News for hackers. Stuff that matters.

A comment on Opera launches as a snap for Linux users. Parent comment

Re:Opera launches as a snap for Linux users by Sir_Cmpwn on Thursday August 02, 2018 @11:32AM (#17672192)
Yes, that is totally how software distribution should work. Vendors cannot be trusted, this has been proven over and over and over again. Having a dispassionate third party do the packaging keeps malware out of your computer. This is why we have browser extensions and android apps that spy on you. This is why we have a snap which was mining cryptocurrency on your computer a few weeks ago. This is why Mozilla can add spyware to Firefox. Vendor publishing is fundamentally broken.
[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by Boulth on Thursday August 02, 2018 @01:50PM (#17673653)
> This is why Mozilla can add spyware to Firefox.

Mozilla has some interesting technical solutions to this problem: https://wiki.mozilla.org/Security/Binary_Transparency

[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by Sir_Cmpwn on Thursday August 02, 2018 @02:31PM (#17674132)
Mozilla is the one adding the spyware, though.

https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

>Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.

[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by Boulth on Thursday August 02, 2018 @03:09PM (#17674524)
And upstream issues such as this one should be fixed in upstream not patched endlessly with every other distro. That's the approach promoted by Arch Linux.
[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by Sir_Cmpwn on Thursday August 02, 2018 @04:55PM (#17675393)
My point is that upstream can't always be trusted. With snaps there's no one between you and a potentially bad actor.
[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by Boulth on Friday August 03, 2018 @02:29AM (#17677662)
If you don't trust upstream why are you running their code?

I don't think it's reasonable for such a small group of people as Debian developers (or any other maintainers) to review each change looking for potentially malicious code. Especially in codebases as big as Firefox.

[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by AnIdiotOnTheNet on Thursday August 02, 2018 @12:56PM (#17673078)
Well, you're free to believe that a platform that places you at the mercy of third party comrades who dictate what you can and cannot install or distribute "for your own good" is a good idea.

I disagree. Wholeheartedly.

[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by Sir_Cmpwn on Thursday August 02, 2018 @01:14PM (#17673302)
We're not talking about some shady organization in some ivory tower. Package maintainers are people whose names and email addresses are available to you. Distros are also always looking for volunteers, you can volunteer and steer things the way you want. And if not, then there are dozens of other distros to choose from whose maintainers may agree with you more.
[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by AnIdiotOnTheNet on Thursday August 02, 2018 @01:42PM (#17673589)
Yes, and look at how well all that fragmentation works.

We're clearly of very different opinions about what personal computing is all about.

[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by taway234252 on Thursday August 02, 2018 @02:32PM (#17674141)
Without the "fragmentation" the problem of third parties censoring applications would be even worse and it still wouldn't be any easier to deploy anything. If you want a proprietary centralized service loaded with malware, there are already plenty of those to choose from on other systems, complete with their own gatekeepers.
[ Parent | on HN ]
Re:Opera launches as a snap for Linux users by AnIdiotOnTheNet on Thursday August 02, 2018 @04:13PM (#17675066)
Neither MacOS nor Windows prevent you from installing any application you desire[0], direct from the vendor. That has only recently begun to change thanks to app stores, which bear a remarkable similarity to package repos.

[0]Ok, there are some hoops regarding unsigned drivers.

[ Parent | on HN ]