I thought the insecurities had been dealt with - is this not the case?
If the linux co-ordinator who has had more years experience of Linux than I have had hot dinners, then yes, SNAP is insecure!
I made a mistake jumping to Devuan - I thought it was a break away from Debian, only to find Pulse Audio present there. My mind is now made up … Arch Linux here I come! and hopefully nothing but ALSA!
As Mark Twain once said “I apologize for such a long letter - I didn't have time to write a short one.”
@niceone There currently aren't any known security issues with Snap. While Snap has had security vulnerabilities in the past (just like most complex software), they've all been fixed and the Ubuntu Security Notices page doesn't list any other open vulnerabilities:
Of course, the reality of all software projects – not only Snap – is that no piece of software can be proven to be 100% secure. The more complex a piece of software is, the higher the chance that there's a bug in it which ends up causing a security vulnerability. However, the advantage of Open Source software in this case is that anyone can inspect the source code and find these vulnerabilities so they can be fixed. You're not relying on only the developers behind the software to find and fix these bugs.
If you're aware of any security issues with Snap, I'd highly encourage you to file a bug report here: OpenID transaction in progress
Snap has been designed to support sandboxing. That way, supported apps run in isolated containers, minimizing the chance that a potentially nefarious or compromised app would cause damage to the rest of your system. This is an important safety feature that actually makes Snap apps more secure than their counterparts published on traditional package formats like .deb/APT.
Warning: some personal opinions ahead
It certainly appears that Snap does get more of a bad rap among the Linux community than most other projects I've seen. While some of the criticism Snap gets is valid, some of it can get exaggerated and is not always fair. Because this is a highly technical matter, it's understandable that some people get confused and misinterpret important details, leading them to believe certain things about Snap.
The following are some of the common reasons why people can have an unfavourable opinion of Snap:
Another competing standard
Containerised app package formats (like Snap and Flatpak) are the result of an effort intended to solve – amongst other problems – the issue of package format fragmentation amongst Linux distributions. In the past, if you were an app developer wanting to make an app for Linux, you would need to create separate installer packages for all of the different package managers in every distribution you target (".deb" packages in Debian & Ubuntu, ".rpm" in Fedora & openSUSE etc.) as well as making sure the required dependencies were available in the distro to allow your app to run. This could often end up being a mess, requiring the app developer to put a lot of time into packaging and testing the app across these different environments – taking time away from actually developing the app or other more important things. This extra overhead – as well as the smaller userbase of Linux in general – gave app developers another reason to not develop their apps for desktop Linux. Sometimes, the distribution developers took on the task of packaging apps and distributing them in their repositories. Unfortunately, this meant that some apps weren't updated in the repositories as often as the original developer made new versions of it, or they weren't made available at all.
When Flatpak came onto the scene in 2015 (back then it was called "xdg-app"), it was welcomed as a new single app package standard by many people in the desktop Linux community. At around the same time, Canonical started advocating for Snap as a single standard for the desktop. It looks like some people saw this as Canonical foiling Flatpak's plan to create a single app standard, causing more fragmentation. However, it shouldn't be overlooked that Snap pre-dates Flatpak/xdg-app. Snap (formerly called "Click") was originally released in 2014 for cloud servers running Ubuntu, Internet of Things devices, and the ill-fated Ubuntu Phone project, but was later adapted for desktop use.
Slower initial load times
Because Snaps are compressed when first downloaded, the system needs to decompress the package before running the app. This ends up taking a bit of time when initially starting an app. There are also some other overheads that cause performance decreases.
This used to be a worse problem than it is now. There have been updates to Snap that help alleviate this issue, and the Snap developers are actively working to improve this further.
Centralized app store
The only way to download Snap packages is from servers operated by Canonical (the company behind Snap and Ubuntu). There's no way to run your own Snap app store, like you can with other package formats such as Flatpak and .deb/APT. In addition, the software that Canonical's Snap servers run is not currently Open Source. However, I want to make clear that snapd – the software running locally on your computer that allows it to use Snaps – is Open Source (licensed under GPL 3.0) and you can view and contribute to its source code here.
This was an intentional architectural decision by Canonical stemming from the failure of APT repositories/PPAs to become a simple and reliable place where developers can publish apps and users can easily download them. You can learn more about this decision in this interview with Alan Pope, a member of the Snap team at Canonical:
This brings some advantages to users. When you have Snap installed, you don't need to worry about adding package sources and repositories; all of the apps you can download are immediately available from one place. And app developers don't need to think about where they need to publish their apps, since the store run by Canonical is the one-stop-shop for that. Simple. As well, Canonical have tests and infrastructure in place to detect if the developers have included any malware or crypto-miners into their apps, so they can be blocked from being published. While these tests might not be 100% foolproof, users can be more confident that the apps were verified by a trusted authority that they don't do anything nefarious.
On the other hand, some people are averse to this centralization. They don't want to rely on a single company – Canonical – to provide all of the apps they use. In addition, some people are sceptical of Canonical for other reasons (see below).
Flatpak has been designed to be decentralized, so anyone can run their own repository/app store and you can install Flatpak apps from multiple repositories on your computer. In fact, we run our own repository that hosts Flatpak versions of our themes (for compatibility reasons). However, in practice, most apps in the Flatpak ecosystem come from one single repository: Flathub. While it's good to know that you have the freedom to run your own Flatpak repository, it appears that the consensus amongst Flatpak users and developers is that having one repository is more convenient.
