Snap Store administrators removed signal-desktop from Ubuntu Snap • Hacker News Board

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#91

Post by aftbit » Thu, Nov 03, 2022, 3:38 PM UTC

ilaksh wrote: post #30

Well, I have been using Ubuntu for many years. This kind of thing, centralizing packages and removing one without explanation etc makes me think I should move on. I suppose the alternative is to switch to Debian? Or maybe there is something totally different that is becoming popular that I don't know about yet?

Debian is probably the move if you want to keep stability, security, and minimize disruption. Most Ubuntu PPAs work on Debian too, in case that matters to you. I personally run Arch Linux on my dev machine, which has its own share of issues (mostly breaking changes due to being a continuous release distro with a focus on being up to date), but the Arch User Repository (AUR) is really good. IMO stay away from the redhat distros like Fedora.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#92

Post by voakbasda » Thu, Nov 03, 2022, 3:38 PM UTC

sarnowski wrote: post #13

mort96 wrote: post #8

Earlier quoted context omitted.

Another perspective: Canonical's IoT offering, Ubuntu Core, is based around the idea that Canonical provides the base operating system, and you provide your software as a snap, uploaded to Canonical's snap store, and you push updates to your IoT product by pushing an updated snap to the store. That has always rubbed me the wrong way, but "Canonical will just delete the snap and not respond to questions about why" was…

And last time I checked, they refused to let you use your own signing keys. Means you do not get end to end trust for your own bits but need to rely on Canonical that they don’t screw up - with the obvious effect of strong vendor lock-in as I cannot sign and run my own bits.

Couldn't you just double sign your bits? Sign your payload with your key, then wrap that in a snap with their key; snap verifies the outer sig, then an "inner" installer verifies the sig of the payload. That said, I would run screaming from an ecosystem with such insanity.

In fact, I am poised at the starting line of that sprint, but I'm still trying to decide what my next distribution will be that provides similar quality and cadence. It's a somewhat sad day, as my servers have been running Ubuntu for almost two decades. A switch will be immensely painful, but the state of their snap crap is pushing me to switch all of my systems once and for all. Worse for Canonical, I then will be taking all of the systems in my engineering division to those greener pastures.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#93

Post by boudin » Thu, Nov 03, 2022, 3:38 PM UTC

smallerfish wrote: post #62

mort96 wrote: post #3

This is not a good look. The snap has been gone for almost a month, with seemingly no information given to the maintainer or users about why, except a belated "we removed it for policy reasons" 21 days ago. And if this happens to maintainers associated with Snapcrafters , imagine how you're treated if you're just some random person or company who maintains your own snap. This is the sort of reason why people are conc…

While this incident isn't good, I still think the setup is a ton better than Flathub, where you have flatpaks being maintained by third parties with no relationship to the software vendors. For example, all of the Jetbrains snaps are managed by a volunteer, as is Zoom (!) Compromise one of those devs' personal computers, and you've now got a path to getting a backdoor out to everybody using those. I trust Canonical's…

Most of what runs on any computer is built by volunteers. Most open source softwares relies on volunteers.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#94

Post by bioemerl » Thu, Nov 03, 2022, 3:38 PM UTC

ilaksh wrote: post #30

Well, I have been using Ubuntu for many years. This kind of thing, centralizing packages and removing one without explanation etc makes me think I should move on. I suppose the alternative is to switch to Debian? Or maybe there is something totally different that is becoming popular that I don't know about yet?

I don't see anyone mentioning fedora. Is that a decent alternative?

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#95

Post by junon » Thu, Nov 03, 2022, 3:38 PM UTC

sschueller wrote: post #89

award_ wrote: post #85

Earlier quoted context omitted.

What are your others? I use signal alot personally and haven't had too many issues.

- Still need a phone number - They refuse to post the app on f-droid (directly) - No 3rd party clients allowed on their servers. - Crypto thing they attempted - I don't trust Moxie, he rubs me the wrong way.

