Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware Found in the Ubuntu Snap Store

linuxuprising.com

Post reply on HN
Print view View original

201–210 of 223 posts

Re: Malware Found in the Ubuntu Snap Store

#201

Post by badsectoracula »

newnewpdro wrote: post #121
badsectoracula wrote: post #99

Earlier quoted context omitted.

In theory you can have the last bit with flatpack (and perhaps snap), the issue here is auditing what goes in the repositories, not the package format.

Have you ever gone through the rigamarole of getting a project into a major distro like debian? A bunch of the guidelines governing that process are simply unenforcable in a model where the developer builds and publishes the release. I am not of the opinion that those rules are irrelevant to the stability and security of our systems. There's a significant push to establish a more app-store model for linux distributio…

I do not really see the difference between the app-store model and the distribution repository model, at the end of the day both are models that teach the users to only download stuff from a specific place. This introduces gatekeeping middlemen that personally i'd rather do without. But if there is going to be a central """trusted""" place, i'd prefer it to be distribution agnostic.

(although even that isn't ideal since in practice it ends up with the major popular distributions pushing agendas to the smaller distributions through whatever requirements are there for "compatibility")

Re: Malware Found in the Ubuntu Snap Store

#202

Post by Iolaum »

If you use snaps, be aware that they update automatically on their own. You have the option to set upgrade time windows but you cannot completely disable automatic updates and use your own custom solution to update and administer your system.

Discussion of this issue with snap developers here: https://forum.snapcraft.io/t/disabling-automatic-refresh-for...

Re: Malware Found in the Ubuntu Snap Store

#203

Post by John_KZ »

stiGGG wrote: post #128
kpcyrd wrote: post #112

Earlier quoted context omitted.

Firefox addons are reviewed. That's why malicious firefox addons are a lot less common than malicious chrome extensions.

Can confirm that Mozillas review process is the most sofisticated i’ve ever experienced. The good thing is that when they have something to complain you have a competent person on the other side that really helps you. Not like Apple who only send you some boilerplate to all your responses. The downside at Mozilla is that it takes them ages to even start the review, it took me once over 2 month to get my extension in…

Why do they allow so many extensions that rely on third-party services though? I don't like this trend. Especially given there's no network sandboxing of any sort, giving permissions for an extension to access your data locally is very different from allowing it to send them to a third-part, untrusted server.

Re: Malware Found in the Ubuntu Snap Store

#204

Post by sleavey »

Sylos wrote: post #192
sleavey wrote: post #72

As someone who hasn't yet used Ubuntu 18.04, is the snap store something I'll be using in 5 years time instead of APT, is it just another attempt by Canonical to jump on the app store bandwagon, or is it something completely different? Excuse my ignorance but I'm intensely suspicious of "stores" on open source operating systems.

You might be using it instead of APT for some things, but it won't replace APT. Say you want the newest version of LibreOffice for whatever reason. This is a typical use-case where Snaps will come in handy. They have most dependencies bundled into the application, so you don't have to worry about your whole system getting wonky by installing newer versions of those dependencies to go with the newer version of the app…

Thanks for the info. I like that Canonical are trying to solve the problems with package managers, but it's a shame we can't focus on making APT and friends more capable of the positive parts of app stores without bundling things into binaries akin to Windows executables. Allow multiple versions of libraries able to be installed, provide path translation (so systems that store binaries in /opt and others in /usr can still work from the same .deb file) and make sure repositories are more frequently updated. This might require Ubuntu to move to a rolling release, at least for some of their products (maybe they could keep releasing LTS versions every two years but have a rolling release for everything else). Sandboxing is arguably nothing to do with the package manager or app store - it's the kernel's problem. And bundling dependencies together is bad for security - critical vulnerabilities (recent example being in SSH) would not be able to be patched with one update, leaving unmaintained code that bundled a vulnerable dependency permanently flawed.

I think I'll wait for this most recent example of the trend to make everything into an app to blow over...

Re: Malware Found in the Ubuntu Snap Store

#205

Post by fulafel »

fulafel wrote: post #150
the_common_man wrote: post #6

This is exactly why you should not run random docker images and snaps. Docker images are also run as root in many cases. It is better to build app images from scratch and understand what exactly goes into the image.

Docker does use user namespaces by default, that's pretty bad.

*doesn't

Re: Malware Found in the Ubuntu Snap Store

#206

Post by gmueckl »

B-Con wrote: post #127
HankB99 wrote: post #125

Earlier quoted context omitted.

