Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Found in the Ubuntu Snap Store

linuxuprising.com

Post reply on HN
Print view View original

141–150 of 223 posts

Re: Malware Found in the Ubuntu Snap Store

#141

Post by solomatov »

matthewbauer wrote: post #85
solomatov wrote: post #33

Earlier quoted context omitted.

Yes, I understand that there're people in the community who try to fix the problems. But it's really unfortunate, that Canonical tells us that it's secure whereas it's not: https://snapcraft.io/ >Snaps are containerised software packages that are simple to create and install. They auto-update and are safe to run. And because they bundle their dependencies, they work on all major Linux systems without modification.

From what I gather, Snappy is mostly a marketing gimmick by Canonical. If you want to packages apps, you should use something like FlatPak or AppImage.

Do you know whether they more secure than snaps? I like the idea of running whatever I want on my hardware without compromising security very much.

Re: Malware Found in the Ubuntu Snap Store

#142

Post by faho »

64kbisalluneed wrote: post #133
faho wrote: post #63

Earlier quoted context omitted.

But this particular issue doesn't have anything to do with X!

One word: lxc

And the explanation for that word?

It's still nothing to do with X, and it's not certain that it would plug the "hole" that is being used here.

This "exploit" requires unfettered (or at least not completely throttled) access to the CPU and a way to send the spoils home via the network.

Would this actually be stopped with "lxc"? I doubt it'd do much to curb the CPU abuse, and network access is something games frequently demand (in something like this for e.g. leaderboards or a social sharing feature), so I'd bet that nobody would bat an eye.

Re: Malware Found in the Ubuntu Snap Store

#143

Post by pasbesoin »

zootboy wrote: post #35
eat_veggies wrote: post #24

Earlier quoted context omitted.

I like Arch's package management model, where sources are split into the official repositories, which are manually approved, and the AUR, which everyone knows are not officially endorsed or reviewed, and to check the sources and PKGBUILDS for anything sketchy before installing. The processes for installing from the two are also different enough that the user can't mistake one for the other: official packages are a pa…

Also, compare the wording on the snap store: > Safe to run - Not only are snaps kept separate, their data is kept separate too. Snaps communicate with each other only in ways that you approve. Versus the AUR: > DISCLAIMER: AUR packages are user produced content. Any use of the provided files is at your own risk.

And then, a Snap doesn't behave as the user expects (e.g. like a "native" application). And the first solution on stack-whatever, is to install it using the "--classic" switch. Whereupon, there goes your sandboxing.

Re: Malware Found in the Ubuntu Snap Store

#144

Post by 64kbisalluneed »

faho wrote: post #142
64kbisalluneed wrote: post #133

Earlier quoted context omitted.

One word: lxc

And the explanation for that word? It's still nothing to do with X, and it's not certain that it would plug the "hole" that is being used here. This "exploit" requires unfettered (or at least not completely throttled) access to the CPU and a way to send the spoils home via the network. Would this actually be stopped with "lxc"? I doubt it'd do much to curb the CPU abuse, and network access is something games frequent…

Sorry, missplaced my answer. It was regarding the guy above yours concerning apps in general can create havoc to a system. I mean that using containers like lxc can create a sandbox.

Re: Malware Found in the Ubuntu Snap Store

#146

Post by wollw »

matthewbauer wrote: post #103
wollw wrote: post #12

Earlier quoted context omitted.

I prefer the BSD port system.

Is there a significant difference between BSD ports vs. Portage vs. Arch Build System? Especially in terms of security I think that they all have the same model. FreeBSD ports has a ton of packages, though. Maybe they have incredible quality control, but I would bet a few of those have some malware in them. That goes for all Linux/BSD build systems, obviously, just huge ones make it more likely. https://repology.org/…

The main reason I brought it up is that like the Apple "Store" the OpenBSD Ports (in my case) are a curated selection of software. I do mostly use pkg_add to install, as it is recommended and takes less time, but Ports is more recognizable; I still prefer it to Apple even if I'm not inclined to install everything form source like Gentoo does. The main difference over the Arch Build System in my experience is that most (all?) of the packages are also in Ports. Arch's AUR was/is helpful but my experience with it was always sloppier and I've grown disillusioned with user maintained packages and build systems.

edit: Yes, pretty much the same idea though.

Re: Malware Found in the Ubuntu Snap Store

#147

Post by jordigh »

While this is obviously malicious, I think I would favour paying for things with a few CPU cycles, as long as it was voluntary and overt.

Want to read this article? Please click here to mine a cryptocoin for 30 seconds. Great, thanks! Here's a cookie so we won't ask you again to mine for a whole month.

I would much rather have this than being shamed into looking at ads. It always struck me as utterly bizarre to be told that not wanting to see ads is somehow immoral.

Re: Malware Found in the Ubuntu Snap Store

#148

Post by Shikadi »

geofft wrote: post #136
Shikadi wrote: post #126

Earlier quoted context omitted.

In ubuntu, it's even less obvious. Main, restricted, and universe are all checked together by apt, and treated the same

But main/restricted and universe are both vetted—the only people who can upload to universe are Debian developers (indirectly, via Ubuntu importing from Debian) and Ubuntu developers, and the process of becoming either of these is nontrivial. Ubuntu's equivalent of the AUR, if I understand the AUR right, is PPAs, which are definitely not enabled by default and are fairly obvious about their third-party-ness. (Main vs…

It took me a good amount of googling to verify that, but you're mostly correct, there are only 132 developers with upload rights to the universe repository. Though I would argue that the distinction isn't just licensing, since Canonical themselves only support main and restricted.

Re: Malware Found in the Ubuntu Snap Store

#149

Post by mkl »

fjsolwmv wrote: post #92
scarface74 wrote: post #55

Earlier quoted context omitted.

And for the life of me I can't understand why people use the Facebook app. The mobile web page loads faster, it's automatically sandboxed by being just a browser page and it can do almost anything that the app can do. Besides on iOS at least, if you click on a link from the Facebook web page, you can take advantage of whatever content blocker you have installed.

If you log into Facebook on web, then visit any other site, they send your browsing info to Facebook via Like button. The Facebook app is more sandboxed, since it can't snoop on your web browsing.

The Facebook app can and does track your physical location, among other things.

I think the real answer is "Don't use Facebook" or "If you must use Facebook, do it through Tor Browser".

Re: Malware Found in the Ubuntu Snap Store

#150

Post by fulafel »

the_common_man wrote: post #6

This is exactly why you should not run random docker images and snaps. Docker images are also run as root in many cases. It is better to build app images from scratch and understand what exactly goes into the image.

Docker does use user namespaces by default, that's pretty bad.
Post reply on HN