TheaterFire

Another crypto-stealing app found in the Snap Store

Posted by that_leaflet@reddit | linux | View on Reddit | 167 comments

Reply to Post

167 Comments

Aristippos69@reddit

Exodus from the SNAP Store stole my last money in BTC today... How can I get in touch with someone from the store before someone really loses money?
View on Reddit #24021751

Buo-renLin@reddit

You should report it on the snap's listing page. You can also escalate the issue by posting to the #snap category of [the Snapcraft Forum](https://forum.snapcraft.io/t/another-crypto-wallet-has-been-in-the-store-for-days/39682/16).
View on Reddit #30059284

that_leaflet@reddit (OP)

The snap has been taken down. Sorry that happened to you. I was really hoping that this issue would have gone away now that Canonical has to approve each new snap, but I guess not.
View on Reddit #24043387

that_leaflet@reddit (OP)

Was is this? https://snapcraft.io/quantumquest
View on Reddit #24031743

mollyforever@reddit

Who's taking bets on when Ubuntu will give up and start using Flathub like every other distro?
View on Reddit #22569966

RomanOnARiver@reddit

Just about when flatpak gains all the features in snap. Among them would need to be support for command line applications. How is flatpak to rollback versions?
View on Reddit #22570342

anna_lynn_fection@reddit

> support for command line applications Jesus, please!
View on Reddit #22573228

snyone@reddit

Is this actually a design goal for flatpak / on their roadmap? I like flats and it would be awesome if cli was supported but thought the general attitude there towards anything cli was "we don't do that here" rather than "maybe someday". Was I wrong?
View on Reddit #22598054

redoubt515@reddit

> Is this actually a design goal for flatpak / on their roadmap? No, in fact they specifically state in their FAQ that Flatpak is intended for graphical *desktop* apps, not CLI.
View on Reddit #23638606

snyone@reddit

Do you have a link where one of the devs / leads actually said they are purposely not intending to support CLI though? From what I remember, it was more that Flatpak did not have support for *services* in particular (IIRC bc then they would need to get into the territory of either needing to lose portability - like how snap only works on systemd - or else deal with a complex logistics nightmare - hooking into multiple possible host init-systems - which would add a significant maintenance burden). On top of that, I think some system utilities like `fdisk` / `mount` etc that don't use services are already included on most distros and it could be that putting them in a bubblewrap sandbox while still granting the permissions needed to actually be useful is challenging? (I don't know on that last one, I'm just spitballing) Anyway, if you look in the github issues for flatpak, there are few comments on various tickets mentioning that vim is supported as a cli app. And it would make sense to me given how a) there are several front-ends on Linux actually just interact with a cli-backend and b) for any app that does not hook into services / other system innards, then a programmatic perspective, cli should require *less* permissions than their graphical counterparts, not more
View on Reddit #23718163

redoubt515@reddit

> Do you have a link where one of the devs / leads actually said they are purposely not intending to support CLI though? I don't think it is so much that they are purposefully seeking to exclude CLI apps. If you look at flatpaks design model, and some of the design decisions, and the docs, it seems quite clear that flatpak is focused on and oriented towards desktop applications, in practice almost all of which are GUI applications. There is this from the [FAQ](https://flatpak.org/faq/): > ***Flatpak is designed to run inside a desktop session*** and relies on certain session services, such as a D-Bus session bus and, optionally, a systemd `--user` instance. ***This makes Flatpak not a good match for a server.*** And from the [docs](https://docs.flatpak.org/en/latest/introduction.html): > Flatpak: a system for building, distributing, and running sandboxed ***desktop applications*** on Linux... > Target Audience: Flatpak can be used by *all kinds of* ***desktop*** *applications* \[...\] The only technical requirements made by Flatpak are that applications follow a small number of Freedesktop standards, in order to enable desktop integration But both of these statements are more focused on Desktop vs non-Desktop, not specifically GUI vs CLI. There is considerable overlap, but those are somewhat different questions. Apart from that, there was a comment on the flatpak mailing list made by flatpak's original author (Alex Larsson) where he alludes to Flatpak not being a good fit for shell scripts that need access to the host system or CLI applications. > This is not really the target usecase for flatpak, but it could very well work \[...\] running the scripts will be somewhat painful \[...\] hardly ideal for CLI use He's also [described](https://www.youtube.com/watch?v=xIjxNtIwcBA) flatpak in the past as 'iOS or Android style apps for the Linux desktop' which seems as if it suggests GUI apps (but maybe that is a wrong assumption on my part). Overall, here is a summary of the main reasons I've heard why CLI applications are not typically packaged as flatpaks: * Flatpak apps are meant to be self-contained, bundled, and sandboxed. CLI apps typically follow the unix philsophy (do one thing and do it well) and are meant to be small and to interoperate with other small CLI tools. The two design philosophies are conceptually at opposite ends of the spectrum. [(link)](https://discussion.fedoraproject.org/t/how-to-install-cli-flatpak-apps/81785/5) * Flatpak is designed around unprivileged, rootless containers, sandboxed from the system. Whereas many CLI applications expect or require root privileges. [(link)](https://www.reddit.com/r/flatpak/comments/10w1lxq/comment/j7kx07i/) * Flatpak containers are restricted from accessing many system directories on the host system. [(link)](https://www.reddit.com/r/flatpak/comments/zx4sp6/comment/ks4f26p/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button) * Flatpak syntax is a little painful and quite tedious and unintuitive from the command line. None of these reasons seem like reasons you absolutely positively can't package CLI tools in any context. But I do think these reasons, go a long way towards explaining why its very rare to see CLI tools packaged as flatpaks, and demonstrate why it is often said that flatpak is designed with desktop GUI apps in mind. TL;DR, I don't think the developers are particularly *opposed* to CLI applications as flatpaks, its more that the design is just specifically focused on desktop user applications, and design decisions have been made with this in mind. I'm not technically informed enough to have a strong opinion on what would need to happen to make flatpak more suitable for typical CLI apps, or if doing so would negatively impact their primary focus and goals.
View on Reddit #23732171

