Malware Found in the Ubuntu Snap Store • Hacker News Board

Re: Malware Found in the Ubuntu Snap Store

#221

Post by jordigh » Mon, May 14, 2018, 12:15 PM UTC

dingo_bat wrote: post #163

jordigh wrote: post #147

While this is obviously malicious, I think I would favour paying for things with a few CPU cycles, as long as it was voluntary and overt. Want to read this article? Please click here to mine a cryptocoin for 30 seconds. Great, thanks! Here's a cookie so we won't ask you again to mine for a whole month. I would much rather have this than being shamed into looking at ads. It always struck me as utterly bizarre to be to…

That may be fine on desktops but absolutely unacceptable on mobile and laptops, due to battery usage.

Wouldn't be a payment if CPU cycles didn't have some scarcity.

My laptop would be fine with 30 seconds of a CPU spike, though. Most phones could probably also tolerate it.

Re: Malware Found in the Ubuntu Snap Store

#222

Post by cookiecaper » Tue, May 15, 2018, 5:30 PM UTC

beojan wrote: post #188

cookiecaper wrote: post #154

Earlier quoted context omitted.

The difference being that Snaps always run in a semi-encapsulated environment (a container), whereas the AUR just executes in whatever security context you're issuing commands from. PKGBUILDs are arbitrary shell scripts and they can do anything that the user executing them can do. I'm not trying to defend the perception that Snaps are immune from malware, but there is a real difference in the default safety of a pack…

If the application is trustworthy, it doesn't matter. If not, you should think twice about running it even in a container.

To be clear, I agree. Containers on Linux are very weak security boundaries and should not be considered safe sandboxes for untrusted or dangerous code. In fact, post-Spectre, only physically independent hardware unattached to the network should be considered a reasonably safe sandbox.

However, something is better than nothing, and it's just not true that there's no difference between running something from the AUR and running something in a "confined" snap. There is some crap in the way at least.

Re: Malware Found in the Ubuntu Snap Store

#223

Post by beojan » Mon, May 28, 2018, 12:28 PM UTC

cookiecaper wrote: post #222

beojan wrote: post #188

Earlier quoted context omitted.

If the application is trustworthy, it doesn't matter. If not, you should think twice about running it even in a container.

To be clear, I agree. Containers on Linux are very weak security boundaries and should not be considered safe sandboxes for untrusted or dangerous code. In fact, post-Spectre, only physically independent hardware unattached to the network should be considered a reasonably safe sandbox. However, something is better than nothing, and it's just not true that there's no difference between running something from the AUR a…

Good point. Though the fact that you read your PKGBUILDs before running them (you do read your PKGBUILDs, right?) at least compensates for this.