this post was submitted on 12 May 2024
20 points (95.5% liked)

Linux

48003 readers
1003 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

@linux Sharing a 'small' inconvenience I had to fix with #opensuse #slowroll (I suspect #tumbleweed is the same) - I couldn't launch snaps (spotify, bitwarden) after update - error was: cannot determine seccomp compiler version in generateSystemKey fork/exec /usr/lib/snapd/snap-seccomp: no such file or directory

The fix (I first tried re-installing, didn't work) was to:
a. locate snap-seccomp - was in /usr/libexec/snapd
b. symlink: ln -s /usr/libexec/snapd /usr/lib/snapd

#linux #snap

you are viewing a single comment's thread
view the rest of the comments
[–] thegreybeardofthetree@fosstodon.org 4 points 5 months ago (3 children)

@pastermil @linux the attack surface for something that isn't officially maintained by the developers, and that doesn't have more vetting (e.g. distribution packages) opens up room for malicious actors.

e.g. #arch / #aur recommends verifying scripts manually before installing, and malicious scripts have been found and removed.

There are actors like #jiatan out there. An unofficial #flatpak needs manual verification before install - that's why I just go with #snap if the flatpak isn't official

[–] alxlg@mastodon.social 5 points 5 months ago

@thegreybeardofthetree @pastermil @linux

FYI FlatHub uses GitHub Actions, you can check how they build their apps and some of them support reproducible builds, just in case you want to verify GitHub isn't acting maliciously.

FlatHub and AUR can't really be compared in terms of security. Flatpak apps also don't modify the host OS, while AUR packages can.

Personally, I only trust distro packages and FlatHub.

[–] Bitrot@lemmy.sdf.org 4 points 5 months ago* (last edited 5 months ago) (1 children)

Are you sure snapcraft requires the original developer publish snaps? This seems unlikely, but they may have updated their policies.

Edit: they aren’t, Signal for example is an unofficial snap not published by the Signal developers but rather “snapcrafters” - https://snapcraft.io/signal-desktop. This is very similar to how Flathub handles unofficial packages, except Flathub seems to have more gatekeeping (Snapcrafters doesn’t allow just anyone, but you don’t have to be part of that group to publish).

Snapcraft has hosted multiple malicious applications, so I wouldn’t exactly call it a safe place either.

[–] thegreybeardofthetree@fosstodon.org 3 points 5 months ago* (last edited 5 months ago)

@Bitrot @linux interesting, thank you for that information: I had been under the impression they did do manual verification of authors.

I did some checking: the closest I found to verification was this (so you're right- no need to be the original author, but a bit of vetting does seem involved).

https://forum.snapcraft.io/t/manual-review-of-all-new-snap-name-registrations/39440

My takeaway here is to use whatever the software authors recommend ( on their website.. assuming trusted authors)!

[–] pastermil@sh.itjust.works 1 points 5 months ago

the attack surface for something that isn't officially maintained by the developers, and that doesn't have more vetting (e.g. distribution packages) opens up room for malicious actors.

There are actors like #jiatan out there.

Funny that Jia Tan was an official maintainer of xz until he was found to be problematic.

Speaking of verifying, you know you can't really verify anything on the snap server since they're proprietary, right? On the contrary everything on flathub is laid to bare for anyone to look at.

In the end, you're free to choose. Since you've kindly provided your argument, I've provided mine in hope you'd reconsider.