snyone@reddit

Thanks for expanding on that. I hadn't considered some of those particularly the bit about > shell scripts that need access to the host system or CLI applications. though it absolutely makes sense. I guess the real moral of the story is like you say not cli vs gui but whether whatever app is actually a good candidate for being self-contained (e.g. does not requires dependencies, special privileges, host daemons/services, etc) and that there is a stronger interest in packaging graphical apps that fit these requirements. And within the scope of what's technically possible, the trends will probably align closely with common interests.
View on Reddit #23741908

mrlinkwii@reddit

its a valid use case
View on Reddit #22573804

NaheemSays@reddit

It already works. However afaik flathub is for desktop apps so you might need a different location to host it.
View on Reddit #22587052

AdventurousLecture34@reddit

It's for GUI applications mostly. That's why it was called xdg-application
View on Reddit #22594092

abotelho-cbn@reddit

Which is weird, because it can be packaged with OCI, which definitely could support running CLI applications.
View on Reddit #22573497

that_leaflet@reddit (OP)

They're annoying to rollback, you need to specify the hash of the version you want to rollback to.
View on Reddit #22571524

Michaelmrose@reddit

This does give you fine grained control that is trivially correlated with source control
View on Reddit #22577526

that_leaflet@reddit (OP)

It is great that you are able to rollback to any version you want. But it shouldn't be required. For example, a simple ``flatpak rollback appName`` should return you to the previously installed version. If you want to go back to a specific version, then the command should be something like ``flatpak rollback appName --version=hashValue``. As it currently stands, imagine this scenario. An app you use updates and suddenly crashes on every launch. To rollback the version, you need to start googling how to find the list of hash values for the app you use or look at man pages or ``flatpak --help`` pages. Then once you find the hash you want, you type the command. Or imagine if you could just do ``flatpak rollback appName`` and avoid that extra effort.
View on Reddit #22577847

Business_Reindeer910@reddit

really it should allow version to be a a version tag, like it works in git. so you can say 1.5.2 . perhaps with a magic value like previous for your suggestion.
View on Reddit #22582036

snyone@reddit

And/or let you pass some flag to use an interactive mode? I think if it just prompted you that would also be fine for (non-scripted) scenarios. Like during install if you request an ambiguous package, it will ask you to select which one... Why not make it just does something similar about rollbacks where it shows a list of available versions and has you select a number from a list. Seems like that could be a pretty user friendly solution.
View on Reddit #22598268

Business_Reindeer910@reddit

I don't like it when command line applications go accidentally interactive. It makes them harder to script. I'd rather it be more explicit with a flag like --interactive , or alternatively, split it into 2 separate commands, one meant for users and one meant to be scriptable.
View on Reddit #22622437

snyone@reddit

Fair. I too prefer it when things can be scripted easily. But I still think that would be possible within the scope of an --interactive mode
View on Reddit #22655921

Michaelmrose@reddit

This is an argument for a simple function but you can reproduce the same functionality with flatpak remote-info --log $remote $app
View on Reddit #22589064

Last_Painter_3979@reddit

btw, can you use two flatpak apps that have conflicting depencies?
View on Reddit #22593103

Patient_Sink@reddit

What do you mean? Flatpaks either package dependencies with the package itself, or they use common dependencies from a certain runtime. You can have several runtimes installed at the same time without conflicting.
View on Reddit #22595389

Last_Painter_3979@reddit

i wonder about that, i thought that i could not have some dependency in two versions at once.
View on Reddit #22597463

snyone@reddit

I think I might have run into something like this once due to 2 apps requiring different versions of the same dependency but don't remember the specifics. Anyway, I assumed at the time that it was a case of me not knowing wtf I was doing rather than a design problem... Don't remember which apps but more than likely I just went the "fuck this, Imma build from source" route
View on Reddit #22598934

nandru@reddit

I have this with Mesa, kde platform and freedesktop poatform. Currently have 2 versions of those installed, used to have like 3 or 4 of some of them
View on Reddit #22601244

snyone@reddit

I stand corrected then. Thanks for the feedback
View on Reddit #22601416

MetaTrombonist@reddit

You can already run flatpak apps as command line applications. Just add /var/lib/flatpak/exports/bin to your path or use aliases.
View on Reddit #22580071

