Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 20.04 LTS (Focal Fossa)

wiki.ubuntu.com

Post reply on HN
Print view View original

351–360 of 394 posts

Re: Ubuntu 20.04 LTS (Focal Fossa)

#351

Post by kingosticks »

julianlam wrote: post #291
cies wrote: post #91

Earlier quoted context omitted.

Ubuntu had the calculator as a snap! What's the idea with that? It suddenly took 2 secs to load and uses load of memory... I dont care packaging got easier. I care for a smooth working system I can understand and instrument, and that does not hog resources.

Oh! Is _that_ why the calculator is nigh unusable now? Sheesh, this just shot snap's credibility right out the window. It's faster for me to boot up the node executable and do my calculations there.

Yes! But you can "fix" it:

https://news.ycombinator.com/item?id=21650743

Re: Ubuntu 20.04 LTS (Focal Fossa)

#352

Post by kd913 »

foresto wrote: post #336
kd913 wrote: post #290

Earlier quoted context omitted.

The amount of cases for malicious snaps was about 1 with the cryptominer that was addressed within 3 days. Those snaps that are published go through static analysis and unless manually vetted will not have access to the rest of your system. You install it, at worst it will cryptomine that is it. Oh and you can remove it completely with all traces unlike deb equivalents. Snaps come with a tick against verified snaps c…

> You install it, at worst it will cryptomine that is it. Last time I looked, snaps still had access to the X server. They were therefore perfectly capable of logging and inserting keystrokes, capturing whatever sensitive information is on screen, etc. Has this changed? I don't think Wayland would solve this, because even if Ubuntu switches to Wayland, variants like Xubuntu (which inherit snap from the base distribut…

You are right, there are still issues and vulnerabilities present with using X. That is the case with every distribution mechanism ever in existence.

You would have to be a complete numpty to download and install such a thing as it wouldn't come from anything with first party support. Enough of a numpty that you shouldn't be trusted with root to begin with.

Wouldn't be surprised if this specific thing was scanned for and flagged with their static analysis tool. It seems like something that would be flagged.

> DBus abuse?

When I added the dbus slot for the firefox snap, Canonical wouldn't push to the store until it was manually reviewed. So yes, asking for new permissions/unusual permissions would probably need review.

Re: Ubuntu 20.04 LTS (Focal Fossa)

#353

Post by kd913 »

jamieweb wrote: post #324
kd913 wrote: post #290

Earlier quoted context omitted.

The amount of cases for malicious snaps was about 1 with the cryptominer that was addressed within 3 days. Those snaps that are published go through static analysis and unless manually vetted will not have access to the rest of your system. You install it, at worst it will cryptomine that is it. Oh and you can remove it completely with all traces unlike deb equivalents. Snaps come with a tick against verified snaps c…

I was specifically talking about the default, trusted Ubuntu Apt repositories, not custom PPAs which are of course inherently untrusted. > You install it, at worst it will cryptomine that is it. If that happens then I have no choice but to assume a full system compromise and nuke my machine. It's not a risk I'm willing to take, as there's essentially no way to definitively prove that that's all the malicious Snap was…

>If that happens then I have no choice but to assume a full system compromise and nuke my machine. It's not a risk I'm willing to take, as there's essentially no way to definitively prove that that's all the malicious Snap was doing.

You can be rest assured that the problematic snaps were tackled and addressed within 3 days, there are no cryptominers on the store anymore. That and it was actively searched for.

Why are you downloading random crap from teh snap store to begin with?

People always take extreme perspectives over this and I find it weird. No you probably shouldn't be installing hello-world snap from Davind1923232. I wouldn't expect you to do that on Android or any other manufacturer. It probably is safe, in that it has had as much vetting as any other store owner.

Downloading firefox, vscode, intellij, vlc, nodejs, spotify and all of these other first party snaps is perfectly fine.