> ... and the AUR, which everyone knows are not officially endorsed or reviewed ... Uh, not everyone. I ran Manjaro for a bit and found that many of the things I ran were available via AUR. The usual thing I'd find in a search was usually something like: sudo pacman -Sy sudo pacman -S yaourt base-devel yaourt -Sy yaourt -S gpodder (That's the entire reply, BTW.) At some point I started to wonder what the provenance o…

You can't install unofficial packages via pacman. And AFAIK none of the unofficial/AUR package managers, like yaourt, are in the official repositories so the point where you cross the line is very clear and distinct and any wiki guide to installing from the AUR makes it clear you are going into unofficial territory. I haven't used Manjaro but they seem to intentionally hide the distinction between the official and un…

Also, yaourt has a lot of warnings and prompts at each step along the way to make absolutely certain that you understand what you're getting yourself into with the packages you're installing. The process is certainly not for beginners. Ubuntu seems to go for a more user friendly process instead.

Re: Malware Found in the Ubuntu Snap Store

#207

Post by RayDonnelly »

popey wrote: post #193
hsivonen wrote: post #177

Earlier quoted context omitted.

Presumably it's https://github.com/snapcrafters , but what links the Snap Store identity to that GitHub org? Where does snapcraft.yaml get executed? On my computer? On Canonical's infra? On the packager's computer?

The build service at build.snapcraft.io is what builds it. Anyone can hook up their github repo (containing a snapcraft.yaml) to build and have to automatically rebuild the snap when changes in the git repo occur. It then pushes the snap to the 'edge' channel in the store. Developer validates that build and then pushes to stable for all users.

And what is to stop someone from pushing malicious code to GitHub and you guys distributing malicious packages to end-users via your 'stable' channel?

And who's liable here?

Re: Malware Found in the Ubuntu Snap Store

#208

Post by Shikadi »

geofft wrote: post #152
Shikadi wrote: post #148

Earlier quoted context omitted.

It took me a good amount of googling to verify that, but you're mostly correct, there are only 132 developers with upload rights to the universe repository. Though I would argue that the distinction isn't just licensing, since Canonical themselves only support main and restricted.

I mean that the distinction between main and restricted and between universe and multiverse is licensing. It's a 2x2 matrix: supported only community free main universe non-FOSS restricted multiverse

Oh yeah, definitely misread that

Re: Malware Found in the Ubuntu Snap Store

#209

Post by coatmatter »

scarface74 wrote: post #55
colejohnson66 wrote: post #47

Earlier quoted context omitted.

I remember the Facebook app being less than 20 megabytes in size half a decade ago. Now it’s almost half a gigabyte

And for the life of me I can't understand why people use the Facebook app. The mobile web page loads faster, it's automatically sandboxed by being just a browser page and it can do almost anything that the app can do. Besides on iOS at least, if you click on a link from the Facebook web page, you can take advantage of whatever content blocker you have installed.

> And for the life of me I can't understand why people use the Facebook app.

When I last used it, it just felt less clunky than opening it in a mobile browser tab (Android). I bet most people who do use the app would agree. A mobile browser's address bar is also kind of ugly, so apps often just feel more 'immersive' and therefore 'better'. The ultimate reason however is probably because Facebook is somewhat good at marketing and managed to sell their apps to users better than the mobile version of their site. There are probably more reasons at hand too but I can't remember anymore as I now use neither.

> The mobile web page loads faster

Not really in my experience. Also, apps tend to have more support for gestures than mobile pages. Instagram is probably an easier example. It's more swiping, and less precise tapping. Browsers are also kind of yucky to load if you have many tabs open (Brave seems to be better with this though). Scrolling in apps can often be somehow more pleasant.

The gap between mobile pages and official apps has probably narrowed, but I don't think it's quite correct to imply that the mobile page is always better for everyone (especially those who are still enjoying the 'rewards' of Facebook).

Do you use the Google Maps with its app, or in a browser?

Re: Malware Found in the Ubuntu Snap Store

#210

Post by jake_the_third »

Iolaum wrote: post #202

If you use snaps, be aware that they update automatically on their own. You have the option to set upgrade time windows but you cannot completely disable automatic updates and use your own custom solution to update and administer your system. Discussion of this issue with snap developers here: https://forum.snapcraft.io/t/disabling-automatic-refresh-for...

This is very unfortunate. Despite the negative press snaps is getting, I was planning on releasing a commercial product as a snap. One of the key reasons for doing so was that users had control over what the app is allowed do (via plugging/unplugging slots), a feature flatpack lacks as far as I can tell.

However this changes everything. Disallowing owners from controlling their software and hardware is not something I want to encourage. We have enough of that from Microsoft (and to some extent GNOME Shell developers).

Does Flatpack also force developers' intentions upon their users? Or is AppImage my only recourse?

I want a solution that doesn't mistreat customers.

Post reply on HN