Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Snap Store administrators removed signal-desktop from Ubuntu Snap

forum.snapcraft.io

Post reply on HN
Print view View original

421–430 of 443 posts

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#421

Post by rosnd »

marginalia_nu wrote: post #381
rosnd wrote: post #374

Earlier quoted context omitted.

Is it meaningfully sketchier than downloading a .deb and calling dpkg -i on it? Or cloning a git repo and building it?

The difference is that the stream coming out of curl and entering sh is ephemeral. With this device, there is no checksum or signature (as with apt). If you pipe curl into sh, you also leave no trail of what you've run. A malicious actor can also hinder analysis by serving different payloads per user-agent, per time of day, per subnet; or only serving the malicious payload intermittently. With .deb-files you're expec…

>Compiling from sources is a bit sketchy, but it is also the vector that is easiest to analyze, so I think they cancel out.

Is it really meaningfully easier to analyse? I get that it feels better, but I'd bet that the people saying this would fail to catch the backdoor every time.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#422

Post by ElijahLynn »

SSLy wrote: post #87
ElijahLynn wrote: post #79

Earlier quoted context omitted.

Thanks for the explanation Galgalesh! Can you post this update on the Snapcraft ( https://forum.snapcraft.io/t/what-happened-to-signal-desktop... ) and GitHub threads ( https://github.com/snapcrafters/signal-desktop/issues/70 ) too? I was going to just now and cross link back here to your comment and figured it would be better coming from you directly!

They just did comment on that discourse thread.

Thanks, I see it here now in both places > https://forum.snapcraft.io/t/what-happened-to-signal-desktop... & https://github.com/snapcrafters/signal-desktop/issues/70#iss....

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#423

Post by lcnPylGDnU4H9OF »

jdiff wrote: post #392
lcnPylGDnU4H9OF wrote: post #390

Earlier quoted context omitted.

I don't get why Signal being tech-centric (whatever that means) should disallow their lawyers from sending DMCA takedown requests.

Because it means their lawyers are firing off in random, uninformed directions. There's no copyright issue, as the maintainers of the Snap have a copyright license (the AGPLv3) to do what they are doing. You could argue that it's a trademark issue, except that if it was, this makes a DMCA request illegal as it's not a tool to enforce trademark issues. And in addition, while the AGPLv3 has allowances for trademark car…

Well, okay, but that's not answering my comment.

> ... a company that prides itself on being tech-centric ...

I can't see why this matters. Wouldn't it also be a worthy question for $NOT_TECH_COMPANY if their lawyers send a DMCA takedown request in such a manner?

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#424

Post by jdiff »

spullara wrote: post #396
jdiff wrote: post #379

Earlier quoted context omitted.

It wasn't against the license. It's AGPL v3, about as open as it gets.

You don't get the license without respecting the trademark. e) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; or

Read the full context of that rule. The entire section allows those provisions to be applied, it does not make those provisions. The APGLv3 disallows any further restrictions beyond the license to be applied, except for a handful of exceptions. That's one of them. And if such an exception is made, further instructions are provided to inform downstream users of them. Signal did not follow those instructions and didn't make any of the permitted exceptions.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#425

Post by jdiff »

woodruffw wrote: post #356
progval wrote: post #349

Earlier quoted context omitted.

Trusting Signal to provide the source and host the servers.

Okay, but that's not what any of the parties in this current case are doing: the Snap in question is a third-party build, not a source distribution. My understanding (as an outsider) is that Signal doesn't object to you building yourself a copy of Signal Desktop for source, but they do object to anybody building it for others , especially when they brand it as "Signal." That doesn't seem especially unreasonable to me…

The Snap's build instructions do nothing but download the .deb and repackage it into a Snap.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#426

Post by jdiff »

hiq wrote: post #389
turminal wrote: post #338

Earlier quoted context omitted.

Why doesn't signal have a package in the official debian repo? I don't want to add random deb repositories for software like that.