>Snap sandboxing is rarely utilised in a meaningful way, and the permissions for a particular app are controlled by the author by default. In most cases there's nothing explicitly preventing a malicious Snap from gaining persistence even after it is removed.

Snap permissions aren't controlled just by the author. I have disconnected plenty of plugs that don't magically reappear. Especially for sandboxing internet facing programs from my home directory.

Snaps can't magically persist that is a load of FUD. The files needed are stored on squashfs, home config and configuration in it's own isolated directory. On removal, the squashfs is removed and that is gone.

>In other words, Snap sandboxing is in no way comparable to a 'proper' solution like a well-configured Firejail or a VM.

Why do you comment on things you really don't seem to understand. This is the entire point of snap plugs/connections which are enforced permissions based model.

Re: Ubuntu 20.04 LTS (Focal Fossa)

#354

Post by kd913 »

GordonS wrote: post #318
kd913 wrote: post #290

Earlier quoted context omitted.

The amount of cases for malicious snaps was about 1 with the cryptominer that was addressed within 3 days. Those snaps that are published go through static analysis and unless manually vetted will not have access to the rest of your system. You install it, at worst it will cryptomine that is it. Oh and you can remove it completely with all traces unlike deb equivalents. Snaps come with a tick against verified snaps c…

I don't know much about the Snap system - regarding 3rd parties and the "tick", is this using domain verification, or some other means? Do 3rd parties have to pay for this? I read something the other day about needing to pay Canonical $15k/y for a branded Snap store, but I'm not sure if that was about private stores, this, or something else.

I think the main mechanism of this is communication directly with developers on forum.snapcraft. In this case Mozilla with Canonical etc...

I didn't go through this process so I don't really know.

I think that is how it has worked so far for all of the 1st party snaps I have seen.

Re: Ubuntu 20.04 LTS (Focal Fossa)

#355

Post by insulanian »

Andrew_nenakhov wrote: post #334
jedieaston wrote: post #305

Earlier quoted context omitted.

Nothing, not LibreOffice, not Google Sheets, not Excel for Mac can replace Excel for me. It's wonderful, they keep adding features and I know all the quirks like the back of my hand. If I ever swap to Linux on the desktop, I'll keep a VM around just for Excel. Word is nice too, although that I could probably change that rather quickly (word processing is not hard to get right).

This speaks only that you are so used to MSOffice that you don't want to study different app, not that it is really better. When I switched to OpenOffice.org in 2006 it took me some time to switch, and you know what? I have found that OOo was way more stable, predictable and logical in how things are done. It was also really free as in freedom, and I could run it on any OS of my choice. Now, I know LibreOffice like t…

> _"nah... I don't want any changes, I'd rather keep myself and the world vendorlocked into proprietary software"_

People don't have a problem changing if the change doesn't break their work(flows). The fact that Internet Explorer is pretty much dead proves it - everyone switched to Chrome although is different.

MS Office document format support is simply not good enough on any alternative (of which Libre Office is the only serious contender).

I have tried to switch to Libre Office on multiple occasions over the years, but every time I gave up after couple of weeks of frustration, because I couldn't collaborate on shared documents. Either the stuff I created in Libre Office looked different when others open it in MS Office, or I was breaking the documents for other people.

I don't consider MS Office to be better - it's simply that the alternatives are not compatible.

Re: Ubuntu 20.04 LTS (Focal Fossa)

#356

Post by jamieweb »

kd913 wrote: post #353
jamieweb wrote: post #324

Earlier quoted context omitted.

I was specifically talking about the default, trusted Ubuntu Apt repositories, not custom PPAs which are of course inherently untrusted. > You install it, at worst it will cryptomine that is it. If that happens then I have no choice but to assume a full system compromise and nuke my machine. It's not a risk I'm willing to take, as there's essentially no way to definitively prove that that's all the malicious Snap was…

>If that happens then I have no choice but to assume a full system compromise and nuke my machine. It's not a risk I'm willing to take, as there's essentially no way to definitively prove that that's all the malicious Snap was doing. You can be rest assured that the problematic snaps were tackled and addressed within 3 days, there are no cryptominers on the store anymore. That and it was actively searched for. Why ar…

> Why are you downloading random crap from teh snap store to begin with?

