Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snap Store administrators removed signal-desktop from Ubuntu Snap

forum.snapcraft.io

Post reply on HN
Print view View original

351–360 of 443 posts

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#351

Post by michaelmrose »

jcastro wrote: post #320
tssva wrote: post #297

Earlier quoted context omitted.

I can think of a lot of reasons why publishers of privacy and security related software would want to direct distribute their software rather than relying on 3rd parties if it is avoidable.

There's also just as many reasons to not give Signal root on my PC by installing their .deb package.

Signal is secure communications used not only by nerds but in situations in which privacy is a requirement for safety. In this singular case do you think its a greater security risk that someone may compromise signal and ergo your computer or that one or more of 97 different stores/repos with a multitude of different maintainers get attacked and used to first compromise your communications and then probably your computer as well?

Remember you are expecting the maintainer to not only be honest you are expecting them to secure his own machine as well.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#352

Post by codedokode »

woodruffw wrote: post #346
turminal wrote: post #338

Earlier quoted context omitted.

Why doesn't signal have a package in the official debian repo? I don't want to add random deb repositories for software like that.

It's not a "random" repository, it's their official repository. They seem to be doing everything right (or as right as possible), including providing a signing key (which you can independently verify) and using an HTTPS host. What's your threat model here? Trusting Signal to provide the binary and host the servers, but not distribute the binary that connects to the servers?

Adding third-party repositories is actually dangerous because they can replace packages on your system (for example, bash) and run scripts with root privileges during installation.

Sadly many Linux distributions do not have user-friendly ways to install third-party applications and as a result we see instructions on running curl via sudo bash.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#353

Post by yamtaddle »

jrumbut wrote: post #50
cuteboy19 wrote: post #19

Earlier quoted context omitted.

It's standard policy for me to uninstall snapd after every Ubuntu install

I haven't used Ubuntu recently, hadn't heard of snaps, and this entire thread has been a horrifying introduction.

The whole snap thing is clearly doomed anyway. It's got no chance of "winning" the new wave of app distribution on Linux, being easily the most-hated of the three taking any kind of similar approach (AppImage, Flatpack). Canonical just hasn't thrown in the towel yet, for whatever reason.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#354

Post by codedokode »

irthomasthomas wrote: post #296
dheera wrote: post #262

Earlier quoted context omitted.

Too difficult. Their install instructions are also too complicated and involve reading about 5 lines of comments and 4 shell commands. It should NEVER be more than 1 line of shell or 2 mouse clicks to install anything. This is 2022, not 1995. It's faster to just search for "signal" in the snap store and hit "Install".

It's 5 lines. Took me 30 seconds. Well worth it for the performance gains. wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg && cat signal-desktop-keyring.gpg | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null && echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' |…

This is not secure at all because you just gave Signal root access to your system. By adding their keys you also have granted a permission for Signal to replace any packages on your system.

I would instead manually download and unpack the app, create separate user for it, and run it in chroot. Much safer than your method.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#355

Post by Waterluvian »

brianacton wrote: post #305
mesebrec wrote: post #65

Signal Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again.

Correct. We spoke to our attorneys and found the breakdown in communication. We are working to rectify and reinstate signal-desktop ASAP. Sorry for the confusion.

If possible and reasonable, it would be great to get a short post-mortem on this (because they shouldn't always be for technical issues!)

Trying to prevent legal from being overzealous while not chilling their ability to do their job seems like a very challenging problem.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#356

Post by woodruffw »

progval wrote: post #349
woodruffw wrote: post #346

Earlier quoted context omitted.

It's not a "random" repository, it's their official repository. They seem to be doing everything right (or as right as possible), including providing a signing key (which you can independently verify) and using an HTTPS host. What's your threat model here? Trusting Signal to provide the binary and host the servers, but not distribute the binary that connects to the servers?

Trusting Signal to provide the source and host the servers.

Okay, but that's not what any of the parties in this current case are doing: the Snap in question is a third-party build, not a source distribution.

My understanding (as an outsider) is that Signal doesn't object to you building yourself a copy of Signal Desktop for source, but they do object to anybody building it for others, especially when they brand it as "Signal." That doesn't seem especially unreasonable to me: E2EE is a domain where trust is established exactingly; a proliferation of unreviewed third-party builds compromises environmental trust.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#357

Post by ChuckNorris89 »

marginalia_nu wrote: post #313
irthomasthomas wrote: post #296

Earlier quoted context omitted.

