Ubuntu Snap's Security Is Easily Circumvented Due To X11

[pal666]

The day Linux hit 10% marketshare on desktop, they will have a lot.

linux hit 80% marketshare on smartphone long ago, did they have a lot ?

[bkor]

linux hit 80% marketshare on smartphone long ago, did they have a lot ?

X11 is not used on those phones.

[Passso]

linux hit 80% marketshare on smartphone long ago, did they have a lot ?

Not. Basically because Google Play only allows the software's installation from its trusted servers. After that the low level functions are not available from the API (unless you root your phone) so that harmful scripting is very very limited.

But just surf on the web at bad places or install too many "bubble games" and you will see pop ups coming from nowhere every few seconds...

[Passso]

I suspect that by the time that happens, "desktop" won't be a significant market at all. (ie. only used by developers and the like)

As long as "desktop" includes "business" ransomware will be there

[Cerberus]

How "enlightening". Installing applications from untrusted sources is dangerous regardless of the format, snap, deb, rpm etc. Everybody knows that, and if he watched Ubuntu On Air where snaps were discussed X11 was mentioned as a "problem" and how that will be solved by switching to Mir, until then users should use common sense and install snaps from Ubuntu Store and trusted sources. I think some people are blowing snaps out of proportion, they are here to allow easy updating of applications, not to magically solve any and all security issues on Linux. They might do to that when paired with Mir display server with its sandboxed approach, but until that happens use common sense. The guy basically "proved" what was already known, X11 is insecure in some aspects and that cannot be fixed without switching to another display server, therefore all packaging systems/applications are inherently vulnerable because of access to X11. That is not the fault of snaps in this case, but of X11. Wayland and Mir will solve these issues.

[bug77]

Well, Ubuntu has always focused on usability. So why make it hard to compromise security, that would contradict Ubuntu's motto. </joking>

[Krysto]

In the future, could the se of Xwayland/Xmir be used for these sandboxed applications in order to gain the necessary security?

Each sandbox/application could have its own x-server so there would be no leakage of data between sandboxes.

And what will that do to performance?

[anda_skoa]

Each sandbox/application could have its own x-server so there would be no leakage of data between sandboxes.

One could likely already do that today with a nested X-Server such as Xephyr.

Cheers,
_

[r_a_trip]

Is my intuition wrong and out of date ?

No, AFAICT Snaps are a step back. It is farming out the update regimen (and testing) to the app developers and using sandboxing techniques to mitigate the damage an out of date and vulnerable Snap can do. It is Ubuntu's .exe or .dmg.

Joe sixpack will lap these new packages up, as it will enable Ubuntu to have the latest Firefox, Chrome, Steam, etc. on release day. But the security and the stability of these packages hinge on the ability of the Snap builder to maintain the Snaps in a responsible way.

In the future there may be another problem, since Snaps are self-contained and only minimally need OS services, Ubuntu might find themselves in the same position as MS in a few years. Old, crummy (and potentially insecure) software from a bygone decade still running on a more modern OS.

A repository based distro with shared dependencies doesn't have that problem. Stale software (e.g. abandonned proprietary software) eventually falls by the wayside as its dependencies are no longer provided.

[pal666]

Not. Basically because Google Play only allows the software's installation from its trusted servers. After that the low level functions are not available from the API (unless you root your phone) so that harmful scripting is very very limited.

so, "linux has no malware only because of lack of market share" is a lie. linux has no malware because linux is inherently secure.
btw, android has checkbox, allowing installation from anywhere