Pay08@reddit

That's not what he meant.
View on Reddit #22636009

natermer@reddit

I would very much rather Flatpak continue work on improving their security, permissions, and portal design for desktop apps rather then chasing feature parity with Snaps. Snaps and Flatpak have different focuses. Snaps is general purpose, Flatpak is specifically for desktop applications. Existing solutions around OCI container format work perfectly fine for CLI apps and services. Things like podman. All that is required to use docker images for CLI applications is to setup a shell alias. I don't see how coercing Flatpak to fill that role would be a improvement.
View on Reddit #22586531

AdvancedChickenD@reddit

>support for command line applications flatpak run whatever.whatever.whatever [arguments]
View on Reddit #22576194

gilium@reddit

I thought I lost my mind. I definitely have aliased a few flatpak CLI utilities
View on Reddit #22578849

Michaelmrose@reddit

It seems like you could simply have a one line wrapper script per flatpak which wraps flatpak run.
View on Reddit #22577475

mrtruthiness@reddit

And for there to be the ability of having flatpak daemons like snapd, cups, lxd. And for flatpak to be offered as a flatpak. And for flatpak to be able to run apps like docker, firejail. It would not be too difficult to get flatpak to deal with command line tools, but these other things are just not going to happen. flatpaks and snaps have different "use cases". Both are valid.
View on Reddit #22575770

dali-llama@reddit

All of these new "whole app in one" things suck. We've been doing fine without them for 50 years, WE DON'T NEED THEM NOW.
View on Reddit #22575335

QuantumToilet@reddit

i get where you are coming from but clearly there is a reason why they exist. linux is too fragmented for app developers
View on Reddit #22575875

cloggedsink941@reddit

> linux is too fragmented for app developers They are sièèpsed tp reòease a .tar.gz and let distributions take care of the rest!
View on Reddit #22580098

Indolent_Bard@reddit

The fact people unironically want to go back to this is mind blowing.
View on Reddit #22593729

Sarin10@reddit

idk, as a package mantainer i much prefer the "old fashioned" way.
View on Reddit #22777878

Indolent_Bard@reddit

And I would much prefer you be out of the picture entirely because the whole concept of needing package maintainers for each distro is awful.
View on Reddit #22848949

cloggedsink941@reddit

It's so much much easier than having to set up 2fa for github account, then github actions to publish on pypi, which of course requires setting up 2fa for pypi as well. Then another complicated setup to publish on snap, and another to publish on flatpack, and… and… and… Developers can be fixing bugs or can be wasting days upon days to set up all of that, then deal with getting hacking attempts, then deal with random API changes that need changes…
View on Reddit #22613642

Sarin10@reddit

And if the dev isn't a Linux citizen, they have no idea of which format to use. Every few months/years they'll get a bunch of requests to switch to packaging in *xyz* format.
View on Reddit #22778022

Pay08@reddit

Why would developers care?
View on Reddit #22636133

neon_overload@reddit

We should invent a new packaging format that solves all these issues once and for all
View on Reddit #22576380

Indolent_Bard@reddit

Well, technically, we only have two trying to do that. Appimage wasn't sandbox, so it doesn't count.
View on Reddit #22593697

useless_it@reddit

> Appimage And you can't really run them everywhere.
View on Reddit #22603202

neon_overload@reddit

Appimage is pretty cool from a "wow that's neat" perspective
View on Reddit #22597246

contigomicielo@reddit

https://xkcd.com/927/
View on Reddit #22576514

NoWarButMyWar@reddit

Lol I knew which xkcd this was before even clicking the link.
View on Reddit #22581917

dali-llama@reddit

I would rather just get the dependencies from the developers and compile it myself then. If I can't use my package manager, I probably don't want the app, but if it is a "must have," I would rather compile it over using a snap, flatpack, or appimage.
View on Reddit #22577731

mollyforever@reddit

That's not very user friendly.... Unless the ecosystem can eliminate those technical obstacles Linux is never become mainstream.
View on Reddit #22579202

dali-llama@reddit

It's not very user friendly if I can't manage it with my package manager either, but suddenly nobody seems to give a shit anymore.
View on Reddit #22586679

mollyforever@reddit

You will be able to manage it, it just won't be with a package manager. And I also don't that traditional distros completely disappear either.
View on Reddit #22597038

cloggedsink941@reddit

What's the point of being mainstream if you end up being the same shit as windows? If I wanted that I could have just kept using it.
View on Reddit #22580180

Business_Reindeer910@reddit

The problem with windows is that the source code isn't there for us to distribute and modify, not neccessarily these things.
View on Reddit #22582111

cloggedsink941@reddit

Well snap's server is proprietary, and so are some of the snaps…
View on Reddit #22591942