Agreed on all counts, especially the last one.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#96

Post by SSLy » Thu, Nov 03, 2022, 3:39 PM UTC

smallerfish wrote: post #71

freedomben wrote: post #69

Earlier quoted context omitted.

Is the third party maintainer relationship a policy choice by flatpak? or is that just the case because the maintainer built the flatpak first?

It's because Zoom / Jetbrains haven't stepped up to package their software as flatpak, so volunteers got in there. There's a flathub policy that a flatpak project will be handed over to the vendor to maintain if they make that request - which is definitely good, but the fact of those volunteers being able to do this (however well intentioned) is not.

This is no worse than distro contributors or say, AUR or Nixpkgs folks packaging 3rd non-free party software.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#97

Post by CoastalCoder » Thu, Nov 03, 2022, 3:39 PM UTC

sschueller wrote: post #74

mesebrec wrote: post #65

Signal Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again.

Yet another reason not to use Signal. The correct behavior would have been for signal to offer an official snap or to contact the maintainer. Instead they send their legal team...

> The correct behavior would have been for signal to offer an official snap or to contact the maintainer.

Are we sure that Signal didn't contact the maintainer? I haven't seen any statements either way about that.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#98

Post by mort96 » Thu, Nov 03, 2022, 3:40 PM UTC

smallerfish wrote: post #62

mort96 wrote: post #3

This is not a good look. The snap has been gone for almost a month, with seemingly no information given to the maintainer or users about why, except a belated "we removed it for policy reasons" 21 days ago. And if this happens to maintainers associated with Snapcrafters , imagine how you're treated if you're just some random person or company who maintains your own snap. This is the sort of reason why people are conc…

While this incident isn't good, I still think the setup is a ton better than Flathub, where you have flatpaks being maintained by third parties with no relationship to the software vendors. For example, all of the Jetbrains snaps are managed by a volunteer, as is Zoom (!) Compromise one of those devs' personal computers, and you've now got a path to getting a backdoor out to everybody using those. I trust Canonical's…

I agree, FlatHub isn't ideal either. They also fail to make it clear that the flatpak isn't made by the developers of the software, the "developers" on the Zoom snap lists zoom.us, and the only potential indication that it might not be official is the "See details" link under "Publisher" which takes you to a github contributors list.

How is a user supposed to decide whether they want to trust a flatpak published mainly by "flathubbot" (according to the page linked by FlatHub) and a bit by various other contributors with names like "TheEvilSkeleton" and "barthalion"? I have no idea.

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#99

Post by bee_rider » Thu, Nov 03, 2022, 3:40 PM UTC

Y_Y wrote: post #15

turblety wrote: post #5

Earlier quoted context omitted.

No one knows [1], except Snap. Not even the maintainers :( Snaps response [2] seems to be: > I understand the sudden move of signal-desktop can be disruptive for people wishing to install this package. Just to confirm the reason for the absence - Snap Store administrators had to remove the snap in accordance with our policies. We hope to have it back shortly. 1. https://github.com/snapcrafters/signal-desktop/issues/7…

That's funny, because in accordance with my policy I delete snap immediately after install.

Unfortunately Firefox is a snap on Ubuntu (eventually I'll get around to switching to a better distro -- "it's a laptop," I said, "it'll be nice to have Ubuntu deal with everything for me," big mistake).

Re: Snap Store administrators removed signal-desktop from Ubuntu Snap

#100

Post by galgalesh » Thu, Nov 03, 2022, 3:40 PM UTC

googlryas wrote: post #75

mesebrec wrote: post #65

Signal Snap Maintainer here, this is because of a DMCA takedown request from lawyers representing Signal. Canonical is currently working with them to clear things up. Canonical's communication to me was initially lacking due to issues in their process, the process has been amended and I'm back in the loop again.

So you're saying signal requested their own program be removed from the snap store? Sorry, I'm a little confused on terms. When you say snap maintainer, are you saying you are the maintainer of the signal snap package, or that you're a maintainer of snap itself?

I'm the maintainer of this unofficial snap package.