News for hackers. Stuff that matters.

A comment on Snap Store administrators removed signal-desktop from Ubuntu Snap. Parent comment

Re:Snap Store administrators removed signal-desktop from Ubu... by electromech on Thursday November 03, 2022 @08:29PM (#33460056)
Respectfully, I don't think that's correct, or possibly I am misreading your comment. IIUC, placing a key in /usr/share/keyrings does not allow those keys to sign any package, only the packages designated with "signed-by" in the apt list.

Sadly, plenty of applications still take the old "apt-key" approach of adding the keys globally (e.g., installing keys to /etc/apt/trusted.gpg.d), but I think Signal's installation process is the correct/recommended approach for distributing apt packages securely.

[ Parent | on HN ]
Re:Snap Store administrators removed signal-desktop from Ubu... by codedokode on Friday November 04, 2022 @05:18AM (#33463812)
Yes, I made a mistake about the key. Adding a key is safe by itself. However by adding third-party repository you are granting Signal a permission to replace packages on your system (unless you manually whitelist package names in apt preferences), and by installing a package from Signal repository you grant it root access to your system.

Sadly debian-based distributions do not respect the principle of least privileges and grant unnecessary permissions to installation scripts.

[ Parent | on HN ]