3 ms·

Snap is the one reason I most don't want to update Ubuntu, but sandboxing the browser in particular (and email client) is the one place where Snap makes a lot o

by blagie 4y ago

Snap is the one reason I most don't want to update Ubuntu, but sandboxing the browser in particular (and email client) is the one place where Snap makes a lot of sense to me (as do subsystems like SELinux). My key problems is that I care less about Firefox being snappy as it not making the rest of my system slow: - I don't know what bug X has, but application should not be able to commender my mouse cursor. I've seen bugs in Firefox+Ubuntu multiple times that feel like they might have security implications. - A web page should not be able to use 100% of a CPU. There should be some kind of hard limit, perhaps with burst performance as well - Related to the above, a background tab shouldn't drain my battery if I'm on a laptop. I don't want to give random web pages 100% of my CPU. - Firefox should not be able to keep sucking RAM. I have hundreds of GB of swap, primarily so I don't need to worry to Firefox/Chrome/etc. memory usage/leaks. That's crazy. - Firefox should not be able to suck GPU resources. This is a place I'm convinced there are issues with security implications. GPU drivers are engineered for performance and not stability, and there are edge cases. - Less relevant to my system, disk usage is an issue on many smaller devices, with offline storage in browsers. - Bandwidth limits for pages would be nice too, for both 5G bandwidth and battery. I'd love to see richer benchmarks. Even if not optimized, I'd feel better if Ubuntu / Mozilla were actively aware / looking at these sorts of things. I'd also like someone to think through concrete ways in which snap helps my security. Firefox can overwrite arbitrary files on my system (save-as -> pick one of your files). That's convenient for me, and for an attacker. An open sandbox doesn't help much. I'd love to see a holistic mile-high view where someone thinks through resource usage (across different types of resources), convenience, and security). Implementing snap without that type of homework seems premature. As a footnote, a lot of the issues might be solved with copy-on-write, both with regards to performance and memory.

enriquto 4y ago
> I'd love to see a holistic mile-high view where someone thinks through resource usage (across different types of resources), convenience, and security). Implementing snap without that type of homework seems premature. I agree. Process sandboxing should be independent from program packaging and distribution. It should be a core feature of your operating system (and it already is!) and not controlled in any way by the people who distribute the software: mozilla, canonical, etc. If you decide to sandbox some program, like firefox, or gimp, or inkscape, it should be easy, and out of control of other people. You get to decide the amount of resources that you want to give the app, and not the app developers themselves! Why this is not obvious to everybody is beyond me. Unfortunately, both snap and flatpack fail to use this sane approach, and try to shoehorn unrelated stuff like package distribution, dependency packaging, and app stores to this simple problem.
- blagie 4y ago
  Wow. That goes a level deeper than I had thought through myself. The place where I've always wanted to see this is on my phone. I would like to be able to deny apps network access, location access, contact lists, etc. This should not be a series of continuous pop-us ("let us scrape your data or you can't use our app"), but simply return a sandboxed empty contacts list (which the app can manage), a sandboxed storage for photos (which the app can add / remove photos from), and a random set of GPS coordinates. Firefox has errors, but no hostile code. Most apps seem to have hostile code. It's almost impossible to tell how hostile that code is for which app. Even when I do want to grant access, it's almost always too much. Many apps which have valid reasons to e.g. take and store photos, but that doesn't mean I want them to be able to copy and analyse my personal photos.
- yjftsjthsd-h 4y ago
  Sounds like you're asking for firejail or bubblewrap?
akvadrako 4y ago
> Snap is the one reason I most don't want to update Ubuntu That is no reason to avoid updating. I use the latest Ubuntu and just uninstall snap. It's not needed for anything.
- blagie 4y ago
  I use the second-to-latest LTS Ubuntu, and did the same when I upgraded. That said, the overhead to getting non-annoying Ubuntu increases with each version. It feels like someone there is creating make-work; like people need a job and just randomly change things, without making them better. Installing latest LTS Ubuntu involves going through this whole annoying process all over again. That's not to mention the sketchy app-stores, cross-sells, etc. It's a lot less sketchy than Windows or Android, but it's not a good direction. No, I don't want an app store. No, I don't want to send data to Ubuntu. No, I don't want cloud services, accounts, and whatnot. Come to think of it, an up-sell I would pay for is an option to download Ubuntu without all this crap. I understand they need to stay in business, and I wish they'd do so without annoying me.

by blagie 4y ago

enriquto 4y ago

> I'd love to see a holistic mile-high view where someone thinks through resource usage (across different types of resources), convenience, and security). Implementing snap without that type of homework seems premature. I agree. Process sandboxing should be independent from program packaging and distribution. It should be a core feature of your operating system (and it already is!) and not controlled in any way by the people who distribute the software: mozilla, canonical, etc. If you decide to sandbox some program, like firefox, or gimp, or inkscape, it should be easy, and out of control of other people. You get to decide the amount of resources that you want to give the app, and not the app developers themselves! Why this is not obvious to everybody is beyond me. Unfortunately, both snap and flatpack fail to use this sane approach, and try to shoehorn unrelated stuff like package distribution, dependency packaging, and app stores to this simple problem.

blagie 4y ago
Wow. That goes a level deeper than I had thought through myself. The place where I've always wanted to see this is on my phone. I would like to be able to deny apps network access, location access, contact lists, etc. This should not be a series of continuous pop-us ("let us scrape your data or you can't use our app"), but simply return a sandboxed empty contacts list (which the app can manage), a sandboxed storage for photos (which the app can add / remove photos from), and a random set of GPS coordinates. Firefox has errors, but no hostile code. Most apps seem to have hostile code. It's almost impossible to tell how hostile that code is for which app. Even when I do want to grant access, it's almost always too much. Many apps which have valid reasons to e.g. take and store photos, but that doesn't mean I want them to be able to copy and analyse my personal photos.
yjftsjthsd-h 4y ago
Sounds like you're asking for firejail or bubblewrap?

akvadrako 4y ago

> Snap is the one reason I most don't want to update Ubuntu That is no reason to avoid updating. I use the latest Ubuntu and just uninstall snap. It's not needed for anything.

blagie 4y ago
I use the second-to-latest LTS Ubuntu, and did the same when I upgraded. That said, the overhead to getting non-annoying Ubuntu increases with each version. It feels like someone there is creating make-work; like people need a job and just randomly change things, without making them better. Installing latest LTS Ubuntu involves going through this whole annoying process all over again. That's not to mention the sketchy app-stores, cross-sells, etc. It's a lot less sketchy than Windows or Android, but it's not a good direction. No, I don't want an app store. No, I don't want to send data to Ubuntu. No, I don't want cloud services, accounts, and whatnot. Come to think of it, an up-sell I would pay for is an option to download Ubuntu without all this crap. I understand they need to stay in business, and I wish they'd do so without annoying me.