I'm not, but the fact that there's the potential for junk to exist on the store in the first place is the problem, especially when there isn't adequate protection against typosquatting like I mentioned originally.

As long as I only use the default repositories, I can `apt install` a package I've never even heard of and it's pretty much guaranteed to not be malicious/actively dangerous. With Snap, this guarantee doesn't exist to the same level.

Sure, there is moderation and review in place, but this puts the Snap Store in the same realm as other stores and 'community maintained' package managers, almost all of which have issues with junk/dangerous packages.

> Snaps can't magically persist that is a load of FUD.

Yes, in many cases this is right, but some of the most common Snap interfaces (multiple of which can auto-connect) would provide enough leverage on a system to gain persistence or actively interact with things outside of the sandbox.

For example, the `home` interface is enough to compromise an average personal computer and probably gain persistence, as everything of value is usually within the home directory. (I do like the fact that `home` disallows access to hidden files though.)

The `x11` interface can even be auto-connected, and this potentially allows the Snap to read the graphical output of other applications.

I agree that these scenarios are quite theoretical, but as foresto says in this thread, 'sandbox' implies 'safe', and sandboxed Snaps are quite leaky compared to other sandboxes such as Firejail or a full-blown VM.

Perhaps this is just a terminology problem? I would say that Snap sandboxing is far more comparable to permission management on an Android phone.

Re: Ubuntu 20.04 LTS (Focal Fossa)

#357

Post by Anthony-G »

Anthony-G wrote: post #259
doublesCs wrote: post #32

For a long time I've been using Lubuntu on my laptop. However, a couple of years ago they changed focus and From wikipedia: Lubuntu was originally touted as being "lighter, less resource hungry and more energy-efficient", but now aims to be "a functional yet modular distribution focused on getting out of the way and letting users use their computer" I stopped updating my OS since (I'm on 14). Does anyone care to sugg…

I use a 12-year old Dell laptop (upgraded to 4GB RAM) as my main computer and I’ve been using Lubuntu for the past 6 years for the same reasons you describe. I was also a little disappointed that the focus of the project is no longer to produce a light-weight and efficient desktop – though I don’t object to their new goal. I’ve been running Lubuntu 16.04 for the past three years but I recently thought I’d update my s…

Update: I see the Lubuntu 20.04 LTS has been released [1] since I posted earlier today. :) Kudos to the maintainers!

I forgot to mention in my post above that I had purchased an SSD a while ago and this is what prompted me to consider the available options for updating/changing the OS.

[1] https://lubuntu.me/focal-released/

Re: Ubuntu 20.04 LTS (Focal Fossa)

#358

Post by [deleted] »

rlpb wrote: post #348
hajile wrote: post #343

Earlier quoted context omitted.

Don't forget performance. SquashFS has terrible IO performance and you pay that price every time you open an application. https://forum.snapcraft.io/t/squashfs-is-a-terrible-storage-... There's an even bigger security hole with Snaps. If a library is compromised on apt, they'll push the update and your applications will be updated. With a Snap, every single snap developer must somehow come across the error (which cou…

> If a library is compromised on apt, they'll push the update and your applications will be updated. With a Snap, every single snap developer must somehow come across the error (which could be in a sub-dependency), find the fix, then deploy again. Snaps compete with third party apt repositories, not distribution-provided packages (but see below). I've seen a general trend in complex upstreams _bundling_ their depende…

[deleted]

Re: Ubuntu 20.04 LTS (Focal Fossa)

#359

Post by kd913 »

jamieweb wrote: post #356
kd913 wrote: post #353

Earlier quoted context omitted.