Business_Reindeer910@reddit

I know this is a snap topic, but i was not talking about snaps at all. I myself don't use ubuntu. I did used to recommend ubuntu, but after the whole Mir thing I stopped recommending it to people and this snap server thing made me it clear that i will never do so again. My comment though was specifically about how people assuming because some things on windows is bad (being closed source and terrible for privacy) also means some of the user friendly conveniences or even design decisions are bad.
View on Reddit #22593424

roerd@reddit

You're completely delusional if you think that "we've been doing fine". There were plenty of valid problems that these new packaging solutions aim to solve.
View on Reddit #22579007

OMightyMartian@reddit

Statically linked executables. That's a novel solution?
View on Reddit #22619165

twowheels@reddit

Never. Ubuntu Core went all in on snaps, even the core OS is in snaps.
View on Reddit #22575381

FocusedFossa@reddit

Counterpoint: Upstart and Unity. They'll give up within a few years.
View on Reddit #22579507

twowheels@reddit

Good point. Unity was very popular for a while, too.
View on Reddit #22582540

Clinton_won_2016@reddit

on the one hand, i feel for the people getting scammed and something needs to be done to prevent this shit. on the other hand, who the fuck downloads a random bitcoin wallet and stores $500k+ in it? holy shit!
View on Reddit #22605962

whosdr@reddit

> who the fuck downloads a random bitcoin wallet and stores $500k+ in it? Someone coming from Windows, who is probably used to the Windows Store being a safe place to get software, and who apparently has a lot invested in bitcoin. Don't blame the user in all this. 100% of the blame should be on Canonical for negligence. I am honestly surprised they aren't being sued out their arses by such a user.
View on Reddit #22722583

Sarin10@reddit

> who is probably used to the Windows Store being a safe place to get software, ?????
View on Reddit #22778395

whosdr@reddit

I didn't say it was true. But it's also a perception given by the platform.
View on Reddit #22782233

Dynsks@reddit

Haven’t heard something like that about flatpak, why it’s every time the snap store?
View on Reddit #22568663

that_leaflet@reddit (OP)

Flathub reviews every new app and when apps change their permissions. The Snap Store only reviews apps if they request certain permissions. Problem is that social engineering scams don't need dangerous permissions to do harm.
View on Reddit #22568799

urban_noise@reddit

You would have to go over the source code with a fine toothed comb and figure out where the credentials are being sent. At least forbid network access as standard policy for these kinds of apps unless they're a well known business with a physical address. But I doubt they want to get into those weeds and will likely ban crypto apps from the store.
View on Reddit #22570022

SoCZ6L5g@reddit

Not very spiritually open source to only allow well-resourced businesses to release stuff with network access, though, is it?
View on Reddit #22575326

urban_noise@reddit

You can still use snaps, just not through the official store. Which people are going to expect is curated to some degree.
View on Reddit #22575692

FocusedFossa@reddit

Snap's backend is closed-source, so either third-parties have reverse-engineered the Snap backend, or people are manually installing Snaps they downloaded from the internet. Both of those are bad ideas.
View on Reddit #22579173

SoCZ6L5g@reddit

Snaps are just a bad idea. Debian > Ubuntu
View on Reddit #22762816

Plan_9_fromouter_@reddit

Yes, but Flathub, for example, has a flatpak version of the Exodus app for cryptos and IT IS NOT EXODUS PROVIDING IT. Yet the flatpak is labeled as if it were, with github page link and Exodus website. It appears that it is not a scam app, but it seems to me this is still not right. With something like that, either Exodus provides it, or you don't offer it.
View on Reddit #22605251

bouche_bag@reddit

I understand what you're saying, but the code there is SUPER simple. I hardly know any programming but can read through through 5 text files enough to see its safe: https://github.com/flathub/io.exodus.Exodus
View on Reddit #22606174

Plan_9_fromouter_@reddit

The code of the scammer snap is safe. It's what the program asks the user to do that isn't. According to Exodus, there are only two portals at which to download their software, and Flathub, Github, or the Snap Store are not official portals or source for code.
View on Reddit #22660253

bouche_bag@reddit

Yes, but if you read the Github for the Flathub Flatpak, you'd notice that it literally just downloads the software from Exodus directly and verifies its SHA256 checksum.
View on Reddit #22672307

Plan_9_fromouter_@reddit

Well anyone who wouldn't verify the checksum is being very careless. I still don't like all these third-party apps.
View on Reddit #22675297

bouche_bag@reddit

The checksum wouldn't even matter. A hacker could hack Exodus and post a malicious version with a matching checksum. It [happened before](https://www.zdnet.com/article/hacker-hundreds-were-tricked-into-installing-linux-mint-backdoor/) to Linux Mint. All I'm saying is that using the Flatpak is about as safe as downloading the file on your own and manually checking the checksum, just like Exodus recommends.
View on Reddit #22676991

