> I don't use Snap on my Ubuntu Desktop systems because I don't like apps secretly updating without my awareness

https://snapcraft.io/docs/managing-updates#p-32248-pause-or-...

Unfortunately that creates a choice between an app that updates in an aloof manner or allowing it to exist in an insecure, not updated state.

What do you mean by "aloof manner"? As far as I'm aware, snaps' updating mechanism is quite reasonable and doesn't suffer from the many update related issues that apt/debs have, especially when users want packages not included by their distribution.

You can also block the updater's internet access by adding this to your /etc/hosts file:

    127.0.0.1 api.snapcraft.io

And for other updates:

    127.0.0.1 archive.ubuntu.com
    127.0.0.1 security.ubuntu.com
    127.0.0.1 mirrors.kernel.org
    127.0.0.1 deb.debian.org
    127.0.0.1 ppa.launchpad.net
    127.0.0.1 flathub.org
    127.0.0.1 dl.flathub.org

Use at your own risk of course.

Or you can just avoid hacking your hosts file and breaking other tools, and set your Snap and Apt proxy configuration to a non-existent value, or firewall their ability to reach those hosts.

Or configure them properly by disabling auto-updates, configure unattended-upgrades appropriately for your needs, and only update your apt packages from a known, internal mirror endpoint that doesn't change until you point it to a new timestamp.

That's how it works in the real world, in production. It's not 1994, we don't hack hosts files anymore.

>I don't like apps secretly updating without my awareness

Any particular reason?

Flatpak doesn't auto update out of the box on any distro I have used.

> I don't use Snap on my Ubuntu Desktop systems because I don't like apps secretly updating without my awareness

My experience with Snap is that it bugs me about Firefox updates multiple times a day for two weeks. Okay, it does then update automatically and break the running program, but I can't claim to be unaware.

Apt is the thing that updates packages completely without my awareness, with Unattended Upgrades. Mostly it works, but I have to blacklist NVidia utilities, as they need to be in sync with the driver in use.