It's 5 lines. Took me 30 seconds. Well worth it for the performance gains. wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg && cat signal-desktop-keyring.gpg | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null && echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' |…

Yeah, let's teach users to paste sudo commands into the terminal. That's great.

>Yeah, let's teach users to paste sudo commands into the terminal. That's great.

This is also one of my fears with pushing non tech savvy people away from Apple/Windows and onto Linux without the Snap, Flathub, or other such curated stores that ship with the distro, without which they would need to touch the terminal and run commands found on the internet.

GNU/Geeks will keep shouting religiously how insecure Windows is because "grandma can download a dodgy .exe pretending to be a game and get viruses", but on Linux it's the same shit or worse, all you have to do is to convince a user new to Linux to paste and run a sudo command in the terminal as instructed by some scammy tutorial he found on Youtube when searching for "how to install Fortnite on Linux" and it's game over for him, since Youtube removed the downvote counter and the user had no idea he was running into a trap.

After all, for most Average Joes, copying some text feels far less dangerous than downloading and opening a strange file.

At least Windows Defender will most likely catch that malware you downloaded and warn you about it being harmful, but on Linux you have no such guardian nanny to save you. With sudo, it will do whatever self-destructive thing you tell it to do and not complain.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#358

Post by alias_neo »

dheera wrote: post #237
nimbius wrote: post #114

Earlier quoted context omitted.

Moxies always been fairly dictatorial about Signal. no third party clients, no decentralization. im not surprised to see a DMCA at all. So far Signal is a centralized encrypted messaging app that includes its own cryptocurrency and wallet no one asked for, shills me for donations every other release, and begs me to invite new users despite deprecating regular SMS message support. if youre a threat-actor the most male…

> no third party clients Isn't their client open source? If I compiled it myself, is that a third party client? If they don't let me compile it myself, how can I trust their official version is using the source they published?

You can build their client and use it yourself, but they don't want you to distribute it and they don't want you using their infra and API from a third party client.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#359

Post by woodruffw »

codedokode wrote: post #352
woodruffw wrote: post #346

Earlier quoted context omitted.

It's not a "random" repository, it's their official repository. They seem to be doing everything right (or as right as possible), including providing a signing key (which you can independently verify) and using an HTTPS host. What's your threat model here? Trusting Signal to provide the binary and host the servers, but not distribute the binary that connects to the servers?

Adding third-party repositories is actually dangerous because they can replace packages on your system (for example, bash) and run scripts with root privileges during installation. Sadly many Linux distributions do not have user-friendly ways to install third-party applications and as a result we see instructions on running curl via sudo bash.

Yes, I suppose Signal could replace other packages on your system by updating their package lists with versions newer than those on the official index.

But again: what's the threat model here? If you're worried about someone stealing your messages, then they don't need root access -- they just need to give you a malicious build of Signal. That's way easier in an unofficial ecosystem like Snap than it is with a third-party package repository that Signal's developers are signing for.

(My understanding is that you can also configure apt to limit packages on a per-source basis, but I won't recommend that since I don't think anybody bothers to do that.)

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#360

Post by fweimer »

cyberphobe wrote: post #200
googlryas wrote: post #75

Earlier quoted context omitted.

So you're saying signal requested their own program be removed from the snap store? Sorry, I'm a little confused on terms. When you say snap maintainer, are you saying you are the maintainer of the signal snap package, or that you're a maintainer of snap itself?

Wasn’t their own program. They have a binary they distribute, this was some other binary calling itself Signal without their approval.

What are the terms that Signal attaches to the binaries?

If unmodified binaries are redistributed, there is no trademark violation. It's nominative use, and simply not misleading the public because it's the genuine article. Any obstacle to redistribution must therefore come from the copyright licensing terms (if the binaries are available to the general public), or from an individual agreement with the original recipient of the binaries (so no direct free, public downloads even if the binaries are technically under an open-source license, and export compliance is a bit more difficult). Not sure which applies here, but it's not a trademark issue.

Post reply on HN