Plan_9_fromouter_@reddit

Regardless, I would never use a third-party app like that.
View on Reddit #22682413

that_leaflet@reddit (OP)

That's something that needs work. It's part of the reason why Flathub created the verification system, but it's not enough. Take Brave as an example: it says "Brave Brower" by "Brave Software", but it's packaged by a third party. Maybe they should include a seprate line for the publisher. So it should say "Brave Browser" by "Brave Software" published by "third party".
View on Reddit #22606486

Plan_9_fromouter_@reddit

Yes again and again I have seen people quite sure they were using an official flatpak based on what they see at Flathub, but it isn't. This came up a lot in discussions about the snaps and flatpaks for Steam. Neither is official Steam. Major software providers need to take charge of their snaps and flatpaks and then none of this would happen. I would never use an Exodus app unless I was sure it was from Exodus and it's been completely verified that it is. That starts with their official download portals and neither the Snap Store nor the Flathub qualify.
View on Reddit #22660178

Helmic@reddit

In theory, an app could clear that first check and *then* change stuff out to do the social engineering. Do they have anything in place to handle things like name/logo/description changes?
View on Reddit #22584127

chrisawi@reddit

Changing the app's name should trigger a review: https://docs.flathub.org/blog/improved-build-validation/ > We have also started moderating all permission changes and some critical MetaInfo changes. For example, if a build adds or removes a static permission (as seen in the finish-args array in the manifest) or changes the app’s user-facing name, it will be withheld for manual human review.
View on Reddit #22642115

gp2b5go59c@reddit

All app manifests are hosted at [github.com/flathub](http://github.com/flathub), while something might slip through it would be in the open for anyone to see and there is no way to "oopsie" your way out of it. Additionally, you know which apps are maintained by their upstream maintainers and thats for certain easier to trust than some random dude packaging for a distro repository.
View on Reddit #22625016

Dynsks@reddit

But if that happens often why the snap store doesn’t reviews everything, sure it would take more time but than It would be way saver for the user.
View on Reddit #22568992

queenbiscuit311@reddit

they both want snaps to be capable of being the sole package manager on your machine and not treating the snap store like a real package manager database
View on Reddit #22579225

cloggedsink941@reddit

And by trying hard we mean mostly using unmodified debian packages.
View on Reddit #22579782

queenbiscuit311@reddit

yeah
View on Reddit #22579935

Danteynero9@reddit

I think they introduced this for like a week.
View on Reddit #22569277

daddyd@reddit

every flatpak has a link to github where you can see for yourself how it is build.
View on Reddit #22699050

Plan_9_fromouter_@reddit

I think it's possible for flatpaks to be scams too. Take for example Exodus for cryptos. I go to their website, and they offer the desktop app in various forms, including deb pkg. But they say nothing about a flatpak. But then I go to Flathub where an Exodus flatpak is listed.. And there are links to the Exodus website--which as I said does not list any flatpak . I would hesitate to use this flatpak until I could certify with Exodus that it is theirs.
View on Reddit #22604822

KnowZeroX@reddit

Looking at it, it is just a flatpak wrapper around the official code. And the first commit came from a flathub maintainer. So while it may not be official from Exodus, it is official from Flathub itself
View on Reddit #22654479

Plan_9_fromouter_@reddit

I don't think Exodus has a flatpak. So Flathub is being very misleading in the labeling.
View on Reddit #22604899

S48GS@reddit

Over 100,000 Infected Repos Found on GitHub [https://apiiro.com/blog/malicious-code-campaign-github-repo-confusion-attack/](https://apiiro.com/blog/malicious-code-campaign-github-repo-confusion-attack/)
View on Reddit #22587556

nandru@reddit

I fail to see your point
View on Reddit #22601099

CyclingHikingYeti@reddit

Numbers and profile type of active users are big enough to become viable target.
View on Reddit #22595114

JimmyRecard@reddit

When will Canonical face the reality that Snap store is a failed experiment? I actually installed `snapd` recently after years of avoiding it simply because I wanted to get the BitWarden client from a first-party distribution channel, after having seen Snap shills lying though their teeth about the fact that Snap is no longer slow, and I have no idea who are they trying to fool. Snap is still by far the slowest format for cold startups, easily, and by a wide margin. If it has improved, it's been from absolutely atrociously slow to merely very slow… BitWarden client still takes solid 5+ seconds to launch, which is an absolute insanity when I'm on Ryzen 5 7600, 32 GB DDR5, and NVMe. Now that Canonical's refusal to moderate the store has been laid bare multiple times, it really has shown what a travesty it is.
View on Reddit #22571991

PsyOmega@reddit

> Snap is no longer slow Are you still on core 2 duo era hardware? I've been using snaps for years on an i5-7200u (sky/kaby lake dual core) and i've never noticed slowness (other than 1st-time app launch but thats only 5 sec max and never comes back)
View on Reddit #22606405

mollyforever@reddit

> (other than 1st-time app launch but thats only 5 sec max and never comes back) "It's not slow if you exclude the parts that are slow" big brain move right there. Taking 5s to open an app in 2024, even if it's just once, is completely unacceptable. That's what people mean when they say that snap is slow.
View on Reddit #22607365