Scepticism of Canonical
There are many reasons why some people are wary of Canonical and Ubuntu and are thus biased against their work (like Snap). This is a whole separate topic which I won't go into personally, but I'd recommend you to watch this video about it if you're interested:
The Chromium Snap situation
Talking more specifically about Snaps, some people were left with a bitter taste in their mouth after a recent decision Canonical made. The APT package for the Chromium web browser in Ubuntu 19.10 onwards now installs the Snap version of it. If your computer doesn't have Snap support, installing this APT package will automatically install snapd before installing Chromium. While I understand why this decision was made, I admit that I still think this is a questionable step for Canonical to make, but that's just my personal opinion. This decision led Linux Mint to block the installation of snapd entirely, which you can learn more about here:
Our stance on Snaps and Flatpaks
All in all, we think that containerised app package formats are a huge leap in the right direction for distributing apps on Linux. They're making things far easier for app developers to create apps for the diverse range of Linux distributions out there, thanks to a more streamlined publishing process. They're simplifying things for users, who no longer need to worry if a certain app will work on their Linux distribution. And more importantly, the fundamental strategy is working. More and more developers are publishing their apps for Linux for the first time in the form of Snaps and Flatpaks, alongside their Windows and macOS versions. There's also a thriving ecosystem of new Linux-exclusive apps, in large part because of the advantages of these formats.
We recognize that – despite sharing many of the same goals – Snaps and Flatpaks are 2 different pieces of technology with different philosophies behind them, which result in advantages and disadvantages for each of them.
Some developers choose to publish their apps in both formats, and others prefer one of them exclusively. This means you can't get access to all Linux apps by choosing only Snap or only Flatpak. However, there aren't any technical limitations stopping you from using both on your system.
We agree with Snap sceptics on the risks of centralization, and relying on a single source to provide something as fundamental as third-party apps to your computer.
Finally, we believe that competition is a good thing. Healthy competition means that the players don't rest on their laurels, but actively work to improve their offering. In this case, the developers of each format work harder to improve their offerings with more features, better performance, and stronger security; all in the effort to make their format the "best" one. Ultimately we – the users – win because this raises the standard amongst the whole competition.
Because of all of these reasons, we've decided to include support for both Snap and Flatpak out of the box in Zorin OS, in addition to AppImage and traditional .deb packages (using the APT package manager). And in the upcoming Zorin OS 16 release, we're planning to add the Flathub repository out of the box, so users will have the widest access to apps possible.
Nevertheless, we believe in the freedom to choose. If you don't wish to use one of these formats in Zorin OS, you can always uninstall Snap by entering this command in the Terminal:
sudo apt remove snapd
or uninstall Flatpak with this command:
sudo apt remove flatpak
P.S. I might be mistaken about some point(s) above. If you notice any errors, feel free to correct me 
4 Likes
Greetings,
Kudos to a thoughtful and thorough look at this issue.
My two cents here is the big perspective of an outsider looking into Linux. I don’t consider Linux any better than Windows, Mac, iOS or Android. I simply see it as a competitor in the group.
As we speak (IMO) the pieces on the OS chessboard are moving. Dramatically. What was once a war between Mac and PC (with Linux barely in the desktop game) is now a war between ecosystem OSes:
- Mac OS and iOS on its way to becoming Apple OS
- Chrome OS marrying up to Android and being friendly with Linux apps
I believe that is where the game is right now. If your OS doesn’t have an ecosystem (direct connection to phone apps) there’s a relevance timeclock ticking. Hence why Windows and Linux are trying to bring your phone literally inside their OS options.
Many eyeball Microsoft Edge on Linux and wonder if there’s going to be a MicroLinux with a direct handshake to Android (think Bliss OS).
Or what if Android got serious about an Android OS option with a direct handshake to Linux apps? (Nudging Chrome OS aside.)
My experience is that Linux purists aren’t interested in any of this – because – a lot of it keeps tying users back to data-thirsty sleazeball corporations. But I’d wager the vast majority of mainstream [moderator edit - Name-Calling] PC/phone users have accepted that reality and are simply seeking EXTREMELY EASY TO USE operating systems with ecosystems that traverse their devices.
You might ask what any of this has anything to do with snap debates. Snap, as Mr. Zorin just explained above, is what normal people want. The type of ‘compromise’ all tech users live with day in and out. To them it’s a non-issue.
If Linux doesn’t want mainstream [moderator edit - Name-Calling] people, lol, there’s that. But I see a door open right now, maybe for a while, where a truly stable/faster/simpler Windows 10 alternative would be very attractive to said mainstream [moderator edit - Name-Calling] users. Yes, it lacks the phone ecosystem – but then so does Win10.
I also believe Mac users are waking up to how over-priced Cook’s Apple is – and would be delighted by a Mac friendly LInux on a PC a quarter of the price of its iRoll equivalent.
So for my two cents OS stability/elegance is far more important than possible shortcomings of an install process. All OSes have that issue.
POSTSCRIPT
Hey. I’m all for board moderation. But editing out the word ‘normal’ and calling it ‘name-calling’ is rather misleading. Typical, average, mainstream, and normal are all brethren and not insulting. Being labeled a ‘name-caller’ is name-calling.
1 Like
Anyone for Beta Max? 
8-track audio? 
8-bits? 
