Can somebody explain the need for this new package management thingy when apt exists and works nicely? Why have 2 softwares to do the same thing.
Malware Found in the Ubuntu Snap Store
161–170 of 223 posts
Re: Malware Found in the Ubuntu Snap Store
#162The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…
Flatpak has been making moves in what I think is the right direction, which is containerization and dynamic privileges[0].
Wayland will also solve a few of these problems.
Personally, I'm of the opinion that the Linux security model is a horribly outdated ticking time-bomb and people really aren't taking it seriously enough. It drives me kind of crazy; a lot of people act like X security is no big deal, like it's fine that our primary security model for Linux is just based on file permissions. I think that once we have a better permissions system in place people are going to look back with 20/20 hindsight and say "Well duh, of course apps should be isolated from each other and the system in general. Everyone knows that."
There are two permissions that my desktop/web/mobile environment doesn't ask me for that would prevent most attacks like this: network access and cpu access.
Network access is obvious. It kind of boggles my mind that apps can by default just access the network and make a request to any server that they want. Blocking that alone would take care of a huge number of crypto miners (and spyware), because they all need network access to operate. There are almost no good reasons I can think of for a desktop app to have network access by default.
The less obvious permission that I think is probably worth exploring is CPU access. I don't necessarily know what a control for that would look like in a standard permission system, but if an app wants to start going crazy with my CPU, whether they're being malicious or just innocently inefficient, my OS/browser/phone should probably bring it to my attention and give me the opportunity to either permanently throttle them or set some kind of ground rules.
Re: Malware Found in the Ubuntu Snap Store
#163While this is obviously malicious, I think I would favour paying for things with a few CPU cycles, as long as it was voluntary and overt. Want to read this article? Please click here to mine a cryptocoin for 30 seconds. Great, thanks! Here's a cookie so we won't ask you again to mine for a whole month. I would much rather have this than being shamed into looking at ads. It always struck me as utterly bizarre to be to…
That may be fine on desktops but absolutely unacceptable on mobile and laptops, due to battery usage.
Re: Malware Found in the Ubuntu Snap Store
#164The problem with snaps is that they didn't take security really seriously on desktop: https://www.zdnet.com/article/linux-expert-matthew-garrett-u... >"X has no real concept of different levels of application trust. Any application can register to receive keystrokes from any other application. Any application can inject fake key events into the input stream. An application that is otherwise confined by strong securit…
In this case though it's not really a security issue as you describe and more of an abusive use of resources. I don't mean to be facetious but that's also what Electron apps do to some extent
It might not be a full-fledged security issue, but it's at least a user control issue. Why can't we easily set hard CPU/RAM/Storage limits for Electron apps?
Regardless of whether you love or hate Electron, its rise in popularity has clearly shown that a number of HN users feel like they don't have complete control over their computer's resources - that their only choice is to either avoid an app entirely or slow down their computers.
A user should be able to pick up an application and easily say something like "you can have up to 2 CPUs and 250mb of RAM. If you want more, come back and ask me." And honestly, if Google couldn't trust that most users would give it unfettered access to 4 gigs of RAM, I bet their engine would magically get a lot more efficient really quickly.
Re: Malware Found in the Ubuntu Snap Store
#165Earlier quoted context omitted.
And for the life of me I can't understand why people use the Facebook app. The mobile web page loads faster, it's automatically sandboxed by being just a browser page and it can do almost anything that the app can do. Besides on iOS at least, if you click on a link from the Facebook web page, you can take advantage of whatever content blocker you have installed.
If you log into Facebook on web, then visit any other site, they send your browsing info to Facebook via Like button. The Facebook app is more sandboxed, since it can't snoop on your web browsing.
I use a seperate web browser on my phone for Firefox and Gmail. Everything else, I use Firefox.
Re: Malware Found in the Ubuntu Snap Store
#166Earlier quoted context omitted.