PsyOmega@reddit

> Taking 5s to open an app in 2024 is completely unacceptable. My god dude. You're whining over 5 seconds delay, once ever. Do you have any idea how entitled and whiny that sounds? Get some emotional regulation my friend.
View on Reddit #22616158

whosdr@reddit

I think there was some ambiguity over whether it was "First time ever opened on the operating system" or "First time opened in this session". The latter is worth being concerned over.
View on Reddit #22722913

that_leaflet@reddit (OP)

Bitwarden probably launched so slow because it still uses the core18 runtime, which uses a slower compression method. Thankfully they just updated it to core22, which uses a faster compression method, should be faster to launch. But that version probably won't roll out until April. The Bitwarden snap itself should also switch to the faster compression method with that update as well.
View on Reddit #22572356

Michaelmrose@reddit

The proper place for compression seems to be file system layer -> snap itself -> the app itself. What is the logical reason for using compression in the least advantageous place?
View on Reddit #22577387

FocusedFossa@reddit

Compression designed for a highly-specific purpose almost always beats more general solutions. I don't think the added complexity is worth it in this case, but it does have better performance than filesystem-level compression.
View on Reddit #22579967

Michaelmrose@reddit

> but it does have better performance than filesystem-level compression. It doesn't. Mature solutions are usually better.
View on Reddit #22582775

FocusedFossa@reddit

General solutions are often "better" than highly specific solutions because they have less complexity and more development resources (due to being more widely applicable), not because they have higher performance or efficiency. Think of a Pi "compression algorithm" that computes the digits of Pi as needed, compared to compressing the pre-computed digits by any other means. Pi is irrational, so any generic algorithm will still have an infinite size, while the computation program has a finite size. That's essentially a 0% reduction in size compared to a 100% reduction in size.
View on Reddit #22614491

Michaelmrose@reddit

But snaps solution isn't highly specific and doesn't meaningfully differ on average what filesystem compression handles dealing with the root filesystem. In fact compressed filesystems have been performant for a long time. For instance ZFS since at least 2008 whereas from 2016–2022 snap was for practical purposes very slow. I include the end date there not because snap became acceptably fast but because I stopped caring and don't know if its still a dog.
View on Reddit #22616411

FocusedFossa@reddit

Regular executables without filesystem compression probably open faster than regular executables with filesystem compression. That compression isn't for making things faster, it's for making things smaller. *If* the compression algorithm were properly optimized for a highly-specific situation, *then* it would be smaller *and* faster. Filesystem-level compression *can't* ever reach that level of optimization because it needs to handle all file types, but an algorithm that will only ever compress executables *can*; the problem is not the use of a highly-specific algorithm, it's the fact that it hasn't been sufficiently optimized.
View on Reddit #22618379

dali-llama@reddit

I will NEVER use a snap, or a flatpack, or an appimage. I'm migrating all my Ubuntu machines (most of which I've been running and upgrading from 8.04 or 10.04) to Debian because it's getting too difficult to build and run a server without snaps.
View on Reddit #22575496

andrelope@reddit

Canonicals attrocious behavior is what ultimately lead me to arch , which was a blessing in disguise .
View on Reddit #22581616

arwinda@reddit

Read an online thread the other day where someone describes that Canonical is looking for a PR manager, and after about 10 interviews got rejected by the CEO. Job is posted regularly, and they never fill it. No wonder they have no idea how bad that looks.
View on Reddit #22580961

mrlinkwii@reddit

>When will Canonical face the reality that Snap store is a failed experiment? probably never since snap have been mostly successful , unlike what you hear about complaining on reddit , most people have no issues with snaps
View on Reddit #22573891

dali-llama@reddit

I will NEVER use a snap, or a flatpack, or an appimage. I'm migrating all my Ubuntu machines (most of which I've been running and upgrading from 8.04 or 10.04, to 20.04) to Debian because it's getting too difficult to build and run a server without snaps.
View on Reddit #22575579

Innominate8@reddit

All of the above are just a symptom of how broken dev toolchains and distribution packaging has become. It's the epitome of "it works on my machine", except instead of fixing it the solution is to run it on a totally bespoke environment.
View on Reddit #22577889

daemonpenguin@reddit

Yeah, they are sooooo successful that Canonical had to force their community editions to install it since they'd all followed their users' demands up to that point and used Flatpak instead.
View on Reddit #22577360

Michaelmrose@reddit

Do you feel like malware in the store, very poor performance and fewer users than flatpak isn't a failure?
View on Reddit #22577282

