pacaur and just use official and AUR sources without much checking. It's just convenient that there's an AUR for everything

For packages with many votes this is somewhat fine, but you should still skim the PKGBUILD as the maintainers of even popular packages may change in time.

I'd recommend checking both PKGBUILD and clicking "View Changes" to see who (and what) the last few authors have been up to.

It's relatively common for people to be added as co-maintainers after posting even just one helpful comment (!) in an unpopular package, so it's worth double-checking to make sure a big change hasn't been made recently without the author's permission.

Re: Malware Found in the Ubuntu Snap Store

#94

Post by badsectoracula »

detaro wrote: post #54
aritmo wrote: post #32

Earlier quoted context omitted.

There's not much to do with X without breaking the protocol.

... without additional overhead and engineering effort. You can sandbox an X application by running a dedicated X server in the sandbox and pass only a secured channel out.

No need for that overhead, simply disallow untrustred clients, trusted clients that explicitly request to drop down to untrusted (e.g. browsers could do that) and clients the user explicitly marks as untrusted to access other clients' data. Xorg already has most of this functionality (AFAIK all remote/socket connections can be made untrusted) and last time i heard about it, it is something some X developers are going to look into improving.

This way you don't have any overhead, you preserve backwards compatibility with the protocol, existing programs that need the functionality of accessing each others' data (window managers, panels, tools like xdotool, screenshotting tools, etc) can keep working like they always were and you still get to implement sandboxing (with or without snaps/flatpack/etc) without breaking the Linux desktop.

Re: Malware Found in the Ubuntu Snap Store

#95

Post by scarface74 »

FRex wrote: post #87
scarface74 wrote: post #61

Earlier quoted context omitted.

It would still look quite shady. It's also burning electricity, hogging your CPU and putting heat and stress onto your CPU Like any other Electron based app...

This is false equivalence. The electron app is ostensibly working for your benefit, just in a very inefficient way, not mining a currency using your resources to ship off to someone. You could argue that making users pay for savings in development by their RAM, Disk, CPU, GPU and electricity costs is also bad (and even bad for the planet) but that's a less shady business strategy for saving cost than covertly mining.…

and goes against what Joel Spolsky said about rewrite from scratch[1]

Joel at one time was the product manager(?) for Excel. Microsoft also got lambasted for trying to use an internally built cross platform solution to use the same codebase for Mac Office and Windows Office back in the mid 1990s. Microsoft even decided that it was better to use native tooling for both platforms.

There is a difference between "rewriting" and using native tools for each platform. Would you still want something using Java+Swing?

Re: Malware Found in the Ubuntu Snap Store

#96

Post by shawn »

logane wrote: post #86

Whoa, I made Hextris ( https://github.com/hextris/hextris , one of the games removed from the store) a few years ago! Is there any precedent in OSS developers being held responsible for misuse of their code?

From the license you chose:

The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program--to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.

When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.

Part of the problem with letting people have freedom is that they have the freedom to make decisions that impact communities in a negative way. But it's usually worth the tradeoff.

This is probably the most relevant line though:

For the developers' and authors' protection, the GPL clearly explains that there is no warranty for this free software.

i.e. you have nothing to worry about, but you also probably can't do anything to punish the misuse. After all, misuse is subjective.

Re: Malware Found in the Ubuntu Snap Store

#97

Post by tinus_hn »

foepys wrote: post #14
geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

> Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? As far as I know, Apple is the only company that manually reviews the code of apps, and even they let some (in my opinion) malware through [1]. Everybody else just does some heuristic anti-malware checking and then publishes the app. 1: Uber was perma…

Apple doesn’t get the source code of apps. They check what apis you use so they can prevent you from using non public apis and they run some cursory checks. But there is a lot of crap on the App Store.

Re: Malware Found in the Ubuntu Snap Store

#98

Post by matthewbauer »

avar wrote: post #25
ISL wrote: post #13

Earlier quoted context omitted.

I do tend to believe that the presence of a package in the Debian repositories is a limited representation of quality/review, as there is a package-maintainer and apparent community decision as to whether or not to keep it in the distro. Is that perception correct?

Your perception is entirely incorrect. Debian maintainers don't have the time (or often the knowledge) to review upstream changes. Do you think the Debian Linux, GCC and Xorg maintainers exhaustively review and understand every patch? They don't. Instead, the reason you don't see malware pushed to those repositories is because the incentives in the free software world don't align to make them happen in the first plac…

The particular problem with Snappy is all that's submitted is a single binary blob. Usually with free software source code is submitted & built that has multiple mirrors. That alone can make a big difference.

Re: Malware Found in the Ubuntu Snap Store

#99

Post by badsectoracula »

newnewpdro wrote: post #88

It's only a matter of time before some major successful linux system attack is delivered via snap/flathub. Distributions and their package maintainers serve an important role. In the interests of consuming more & faster people seem to be ignoring that. I wish we had enough resources in the free softare community for all software to be packaged and maintained in the distributions by independent parties unaffiliated wi…

In theory you can have the last bit with flatpack (and perhaps snap), the issue here is auditing what goes in the repositories, not the package format.

Re: Malware Found in the Ubuntu Snap Store

#100

Post by doall »

logane wrote: post #86

Whoa, I made Hextris ( https://github.com/hextris/hextris , one of the games removed from the store) a few years ago! Is there any precedent in OSS developers being held responsible for misuse of their code?

I thought that well known software licenses deal with such concerns.
Post reply on HN