In this case though it's not really a security issue as you describe and more of an abusive use of resources. I don't mean to be facetious but that's also what Electron apps do to some extent
It might not be a full-fledged security issue, but it's at least a user control issue. Why can't we easily set hard CPU/RAM/Storage limits for Electron apps? Regardless of whether you love or hate Electron, its rise in popularity has clearly shown that a number of HN users feel like they don't have complete control over their computer's resources - that their only choice is to either avoid an app entirely or slow dow…
How does that help? You already know that app is not going to work (well) with 250M, nagging the user for more RAM doesn't solve anything. Either you run an app written with resource constraint environments in mind or you don't.
Re: Malware Found in the Ubuntu Snap Store
#167Earlier quoted context omitted.
Be warned that malware like this is in the AUR all the time. It's so common it's not even newsworthy. They are usually pretty good at handling it though.
I've never heard of this happening and I can't find a single occurrence of it. I mean, I agree with "don't blindly trust everything in the AUR", but this seems wrong.
I maintain 14 AUR packages and have also never heard of this happening.
Re: Malware Found in the Ubuntu Snap Store
#168Can somebody explain the need for this new package management thingy when apt exists and works nicely? Why have 2 softwares to do the same thing.
I agree; I have zero interest in installing software using anything other than my system's default package manager. The whole point of package management is centralization, keeping track of chaotic dependencies and install states. Having multiple package managers, that don't know about each other's state, on the system defeats the purpose entirely.
Re: Malware Found in the Ubuntu Snap Store
#169Unlike flahub where either original develop or flathub admins take control Canonical's Snapcraft literally says "Get published in minutes" Any random guy would publish his malware with near no review https://dashboard.snapcraft.io/snaps/ Yes, they maybe win the counter for published apps compared to flathub. Congratulations!
I really don't see the use case at all for Snappy. I mean FlatPak makes sense for devs who want to "package- once, run everywhere", but Snappy is Ubuntu-only. The thing is Ubuntu through Debian is really good at having lots of up-to-date packages. Why abandon that for some crummy app store?
A month or two ago I went digging because I wanted to disable auto-update for something I installed through snap (it stores configuration inside the versioned directory, so one day everything was just gone because snap auto-upgraded it the night before). Completely disabling auto-update is apparently not possible, and by design.
According to the devs involved, on mailing lists and bug reports, the point of snap over apt/etc is the auto updates can't be disabled, so end-users can't put off or forget about security updates. Even adding a way to delay or configure when an update happens seemed to take a lot of convincing before it was added.
(In the end I just disabled the snap service entirely to stop auto-updates. Only downside seems to be that I can't query or install new things through snap without it.)
Re: Malware Found in the Ubuntu Snap Store
#170Earlier quoted context omitted.
It might not be a full-fledged security issue, but it's at least a user control issue. Why can't we easily set hard CPU/RAM/Storage limits for Electron apps? Regardless of whether you love or hate Electron, its rise in popularity has clearly shown that a number of HN users feel like they don't have complete control over their computer's resources - that their only choice is to either avoid an app entirely or slow dow…
How does that help? You already know that app is not going to work (well) with 250M, nagging the user for more RAM doesn't solve anything. Either you run an app written with resource constraint environments in mind or you don't.
It may not be common, but I occasionally run into apps that will work will with limited resources but that will happily expand outwards if given the opportunity. Perhaps a bad example, but the code for this cryptominer itself checks how many CPUs you have before it starts.
You are often right that you either supply the resources an app needs or you don't. However, there are a growing number of apps I'm seeing that act more like goldfish - they grow to the size of the container they are put in.
I also occasionally run into apps where I'm OK with bad performance, I just don't want them to interfere with other tasks that I have.
I might decide that I'm OK with a version of Slack on my work computer that runs poorly and that occasionally starts caching stuff to disk - as long as the rest of my computer doesn't slow down. Not every app that I'm using needs good performance - some are more important than others. This is especially true for background apps like a backup system, file sync, update, anything where I don't really care if a task takes longer to finish.
It also might be worth exposing some kind of more fine-grained policy; something like "I want this app to have full access to my CPU if it's in the focus, but if I minimize it, I want you to reduce its resources or even suspend it."
And of course there is the (perhaps naive) hope that as CPU and RAM become a resource where users control access in the same way that they control location or camera access, developers might start to include resource-heavy features as progressive enhancements. This has... sort of... worked on the web with resources like location. So it's unlikely, but possible.