>If that happens then I have no choice but to assume a full system compromise and nuke my machine. It's not a risk I'm willing to take, as there's essentially no way to definitively prove that that's all the malicious Snap was doing. You can be rest assured that the problematic snaps were tackled and addressed within 3 days, there are no cryptominers on the store anymore. That and it was actively searched for. Why ar…

> Why are you downloading random crap from teh snap store to begin with? I'm not, but the fact that there's the potential for junk to exist on the store in the first place is the problem, especially when there isn't adequate protection against typosquatting like I mentioned originally. As long as I only use the default repositories, I can `apt install` a package I've never even heard of and it's pretty much guarantee…

>I'm not, but the fact that there's the potential for junk to exist on the store in the first place is the problem, especially when there isn't adequate protection against typosquatting like I mentioned originally.

If you are that concerned about typing the wrong thing then use a software center. I have never even seen one and I have been using snaps since their inception. I am using 38 snaps and I have never once installed something i didn't intend to do. I also tend not to run sudo commands without knowing what i am doing.

It's not like launchpad, or universe isn't full of junk software too. I think you can download an open source rootkit via apt as if that matters.

> For example, the `home` interface is enough to compromise an average personal computer and probably gain persistence, as everything of value is usually within the home directory. (I do like the fact that `home` disallows access to hidden files though.)

You can't gain 'persistence' just from the home interface. In fact the only way of getting 'persistence' AFAIK, is through creating a systemd snap like ufw. Again, I am fairly certain that stuff requires manual vetting before being published to teh snap store.

X11 vulnerability applies to everything, and will apply to everything until wayland is usable. Connecting it automatically means that users actually have a functioning browser. That is a sane policy because users shouldn't have to mess with configuration files to get their programs to work (unlike firejail profiles).

All you are describing are permissions which are generally needed to actually run useful programs. Yes, programs automatically connect them. I do suggest reviewing software permissions before executing it, and you can do that with snap.

>sandboxes such as Firejail

You are talking about leakyness and mention Firejail? Firejail has historically had the most severe CVE vulnerabilities partly because of how usernamespaces/network namespaces work. It was basically a setuid binary and proved a easy mechanism to get root.

Snap is built using the same tech as namespaces, but doesn't act as a setuid binary (I think because it uses mounted namespaces rather than creating a usernamespace). It uses the same seccompf, and same browser sandboxing. The bonus of snap is that it actually comes with working apparmor profiles unlike firejail.

Re: Ubuntu 20.04 LTS (Focal Fossa)

#360

Post by Andrew_nenakhov »

insulanian wrote: post #355
Andrew_nenakhov wrote: post #334

Earlier quoted context omitted.

This speaks only that you are so used to MSOffice that you don't want to study different app, not that it is really better. When I switched to OpenOffice.org in 2006 it took me some time to switch, and you know what? I have found that OOo was way more stable, predictable and logical in how things are done. It was also really free as in freedom, and I could run it on any OS of my choice. Now, I know LibreOffice like t…

> _"nah... I don't want any changes, I'd rather keep myself and the world vendorlocked into proprietary software"_ People don't have a problem changing if the change doesn't break their work(flows). The fact that Internet Explorer is pretty much dead proves it - everyone switched to Chrome although is different. MS Office document format support is simply not good enough on any alternative (of which Libre Office is t…

> MS Office document format support is simply not good enough on any alternative

This is a key fault in your logic. You SHOULD NOT judge the alternative by how it supports the document format that is specifically created in such a way to block competition from effectively supporting it. The company that did it also corrupted the international standards organization to get it an official 'standard' status.

But the truth is, you don't really need MS Office document format support at all. The company I've founded in 2007 never ever sent out any document in MS Office format, never owned any copy of MS Office, and we survived since then just fine.

If you want an electronic spreadsheet, use an open, documented and well supported standard - OpenDocument, and get on with it. Oh, and it is supported just fine on Ubunut 20.04 that we discuss here, as is on a Mac and Windows. The only thing it lacks is a proper online collaborative editor, that's true.

Post reply on HN