Aqua Nautilus researchers have identified a security issue that arises from the interaction between Ubuntu’s command-not-found package and the snap package repository. While command-not-found serves as a convenient tool for suggesting installations for uninstalled commands, it can be inadvertently manipulated by attackers through the snap repository, leading to deceptive recommendations of malicious packages. Additionally, our …

Aqua Nautilus researchers have identified a security issue that arises from the interaction between Ubuntu’s command-not-found package and the snap package repository. While command-not-found serves as a convenient tool for suggesting installations for uninstalled commands, it can be inadvertently manipulated by attackers through the snap repository, leading to deceptive recommendations of malicious packages.

  • octopus_ink@lemmy.mlEnglish
    11·
    8 months ago

    I’ve still never quite been able to understand the problem being solved by going back to what we were happy to leave behind with Windows: The google, download, install, hope it’s not malicious, software installation model.

    I should add that it’s VERY common when one of these “OMG I tried Linux and I can’t even install anything” posts come up, it’s because they are still doing that. Google, download, install, hope it’s not malicious. And they grab something that’s a bad choice for their distro, or not the best way to install something etc.

    Not that many years ago, you could quickly explain that in the Linux ecosystem that’s really not how it works, and is not a good choice until they are experienced enough to make an informed decision. How do you tell the noobies that now without having to then get into snaps/flatpak/appimage and all their differences and caveats?

    Saw just such a post in the past few days, and didn’t even try to explain their problem looked to be that they’d randomly installed shit they found googling, which is normal in Windows, but a bad idea in Linux. I’m not, nor will I ever be, an expert in all those ways of packaging, especially since I’ve eschewed their use myself.

    I see these as solutions without a problem, and that have made it harder, not easier, to help out the noobies when they come in trying to do things “Windows-style.”

    I’m sure there are people who love this evolutionary step, and that’s fine. I’m not a hater, so please don’t come at me as if I am. If these things work for you, I am happy they do so. I just feel we’ve put a lot of effort into trying to throw out the baby with the bathwater on this topic in recent years.

    Instead of looking to refine how package managers work and packages are maintained, we now have 15 competing standards. (/xkcd)