Canonical Continues Snap'ing Up Linux Gaming For Ubuntu

[ssokolow]

Poke poke. Unapproved.

...but to continue the thought in the unapproved post, it is specific to how the Belgian government's PKCS#11 module for their USB auth token system interfaces with the browser. I use U2F/WebAuthn as my second factor for things like GitHub and Google and it Just Works™ for me in both the Firefox and Ungoogled Chromium flatpaks.

Given my success at using flatpak override --filesystem=… --env=… to overlay gtk3-nocsd's LD_PRELOAD and chromedriver and geckodriver into flatpaks (because I didn't know what part of my tightening of sandbox permissions broke the official instructions for getting the WebDriver shim to talk to the browser from the outside), I am curious if anyone's felt bold enough to experiment with getting eID working in an unsupported configuration by doing that.

[ssokolow]

Snaps "just work" for most people. It's possible nobody in Belgium has beta-tested a Snap of Firefox prior to it being switched, and that the issue affects a small amount of people. Is there a bug report about this that goes into more detail?

https://eid.belgium.be/en/faq/why-it-not-possible-use-eid-software-snap-andor-flatpak

The eID software is a plug-in module that can be loaded by third-party software and which, using the PKCS#11 standard, can offer extra functionality to this software.

Snap and Flatpak are two implementations with a similar idea: limiting system access for a given software package to only the software itself and certain authorised exceptions (e.g., writing data to the "Downloads" folder without allowing reading as well). As such, in the event of a security issue in the software installed via snap or Flatpak, malicious actors on the Internet cannot access your system and your private files are safe.

For this setup to work, the person compiling the snap or Flatpak package of your web browser (Firefox or Google Chrome) must explicitly list which files can be opened (either directly or after user confirmation). Currently, both technologies do not yet allow PKCS#11 modules (such as the eID software) to be loaded. As such, using the eID with a web browser installed via snap or Flatpak is unfortunately not possible.

The browser makers and distro administrators are currently looking at a number of possible solutions to still allow the use of pkcs#11 modules via snap (such as the eID software). For more information, you can follow the following discussions:

• Ubuntu: https://forum.snapcraft.io/t/native-...er-snaps/26849
• Native messaging: https://bugzilla.mozilla.org/show_bug.cgi?id=1661935
• PKCS11: https://bugzilla.mozilla.org/show_bug.cgi?id=1734371

In the meantime, to resolve the problem, you can install a browser outside of snap or Flatpak. Possible options for this are the official downloads of Google Chrome (https://www.google.com/chrome/?platform=linux), or the official download of Firefox (https://www.mozilla.org/en-US/firefox/linux/).

Note that from Ubuntu 21.10 on, all browsers supplied with Ubuntu (Firefox and Chromium) are distributed via snap, and are therefore susceptible to this problem.

TL;DR: It's analogous to "The Windows NT kernel's protected mode operation is incompatible with my authentication dongle's TSR driver", except it should be easier to fix.

Honestly, it reminds me of how I run a separate Firefox profile (though still using the same Flatpak firefox) to work around how my "force window.open and target="..." to open in the same tab unless I middle-click the latter" and possibly also one or two of my anti-tracking tweaks break PayPal's newer popup-based checkout flow.

Mint isn't inferior to Ubuntu. If you really dislike Mint, please explain why. But don't give me that "they mix Ubuntu and their own Debian packages" or other ideological nonsense.

That's my main issue with it; isn't mostly everyone's distro-preference based on ideology? Outside of that though, I recall a time years ago where Wine on Mint was broken for months because of that packaging mess.

Ubuntu shipping on popular laptop OEMs was already the case long before Snaps existed.

My point was that if there were other "better" distros, OEMs would be shipping a different distro. System76 seems to be the only ones stepping up.

True, Appimages aren't really used widely, but Flatpaks? Go to the Flathub website and see the amount of apps there before writing utter nonsense like this. Also, if Flatpak aren't publicly used by anyone notable, then how did Valve choose it as the main app distribution method on the Steam Deck. Again, you're wrong here.

I meant to say they aren't publicly mentioned by anyone notable. Steam doesn't mention anything aside from a deb package on the Downloads page: https://store.steampowered.com/about/ and Google doesn't present anything on the main Chrome dl page https://www.google.com/chrome/ nor the community-supported distros list they link to.

So you say Snaps just work right? give me an ffing break. Go ask some people from Belgium who tried the Firefox Snap. Every citizen in Belgium has to use some financial system that works in the web browser. I've seen numerous reports that this system doesn't work in Firefox Snap. How's that for "apps just work".