PorgDotOrg@reddit

It's absolutely unacceptable not only that scams like this happened several times in Ubuntu's blessed app store, but *continue to happen* after the first incidents. If they're going to champion the Snap Store, there needs to be some actual stewardship and proper vetting of applications.
View on Reddit #22584409

shroddy@reddit

> Most meaningful attacks against end users involve tricking them into volunteering information. Here I disagree. The most common thing a malware does these days is collect all kind of information that is accessible without further asking the user, most common are session cookies and passwords in the browser. And here sandboxing helps a lot to prevent these kinds of attacks. I dont think it is possible to vet for the huge amount of applications in snap or on Flathub, so a different approach might be to only vet applications that have a legitimate reason to ask for or work with private information (crypto currency client, email client, ftp client) and let sandboxing take care of the security of all the others. Especially those that dont even need to access the internet, no need to waste time vetting a game that only runs offline and has no need to access everything but its own files.
View on Reddit #22635080

whosdr@reddit

> I dont think it is possible to vet for the huge amount of applications in snap or on Flathub https://docs.flathub.org/docs/for-app-authors/submission/#how-to-submit-an-app *"Your pull request will then be reviewed by the Flathub reviewers. Keep in mind that the reviewers are volunteers."* It appears every app on Flathub has been through some kind of review. And given how these apps are set up, they would definitely have been caught. Canonical has the money to pay employees to vet applications, especially given their business sector and how Snaps were made in part for their business users.
View on Reddit #22722811

nixsurfingtangerine@reddit

I would personally just avoid any distribution that forces you to use snaps. It's literally the only source of applications for Linux that has ever had a serious malware problem, it was designed with no security or review process, and it would cost them money to add one. So don't wait up.
View on Reddit #22661257

whosdr@reddit

At least with PPAs, someone has to go through the effort of finding and then manually adding the PPA via terminal. And, like with the AUR, people will tell you to be careful with PPAs and third-party repositories. The implicit trust combined with the lack of proper review was just perfect for this kind of social engineering malware.
View on Reddit #22722466

whosdr@reddit

Still? Ubuntu treats the snap store under the same umbrella as the conventional package manager (i.e. searching/installing from their first-part app), so the contents of what's in the snap store really should be vetted properly. Otherwise surely the lack of trust in the store will translate to a lack of trust in the desktop, and then in the company behind it. Perhaps a blog post is in order, to detail exactly how they'll tackle this long-term. Not that I personally care at all for snaps, but it's a disservice to so many people on the platform.
View on Reddit #22568765

ClumsyAdmin@reddit

>Otherwise surely the lack of trust in the store will translate to a lack of trust in the desktop, and then in the company behind it That must have been a nice rock, we blew past that point awhile ago
View on Reddit #22652984

whosdr@reddit

Not everyone does, but there's definitely a good sized portion of the community who do. And that's fine, to each their own. Businesses are also worthy of consideration here. Regardless, I really do hope Canonical can do better for the sakes of the people who want to use it. (Just that's not me.)
View on Reddit #22690765

wiki_me@reddit

> Perhaps a blog post is in order, to detail exactly how they'll tackle this long-term. Not that I personally care at all for snaps, but it's a disservice to so many people on the platform. Or maybe people should just not recommend and warn about Ubuntu because the company has shown poor judgement (or williingness to sacrifice quality for profits which is too problematic).
View on Reddit #22596630

secretlyyourgrandma@reddit

if they're not careful people might start to dislike snaps
View on Reddit #22586392

EquivalentReal584@reddit

I’m behind it 100%. This needs to be addressed.
View on Reddit #22580699

El_profesor_@reddit

Agreed 100%. Part of the responsibility of running a platform store is some basic quality checking of apps available.
View on Reddit #22580081

amarao_san@reddit

They wanted to be like 'google store', they got malware like google store.
View on Reddit #22626555

bungotronic@reddit

I wish ubuntu wasn’t so hard over at pushing snaps…
View on Reddit #22573219

OMightyMartian@reddit

That's why there's Debian.
View on Reddit #22619030

snyone@reddit

I wish Ubuntu wasn't recommended any more...
View on Reddit #22598628

that_leaflet@reddit (OP)

The last scam happened less than a month ago: https://www.reddit.com/r/linux/s/WmjgPI2sow
View on Reddit #22568237

MairusuPawa@reddit

It's crypto, whatever. May it die a painful death.
View on Reddit #22573149

draeath@reddit

There's nothing to stop this vector being used with something you care more about.
View on Reddit #22611880

themedleb@reddit

It's evil people not Cryptocurrencies, the latter is okay generally. It's like evil people uses fishing to get people's money from credit/debit cards or bank accounts ... Will you hate fiat money and think they're all scam just because of these incidents?
View on Reddit #22581587

SeeMonkeyDoMonkey@reddit

Except that conventional fiat money doesn't burn a small country's-worth of electricity to run, and doesn't have quite the scale of institution to consumer fraud as crypto. Plus I love that crypto is *also* fiat money - albeit with fewer people believing in it.
View on Reddit #22591617

themedleb@reddit

That's the cost we pay for a corrupted gov controlling world wide money.
View on Reddit #22602690

