After repeatedly suffering issues with scam apps making it onto the Snap Store, Canonical maker of Ubuntu Linux have now decided to manually look over submissions.
    • @VerseAndVermin@lemmy.world
      1•1 year ago

      I’m using Mint and new to it. Does the Mint app store have more security or scrutiny? I’m cautious as most things are lucky to have one or two reviews listen. Many are zero though and it’s not quite clear to me yet how to tell if things are from an official source or if they had review.

      • @RmDebArc_5@sh.itjust.worksEnglish
        1•1 year ago

        Packages are usually not official but maintained by your distro, so there are pretty strict controls, especially on Linux Mint Debian edition. Flatpaks on the other hand come from flathub and are less controlled, but since they’re sandboxed the security is still good. If you open the website you can see which apps are verified (official) and which aren’t. Flatpaks also have more user reviews in the most cases

  • @wiki_me@lemmy.mlEnglish
    23•1 year ago

    How is that not a security theater? , you just need to :

    • publish a good snap
    • change it to malware after it is approved
    • profit

    The extra cost added to override this is fairly small, i don’t think it will help.

    • @progandy@feddit.de
      18•1 year ago

      At least this prevents impersonation of well-known publishers or their software. Maybe all changes to metadata like the description should require a manual review even for established packages.

      • @wiki_me@lemmy.mlEnglish
        0•1 year ago

        At least this prevents impersonation of well-known publishers or their software

        how?

        • @progandy@feddit.de
          5•1 year ago

          That depends on the depth of the review, e.g. verifying the submitter is a member of the project, the software name does not conflict with a well known name,…

          • @wiki_me@lemmy.mlEnglish
            1•1 year ago

            verifying the submitter is a member of the project

            That’s a different requirement as far as i can tell (When you do that you get the “plus” sign next to the name on the store).

            the software name does not conflict with a well known name,…

            It should conflict, the point is that some random dude can create a package and people could use it.

            They can review and check that the URL in the manifest used to build or install the package is from upstream, but that can later be changed, it would be better to have some system where you need to whitelist URL’s i think.

  • @octopus_ink@lemmy.mlEnglish
    21•1 year ago

    I’ve heard all the arguments about how these new packaging formats are supposed to make things easy for developers and for users with different use cases than my own (apparently), but I will continue to avoid them until they have further matured. I’m relieved that this is still possible.

    • @tempest@lemmy.ca
      15•1 year ago

      The idea is good I think but the implementation has only ever caused me problems and seems to have a bunch of frustrating edge cases.

      • @ipkpjersi@lemmy.ml
        5•1 year ago

        I’ve been using snaps for a few years now and while they still could use some improvements, the snaps I’m currently using seem to be fairly indistinguishable from deb-based packaging thanks to bug fixes they have done over the years. I think the idea of containerized applications is a good one, I think it actually can be safer. Performance is also fine for me with snap applications even like Firefox snap startup speed, although I’m using an R9 5900x and Gen 4 M2 NVMe SSD so maybe that’s why, or maybe they really have improved the snap software and it is just as fast now for the most part.

        • @ben_dover@lemmy.ml
          5•1 year ago

          I’ve had to swap Firefox on my laptop for the deb package, the snap took like 5sec to open, whereas the deb opens instantly. Other than that, i don’t see much of a difference, but i run into sandboxing issues quite often (same with flatpak though)

          • @ipkpjersi@lemmy.ml
            2•1 year ago

            I had a “Save As” issue in Firefox snap where it just wouldn’t be able to save pages, but since upgrading to either Ubuntu 20.04 or 22.04 (can’t remember which version fixed it), that problem has gone away entirely.

    • @___@lemm.ee
      4•1 year ago

      The problem for me is portability. Flatpak, Snap, Appimage, docker, podman, lxc, they all do the same thing, but they’re splitting the market into “servers” and “desktops”.

      We need a portable container runtime we can build from a compose file, run cli or gui apps, and migrate to a server with web app capability displaying the UI. There are too many build targets, and too much virtual market segmentation.

      Nix tries to solve the issue, but the problem is you have to use Nix.

    • RichardEnglish
      -3•1 year ago

      True. Actual package managers are still thousands of times superior to flat and snap.

      • @Pantherina@feddit.de
        5•1 year ago

        That scentence makes little sense as both are using package managers that work similarly. Flatpak even uses ostree which is more advanced.

        • @octopus_ink@lemmy.mlEnglish
          1•1 year ago

          My thing (I’m not the guy you replied to) is all the various user-facing complaints that I tend to see in these discussions. I use a distro where I can get current versions of anything I’ve ever needed, and I know how to maintain my system.

          As a user, even if the various alternatives are fine most of the time, without concerns about security, integration, etc - I’ve never read anything that would make me want the additional complication. (I say this recognizing that there are security concerns regardless of how you get your software - I’m not saying these new solutions are inherently worse in that regard.)

          I suppose at some point I’ll want or need to embrace flatpak/appimage/snaps, but I can’t find any reason I’d do so now - it feels like it increases the number of gotchas I need to worry about when installing software without actually giving me anything I want that I don’t already get with my “legacy” package manager.

          • @Pantherina@feddit.de
            2•1 year ago

            We dont live in such a perfect world. Linux has a small marketshare for non-server software, so packaging is done by your distro.

            You would need to have user-facing settings for Apparmor or SELinux to replicate what already exists with Flatpak.

            Principle of least privilege.

            Maybe you prefer native packages, but bubblejail or SELinux confined users are complicated as hell and both are pre-alpha in my experience.

            So yes you add bloat, dependencies etc. But you also add stability, a small core system, take load of OS developers and unify the packaging efforts so that it is done by developers not packagers.

            This reduces complexity a lot, as the underlying system is not as important anymore, and you can just use whatever you want. Software is separated from the OS.

            Flatpak is the only good format, as explained in this talk

            (Snap has no sandboxing outside of Ubuntu and is thus not portable, Appimages are inherently insecure)

            • @octopus_ink@lemmy.mlEnglish
              2•1 year ago

              I will check out the video, thanks! I still say you can have the aur and arch repos when you pry them from my cold, dead fingers, but I’m openminded.

  • @ikidd@lemmy.worldEnglish
    4•1 year ago

    Just remove the crypto bullshit apps and 99% of the problems will go away.

    And maybe release the SnapStore code so they can all scam each other over there.