Snaps "just work" for most people. It's possible nobody in Belgium has beta-tested a Snap of Firefox prior to it being switched, and that the issue affects a small amount of people. Is there a bug report about this that goes into more detail?

Every piece of software has some edge-cases; Flatpak and AppImage certainly aren't free of them, or they would be the standard.

You really sound like a Canonical fanboy without giving comprehensive arguments and spewing utter nonsense.

I agree it sounds like that. I wasn't interested in a serious discussion about this and just wanted to take part in the outlandishly loud statements already going on in this thread

I've used the Steam Snap for about a week for a few games no problem. Real-world I notice no difference between the Steam Snap and a package install, but I like how Snaps install in-general. Basically, future Steam installs for me on Ubuntu will be with the Snap. On Fedora I need RPM Fusion for other things anyway, so installing Steam from that is easy.

Some Snaps and the entire infrastructure being in-place on fresh Ubuntu installs makes it make sense to try out Snaps; I particularly liked that Moonlight was also there. I haven't had to use a Flatpak on Fedora or openSUSE yet, and would have to figure out how to even enable Flatpaks and/or the Flathub repo? which is probably easy, but there's less motivation since I can get everything from RPM Fusion, Copr, or occasionally direct AppImage files.

[ssokolow]

I recently did a fresh install of 22.04. Firefox wouldn't even launch because snap was broken... after an update it did, but on the nvme drives I have in that laptop, it's always been pretty instant to start. With Snaps, it lags seriously on start up. I compared it to the flatpak version and that's perfectly fine speed wise.

Makes sense. Flatpak does the heavy lifting at install/update time, while Snap does the heavy lifting every time you start the program.

[leech]

I recently did a fresh install of 22.04. Firefox wouldn't even launch because snap was broken... after an update it did, but on the nvme drives I have in that laptop, it's always been pretty instant to start. With Snaps, it lags seriously on start up. I compared it to the flatpak version and that's perfectly fine speed wise.

[cl333r]

Maybe post the link? I think I sometimes have this issue too. If you don't have the motivation to jump in and report, discussing it here won't help much, because it's not very easy for someone else to report on your behalf.

That's the point, I don't even know the link, the guy (Vistaus) who told me that this is a known bug and was "solved" didn't post the link to it to begin with.

[hamishmb]

Thanks, in my case the page is still triggering a reload when I switch Appearance from "Dark Theme" to "Light Theme" or vice versa, I'm on AMD RX 570, sorry I don't have enough motivation to find the bug you're talking about, registering, commenting on it and whatnot.

Maybe post the link? I think I sometimes have this issue too. If you don't have the motivation to jump in and report, discussing it here won't help much, because it's not very easy for someone else to report on your behalf.

[cl333r]

Sorry, I meant 104.0.1. I don't have the issue anymore after upgrading to 104.0.1. If you still have the issue, please re-open the bug report as Mozilla really has committed a fix, so if the fix is not working for everybody, they need to know about it.

Thanks, in my case the page is still triggering a reload when I switch Appearance from "Dark Theme" to "Light Theme" or vice versa, I'm on AMD RX 570, sorry I don't have enough motivation to find the bug you're talking about, registering, commenting on it and whatnot.

[Vistaus]

104.0.1 or 104.1? Because I have the former, or 104.1 is not available/released yet.

Sorry, I meant 104.0.1. I don't have the issue anymore after upgrading to 104.0.1. If you still have the issue, please re-open the bug report as Mozilla really has committed a fix, so if the fix is not working for everybody, they need to know about it.

[ssokolow]

oh, sure. I was just talking about startup speed.

Although I'm not sure how much of a difference does this make appart from atomic updates (which are nice, but also supported on snap)

According to this script, I'm using 76.58% of the space I would be without deduplication.

Granted, some of that will have been countered. While Flatpak has BaseApps (basically templates for things like Electron or Godot or QWebEngine that provide pre-built files to bundle into your package to ensure that multiple packages will use hash-identical files so OSTree is guaranteed to deduplicate them every step from server to download to installed), Snap has an analogous system that allows a separate layer of shared overlay filesystems you can depend on between the runtime and the application. However, that still requires the upstream developer to actually use them, does nothing for "identical by sheer luck" files, and I didn't see mention of a mechanism for deduplicating across things like "multiple releases of the same dependency installed in parallel, which may share identical assets" or "developer X used the library snap while developer Y vendored the same version of the library into their application snap".