161–170 of 443 posts
Earlier quoted context omitted.
My new policy is to just install Debian instead.
Snap is the reason I moved from Ubuntu to Fedora years ago. I couldn't have known how happy I would be with this decision :)
Earlier quoted context omitted.
That's funny, because in accordance with my policy I delete snap immediately after install.
It's standard policy for me to uninstall snapd after every Ubuntu install
Don't forget a --purge for extra wantonness.
Earlier quoted context omitted.
While this incident isn't good, I still think the setup is a ton better than Flathub, where you have flatpaks being maintained by third parties with no relationship to the software vendors. For example, all of the Jetbrains snaps are managed by a volunteer, as is Zoom (!) Compromise one of those devs' personal computers, and you've now got a path to getting a backdoor out to everybody using those. I trust Canonical's…
I agree, FlatHub isn't ideal either. They also fail to make it clear that the flatpak isn't made by the developers of the software, the "developers" on the Zoom snap lists zoom.us, and the only potential indication that it might not be official is the "See details" link under "Publisher" which takes you to a github contributors list. How is a user supposed to decide whether they want to trust a flatpak published main…
Earlier quoted context omitted.
Is the third party maintainer relationship a policy choice by flatpak? or is that just the case because the maintainer built the flatpak first?
It's because Zoom / Jetbrains haven't stepped up to package their software as flatpak, so volunteers got in there. There's a flathub policy that a flatpak project will be handed over to the vendor to maintain if they make that request - which is definitely good, but the fact of those volunteers being able to do this (however well intentioned) is not.
This kind of thing is vindicating for those of us who stayed away from snaps precisely because the server side is proprietary and the snap tooling only supports Canonical's centralized store. A centralized service being the only option for software distribution is too large of a failure point, no matter who's running it.
I have plenty of gripes with Snap but this time the Signal team is to blame.
Signal Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again.
Whoa. That's unexpected.
Signal Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again.
Typical behavior from Signal. They have a track record of hostility that we as a community should really not be tolerating. I do not use Signal and I tell my friends not to, either. Play nice or don't play at all.
Earlier quoted context omitted.
No one knows [1], except Snap. Not even the maintainers :( Snaps response [2] seems to be: > I understand the sudden move of signal-desktop can be disruptive for people wishing to install this package. Just to confirm the reason for the absence - Snap Store administrators had to remove the snap in accordance with our policies. We hope to have it back shortly. 1. https://github.com/snapcrafters/signal-desktop/issues/7…
Maybe they're under a gag order? Or there's a critical vulnerability they don't want to disclose yet?
Signal Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again.
Yet another reason not to use Signal. The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Instead they send their legal team...
This is a multi-level failure.
1. Signal-Desktop is AGPLv3: https://github.com/signalapp/Signal-Desktop
2. The snap package metadata is AGPLv3: https://github.com/snapcrafters/signal-desktop
So, this looks like a fraudulent DMCA claim by Signal, as the snap package maintainers and Canonicial have an open source license! This shows malice by Signal.
3. No-one from Canonical contacted the package maintainer(s) about the DMCA, so they have no opportunity to counterclaim or defend.
This is an open sign Snap should not be used. Because utterly unjustified DMCA claims will result in the removal of a package without any way to contest. This is compounded by Canoncial's controlling methodology with Snap where it is ostensibly open-source but Canonical controls what is permitted with snap through a closed-source server.