SeeMonkeyDoMonkey@reddit

I am fully on-board with the idea that the rich and powerful people that make up The Establishment corruptly direct affairs in their own interest, but wasting resources and accelerating global heating is not the solution.
View on Reddit #22604604

themedleb@reddit

Good luck protesting "the rich and powerful people that make up The Establishment corruptly direct affairs in their own interest" without them blocking your bank account and other financial assets to disable your activities and the basic living of your family.
View on Reddit #22608546

PsyOmega@reddit

> conventional fiat money doesn't burn a small country's-worth of electricity to run, and Except it does. Count all of the banks, bank HQ's, money trucks burning diesel all day, mega-scale datacenters to track accounting, etc, and it's on par or more CO2 than crypto. doesn't have quite the scale of institution to consumer fraud as crypto. Cash is used for 50x more crime than crypto ever will be
View on Reddit #22606119

Entity2D@reddit

In 15 years, we still haven't found anything that blockchain does better than what we already have, except illegal activity.
View on Reddit #22600314

Jonathan_the_Nerd@reddit

The government can freeze your bank account if they suspect you of crimes or terrorism, or if they don't like you. No one can freeze your crypto as long as you retain your keys. And no government or private entity can prevent you from transacting in crypto with anyone in the world, regardless of national borders or sanctions. Granted, the government *can* make it hard for you to exchange between regular currency and crypto if they want. And they can sometimes trace your crypto payments. But they can't stop or reverse the transactions themselves.
View on Reddit #22603200

michelbarnich@reddit

Idk, Session Messenger is kinda cool, and rewarding people for hosting Nodes
View on Reddit #22601434

RAMChYLD@reddit

+1. Crypto deserves to die because they're the cause of CPU and GPU shortages.
View on Reddit #22591425

whosdr@reddit

Or at least, the ones that were publicised. It's entirely possible other incidents have occurred..or not. But maybe if there's a blog post, we'll find out.
View on Reddit #22583462

that_leaflet@reddit (OP)

Funnily enough, he just found a bunch more https://mastodon.social/@popey/112121731617251069
View on Reddit #22603521

Monsieur2968@reddit

"Jaxx in now on Snap!"... IN not IS?
View on Reddit #22607167

SpringSufficient3050@reddit

Doesn't affect me since I use arch linux, still I feel bad for people affected. Ubuntu is a great starting distro
View on Reddit #22607094

RomanOnARiver@reddit

Crypto? A scam? In the same sentence?! I'm shocked.
View on Reddit #22570286

LostInPlantation@reddit

Does this mean I need to uninstall VeraCrypt? I heard they are big on crypto.
View on Reddit #22571667

Indolent_Bard@reddit

Not really. Cryptocurrency isn't the problem inherently. Otherwise, it wouldn't be something every major Linux podcast host was a fan of (Tux Digital and Jupiter Broadcasting, the latter of which has an entire segment dedicated to reading what's essentially crypto super chats they've received from the previous episode called Boosts. Sometimes during an episode they'll say that someone just boosted in with a comment and unfortunately they don't have a way to do this with regular currency.) The main issue is the power draw and the fact that not really any better than regular currency right now since it can apparently be crashed by a single tweet from Elon Musk. Oh yeah, and a bajillion cryptoscams come out every single day. Jupiter Broadcasting even had an office hours podcast called "We Hate Crypto" where they basically said they hate it for the same reasons everyone else does, because everyone's trying to scam people and investors. NTFs are also technically cryoto, which basically quadruples the number of scams.
View on Reddit #22594296

CyclingHikingYeti@reddit

And hardly any solid legislation. Regular and audited country and international bank systems have backing of legislation, procedures, policies that protect from volatile acts and save regular folks saving accounts.
View on Reddit #22595425

Indolent_Bard@reddit

Oh yeah, that too.
View on Reddit #22603044

snyone@reddit

I agree with the other comment. If you use LUKS (to encrypt full hard drive), that's probably easier. But if you want an alternate that supports truecrypt/veracrypt containers and functionality, check out zulucrypt (and zulumount). It's in the main repo for Fedora (and probably others)..
View on Reddit #22598588

JimmyRecard@reddit

Yes. Use LUKS.
View on Reddit #22572155

LostInPlantation@reddit

Sounds like another crypto scam. I think I'll finally make the jump to TempleOS and let Jesus take the wheel.
View on Reddit #22572469

OffendedEarthSpirit@reddit

Ah, security through piety
View on Reddit #22586549

BoutTreeFittee@reddit

Wow, that actually exists. LTT on TempleOS https://www.youtube.com/watch?v=LtlyeDAJR7A
View on Reddit #22574763

JTCPingasRedux@reddit

AGAIN?
View on Reddit #22574323

CyclingHikingYeti@reddit

Aye. Same plague that is going in Android and ios apps. Bad actors are relentless in persuit of coins.
View on Reddit #22595354

NaheemSays@reddit

It will keep happening until they get sued.
View on Reddit #22586841

redddcrow@reddit

you guys you Snaps?
View on Reddit #22570624