Malware Found in the Ubuntu Snap Store • Hacker News Board

Re: Malware Found in the Ubuntu Snap Store

#111

Post by mihaifm » Sat, May 12, 2018, 9:42 PM UTC

matthewbauer wrote: post #89

mihaifm wrote: post #73

Can anyone clarify if this is a possibility for apt packages as well? As far as I understand, there are 4 types of apt repositories (for Ubuntu): Main, Universe, Restricted, Multiverse. I guess Main is safe since it's handled by Canonical, but the rest? Moreover, a lot of installers simply add a custom repository to sources.list. What are some good practices for a novice user, regarding apt?

So, most source-based package managers are going to have higher standards & catch something like this. Not every line is going to be audited, but demanding free licenses, active git repos, and wide userbase goes a long way to keep stuff clean. Obviously many valuable packages are left out & you will be tempted to install the .deb files. I would say if you are at all concerned about safety: don't install apps through…

Indeed, building from source is falling out of fashion, with everyone creating a package manager these days. I find some of these very opaque, for example Rust has it’s own package manager which downloads and runs binaries at its own discretion.

https://github.com/rust-lang-nursery/rustup.rs

Re: Malware Found in the Ubuntu Snap Store

#112

Post by kpcyrd » Sat, May 12, 2018, 9:42 PM UTC

foepys wrote: post #14

geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

> Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? As far as I know, Apple is the only company that manually reviews the code of apps, and even they let some (in my opinion) malware through [1]. Everybody else just does some heuristic anti-malware checking and then publishes the app. 1: Uber was perma…

Firefox addons are reviewed. That's why malicious firefox addons are a lot less common than malicious chrome extensions.

Re: Malware Found in the Ubuntu Snap Store

#113

Post by viraptor » Sat, May 12, 2018, 9:42 PM UTC

fjsolwmv wrote: post #92

scarface74 wrote: post #55

Earlier quoted context omitted.

And for the life of me I can't understand why people use the Facebook app. The mobile web page loads faster, it's automatically sandboxed by being just a browser page and it can do almost anything that the app can do. Besides on iOS at least, if you click on a link from the Facebook web page, you can take advantage of whatever content blocker you have installed.

If you log into Facebook on web, then visit any other site, they send your browsing info to Facebook via Like button. The Facebook app is more sandboxed, since it can't snoop on your web browsing.

The like button can't track you if you block it ;-)

Re: Malware Found in the Ubuntu Snap Store

#114

Post by alsadi » Sat, May 12, 2018, 9:45 PM UTC

faho wrote: post #70

alsadi wrote: post #41

Unlike flahub where either original develop or flathub admins take control Canonical's Snapcraft literally says "Get published in minutes" Any random guy would publish his malware with near no review https://dashboard.snapcraft.io/snaps/ Yes, they maybe win the counter for published apps compared to flathub. Congratulations!

> Unlike flahub where either original develop or flathub admins take control Is this actual policy? How do they determine who is the original developer?

By reaching them via official website/email. You are aware that most software have official website, have readme with some copyright note, some authors file...etc

Yes, it's a policy Quote

If there’s an app that you'd like to be distributed on Flathub, the best first course of action is to approach the app’s developers and ask them to submit it.

https://github.com/flathub/flathub/wiki/App-Submission

Re: Malware Found in the Ubuntu Snap Store

#115

Post by madrox » Sat, May 12, 2018, 9:50 PM UTC

geofft wrote: post #9

There is no review process or central restrictions on who can upload to the Ubuntu Snap Store, so in a sense, this isn't surprising. https://docs.snapcraft.io/build-snaps/publish Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? Or does its presence in the software center app imply a connotation that i…

The lesson I learned from this comment is "if you assume security, you won't get security."

Re: Malware Found in the Ubuntu Snap Store

#116

Post by alsadi » Sat, May 12, 2018, 9:50 PM UTC

evand wrote: post #110

matthewbauer wrote: post #105

Earlier quoted context omitted.

I really don't see the use case at all for Snappy. I mean FlatPak makes sense for devs who want to "package- once, run everywhere", but Snappy is Ubuntu-only. The thing is Ubuntu through Debian is really good at having lots of up-to-date packages. Why abandon that for some crummy app store?

The "Users by distribution" table at the bottom of the Spotify page is worth a look: https://snapcraft.io/spotify Snaps are not Ubuntu-only. You can find install instructions for many distros here: https://docs.snapcraft.io/core/install

Snap is a proprietary format that is canonical-centric, don't tell me that the community make choice to make client opensource but official store both hardcoded (initially) and closed source.

