Not the first time this has happened, but recently the Snap store from Canonical hosted a scam bitcoin app that claimed to be Exodus wallet that caused a user to lose money.
      • inetknght ( inetknght@lemmy.ml ) 
        31·
        3 years ago

        Disabling a systemd service won’t prevent it from starting. For example, if another service depends on it then it will start anyway.

        You have to mask the service which redirects the service files to /dev/null so that the service effectively has zero directives.

        systemctl mask --now snapd

        It also means that anything which depends on snapd will likely fail. That is absolutely an improvement since we obviously don’t want anything that depends on snaps.

        • Oisteink ( Oisteink@feddit.nl ) 
          9·
          3 years ago

          What’s wrong with just removing snap? When ever I am forced to install Ubuntu I will remove snap and the “advantage-tools” (the part trying to sell you support)

          First I’ll snap remove —purge all snap packages Then apt purge —auotoremove snapd ubuntu-advantage-tools

          • caseyweederman ( caseyweederman@lemmy.ca ) 
            6·
            3 years ago

            Leaves behind a bunch of stuff. You have to manually remove each Snap individually, plus the snapshots they take and then hide, and then use Snap to remove itself (it doesn’t let you), then you can apt purge snapd.
            There’s several levels of “we know better than you so we’ll just keep this here for when you inevitably change your mind” and it is exhausting.
            I don’t even know if the above would also clean up all the dev/loop cruft. It was an unpleasant surprise to discover that apt remove alone didn’t at least disable all the systemd .mount units.

            • Oisteink ( Oisteink@feddit.nl ) 
              1·
              3 years ago

              There’s like one directory left after my uninstall - I don’t do this by hand though so I’ll have to look up the playbook.

              My first line was the snap remove

              Might need an autoremove —purge at the end to clean up.

    • IHeartBadCode ( IHeartBadCode@kbin.social ) 
      14·
      3 years ago

      It absolutely could. Heck, RPMs and DEBs pulled from random sites can do the exact same thing as well. Even source code can hide something if not checked. There’s even a very famous hack presented by Ken Thompson in 1984 that really speaks to the underlying thing, “what is trust?”

      And that’s really what this gets into. The means of delivery change as the years go by, but the underlying principal of trust is the thing that stays the same. In general, Canonical does review somewhat apps published to snapcraft. However, that review does not mean you are protected and this is very clearly indicated within the TOS.

      14.1 Your use of the Snap Store is at your sole risk

      So yeah, don’t load up software you, yourself, cannot review. But also at the same time, there’s a whole thing of trust here that’s going to need to be reviewed. Not, “Oh you can never trust Canonical ever again!” But a pretty straightforward systematic review of that trust:

      • How did this happen?
      • Where was this missed in the review?
      • How can we prevent this particular thing that allowed this to happen in the future?
      • How do we indicate this to the users?
      • How do we empower them to verify that such has been done by Canonical?

      No one should take this as “this is why you shouldn’t trust Ubuntu!” Because as you and others have said, this could happen to anyone. This should be taken as a call for Canonical to review how they put things on snapcraft and what they can do to ensure users have all the tools so that they can ensure “at least for this specific issue” doesn’t happen again. We cannot prevent every attack, but we can do our best to prevent repeating the same attack.

      It’s all about building trust. And yeah, Flathub and AppImageHub can, and should, take a lesson from this to preemptively prevent this kind of thing from happening there. I know there’s a propensity to wag the finger in the distro wars, tribalism runs deep, but anything like this should be looked as an opportunity to review that very important aspect of “trust” by all. It’s one of the reasons open source is very important, so that we can all openly learn from each other.

      • Oisteink ( Oisteink@feddit.nl ) 
        3·
        3 years ago

        Nice try canonical - no matter what you say snaps is just your way to lock people in to your store. You’re no better than apple, only your product is shit. Excluding the shoulders you stand on, which are made by others. You’re the enshitification of Linux.

        Why would you pull debs from random sites? Do you know how hard that is to do for the average user? And you want to compare that to a download from the store that’s in the basic install on Ubuntu?

    • Empricorn ( Empricorn@feddit.nl ) English
      5·
      3 years ago

      When it does, we’ll deal with it. But in the meantime, the motivation is important. Canonical developed and aggressively pushed Snaps despite most people hating them because… it made then more money.

  • onlinepersona ( onlinepersona@programming.dev ) English
    30·
    3 years ago

    I don’t think you understand, it’s closed-source for your safety! If it were opensource there would be many more malicious apps. Only we can hold those at bay and only we know which improvements to implement as we know better than everybody else. Trust me, you’re safer this way /s

    CC BY-NC-SA 4.0

    • Domi ( domi@lemmy.secnd.me ) 
      16·
      3 years ago

      The architecture is literally better than Flatpak

      Why?

      I don’t understand why people are so hell bent on hating Snaps.

      Every single time I tried snaps in the last years I had a bad time. Either they were slow to start, refused to work (Docker snap) or made my machine boot significantly slower. Granted, I haven’t bothered in a year or so.

      At this point they just released unfinished software that was not ready for production, forced it onto people and are surprised when everybody remembers snap as being partially closed source, slow and unreliable. Even if it’s not now, that’s how the first impression was and it’s going to stick forever.

    • GnomeComedy ( GnomeComedy@beehaw.org ) 
      1·
      3 years ago

      I hate them because they make Ubuntu useless for a desktop in an enterprise environment. Snaps have a bug where they will NOT open with a network home directory, which is common for a business … And now they’ve made Firefox snap only.

      So for a business environment: you can’t even open the included web browser. WTF?

      Do you understand now?

  • potentiallynotfelix ( potentiallynotfelix@iusearchlinux.fyi ) 
    9·
    3 years ago

    I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps I hate snaps