226
Canonical's Snap Store Hit By Malicious Apps
(www.phoronix.com)
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
As much as I despise snap, this instance bring some questions into how other popular cross-linux platform app stores like flathub and nix-channels/packages provide guardrails against malwares.
I’m aware flathub has a “verified” checks for packages from the same maintainers/developers, but I’m unsure about nix-channels. Even then, flathub packages are not reviewed by anyone, are they?
Nixpkgs submissions work through GitHub PRs which have to be reviewed, and packages usually build from source (or download binaries from the official site if no source is available, and verifying it against a checksum). It’s a much safer model since every user has a reproducible script to build the binary, especially if Flathub doesn’t have any reviews as you say.
Same as flatpak, it's quite strict...
If you want your Flatpak on Flathub.org, you'll need to open a pull request and go through review.
Wouldn't it go noticed quickly if a super popular flatpak distribution app is compromised? I love flatpacks for my 5 desktop apps that I actually use everyday, but it is definitely not suitable for general apps I install on a whim.