On the other hand,flatpak is a freedesktop project, done using open standards like OCI and ostree.

Re: Malware Found in the Ubuntu Snap Store

#117

Post by scarface74 » Sat, May 12, 2018, 9:58 PM UTC

FRex wrote: post #106

scarface74 wrote: post #95

Earlier quoted context omitted.

and goes against what Joel Spolsky said about rewrite from scratch[1] Joel at one time was the product manager(?) for Excel. Microsoft also got lambasted for trying to use an internally built cross platform solution to use the same codebase for Mac Office and Windows Office back in the mid 1990s. Microsoft even decided that it was better to use native tooling for both platforms. There is a difference between "rewriti…

Why not? Is Java + Swing very heavy or something? Is NetBeans in Swing or something else? I've used NetBeans for C, C++, PHP and HTML5 on my old Core 2 Duo with 2 Gigs of RAM on Fedora during my uni years and it was fine by me. It lagged some but on that machine everything lagged and it was a full on IDE (not just a code editor) with some really nice features.

A Core 2 Duo should not lag running an IDE. I ran Visual 2008 on a Core 2 Duo with Sql Server running and it had 4GB of RAM.

Netbeans and almost every other Java IDE at the time was one of my major turn offs about using Java compared to using .Net + Visual Studio.

In fact, I still use the same Core 2 Duo 2.66Ghz with 4GB of RAM running Windows 10 as my Plex Server and it can transcode up to two streams simultaneously. I'll still use it interactively when I'm working from home and I'm mindlessly browsing the web while I am waiting on something.

Re: Malware Found in the Ubuntu Snap Store

#118

Post by popey » Sat, May 12, 2018, 9:58 PM UTC

alsadi wrote: post #116

evand wrote: post #110

Earlier quoted context omitted.

The "Users by distribution" table at the bottom of the Spotify page is worth a look: https://snapcraft.io/spotify Snaps are not Ubuntu-only. You can find install instructions for many distros here: https://docs.snapcraft.io/core/install

Snap is a proprietary format that is canonical-centric, don't tell me that the community make choice to make client opensource but official store both hardcoded (initially) and closed source. On the other hand,flatpak is a freedesktop project, done using open standards like OCI and ostree.

No. Snap is not a proprietary format at all. It's a squashfs file with a small amount of metadata. You can make a snap by plopping a file in a folder, add a simple snap.yaml which describes the application and then "make" a snap with the common mksquashfs tool.

There is room in the world for flatpak and snap to co-exist. We created snaps as an evolution on from clicks on the Ubuntu phone, and it covers use cases that flatpak wasn't designed for.

Re: Malware Found in the Ubuntu Snap Store

#119

Post by [deleted] » Sat, May 12, 2018, 10:02 PM UTC

vanviegen wrote: post #81

foepys wrote: post #14

Earlier quoted context omitted.

> Does the name "Ubuntu Snap Store" carry a connotation that code is reviewed for malware by Ubuntu, the way that the Apple, Google, Amazon, etc. mobile app stores are? As far as I know, Apple is the only company that manually reviews the code of apps, and even they let some (in my opinion) malware through [1]. Everybody else just does some heuristic anti-malware checking and then publishes the app. 1: Uber was perma…

Apple is reviewing code? I don't think the blob submitted to Apple includes actual source code. The way I understand it, they (briefly) tap through the app manually, and (like other stores) apply some automated heuristics on the binary.

[deleted]

Re: Malware Found in the Ubuntu Snap Store

#120

Post by matthewbauer » Sat, May 12, 2018, 10:04 PM UTC

evand wrote: post #110

matthewbauer wrote: post #105

Earlier quoted context omitted.

I really don't see the use case at all for Snappy. I mean FlatPak makes sense for devs who want to "package- once, run everywhere", but Snappy is Ubuntu-only. The thing is Ubuntu through Debian is really good at having lots of up-to-date packages. Why abandon that for some crummy app store?

The "Users by distribution" table at the bottom of the Spotify page is worth a look: https://snapcraft.io/spotify Snaps are not Ubuntu-only. You can find install instructions for many distros here: https://docs.snapcraft.io/core/install

Thanks I did not realize it was cross platform. It still disregards too many free desktop standards for me however. Feels like Unity when it comes to Canonical’s NIH syndrome.