One potential reason is that their release cycle is too fast for the official Debian repositories, and they don't want to slow it down. Supporting old versions is a cost they don't want to bear.

All of their builds have shelf lives of 90 days. You must update at least that often or your app will stop working, so it's a non-starter for inclusion in the official Debian repos.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#427

Post by jdiff »

bpicolo wrote: post #253
mort96 wrote: post #231

Earlier quoted context omitted.

No. A DCMA takedown is your lawyers contacting their lawyers and saying that you're invoking a law which forces them to immediately take something down or risk severe legal ramifications. Isn't it better to reach out without invoking a DCMA and see if the other party is willing to cooperate first?

If their explicit goal is having it taken down, and the law gives them explicit ability to do so, why would they waste the time? A DMCA isn't rude, it's just a strictly outlined process.

The law doesn't give them the ability, as the DMCA is for copyright and with an unrestricted free software license, there is no copyright issue. The takedown itself was illegal.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#428

Post by jdiff »

lcnPylGDnU4H9OF wrote: post #423
jdiff wrote: post #392

Earlier quoted context omitted.

Because it means their lawyers are firing off in random, uninformed directions. There's no copyright issue, as the maintainers of the Snap have a copyright license (the AGPLv3) to do what they are doing. You could argue that it's a trademark issue, except that if it was, this makes a DMCA request illegal as it's not a tool to enforce trademark issues. And in addition, while the AGPLv3 has allowances for trademark car…

Well, okay, but that's not answering my comment. > ... a company that prides itself on being tech-centric ... I can't see why this matters. Wouldn't it also be a worthy question for $NOT_TECH_COMPANY if their lawyers send a DMCA takedown request in such a manner?

I'm not sure I understand your confusion entirely, would appreciate some clarification.

It's bad in any case, it's worse when you're uninformed on an issue core to your entire mission. This is an area their lawyers should be exceptionally experienced and informed in, where it'd be potentially easier to forgive a lawyer completely green on FOSS making a mistake on something they thought was straightforward.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#429

Post by lcnPylGDnU4H9OF »

jdiff wrote: post #428
lcnPylGDnU4H9OF wrote: post #423

Earlier quoted context omitted.

Well, okay, but that's not answering my comment. > ... a company that prides itself on being tech-centric ... I can't see why this matters. Wouldn't it also be a worthy question for $NOT_TECH_COMPANY if their lawyers send a DMCA takedown request in such a manner?

I'm not sure I understand your confusion entirely, would appreciate some clarification. It's bad in any case, it's worse when you're uninformed on an issue core to your entire mission. This is an area their lawyers should be exceptionally experienced and informed in, where it'd be potentially easier to forgive a lawyer completely green on FOSS making a mistake on something they thought was straightforward.

I think a lawyer that's completely green on FOSS and working for any company I've heard of should never have been hired. Maybe I'm naive but that sounds insane to me.

To clarify, any lawyer working for any company with a publicly available, physical (read: non-software or computer hardware) product or service that I've heard of should never make this mistake. That's why I wouldn't think it's especially weird that the company in question is one who offers a software product.

Anyway, you do otherwise make a good point. I can understand that someone sees it that way. (And thanks for explaining your perspective!)

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#430

Post by jdiff »

charcircuit wrote: post #408
mort96 wrote: post #231

Earlier quoted context omitted.

No. A DCMA takedown is your lawyers contacting their lawyers and saying that you're invoking a law which forces them to immediately take something down or risk severe legal ramifications. Isn't it better to reach out without invoking a DCMA and see if the other party is willing to cooperate first?

>Isn't it better to reach out without invoking a DCMA and see if the other party is willing to cooperate first? That would still be your lawyers talking to their lawyers. The channels for handling DMCA takedowns are much more efficient than channels for handling something custom.

Those channels are illegal to use outside of the copyright issues they're intended for. It's not just a free "hey take this down for me, will ya?" button.
Post reply on HN