@linux Sharing a ‘small’ inconvenience I had to fix with #opensuse #slowroll (I suspect #tumbleweed is the same) - I couldn’t launch snaps (spotify, bitwarden) after update - error was: cannot determine seccomp compiler version in generateSystemKey fork/exec /usr/lib/snapd/snap-seccomp: no such file or directory

The fix (I first tried re-installing, didn’t work) was to:
a. locate snap-seccomp - was in /usr/libexec/snapd
b. symlink: ln -s /usr/libexec/snapd /usr/lib/snapd

#linux #snap

    • ❌ Ditto@fosstodon.orgOP
      link
      fedilink
      arrow-up
      7
      ·
      5 months ago

      @pastermil @linux I use both. There are packages where the website officially lists snap packages, no flatpaks.

      Unless the project website has a link/install instruction recommending flatpak, I prefer either the distribution package where available, or snap otherwise - this is more from a supply-chain perspective - since snap requires the original developers of the package to package snaps.

      If the developers have officially listed flatpak on their site, that however, is good enough for me.

      • pastermil@sh.itjust.works
        link
        fedilink
        arrow-up
        1
        ·
        5 months ago

        I would take this with a grain of salt. For me, as long as the package is available and functional for my prefered installation method, I’d go with that.

        Take cerbot for example. For some reason, the cerbot developers uses snap in their installation guide. I’ve been using apt on all my projects that requires https, both personal and professional (yes, I get paid to do this, among others). Never had any issue with it.

        • ❌ Ditto@fosstodon.orgOP
          link
          fedilink
          arrow-up
          4
          ·
          5 months ago

          @pastermil @linux the attack surface for something that isn’t officially maintained by the developers, and that doesn’t have more vetting (e.g. distribution packages) opens up room for malicious actors.

          e.g. #arch / #aur recommends verifying scripts manually before installing, and malicious scripts have been found and removed.

          There are actors like #jiatan out there. An unofficial #flatpak needs manual verification before install - that’s why I just go with #snap if the flatpak isn’t official

          • Alex L 🕊 🇵🇸@mastodon.social
            link
            fedilink
            arrow-up
            5
            ·
            5 months ago

            @thegreybeardofthetree @pastermil @linux

            FYI FlatHub uses GitHub Actions, you can check how they build their apps and some of them support reproducible builds, just in case you want to verify GitHub isn’t acting maliciously.

            FlatHub and AUR can’t really be compared in terms of security. Flatpak apps also don’t modify the host OS, while AUR packages can.

            Personally, I only trust distro packages and FlatHub.

          • NaN@lemmy.sdf.org
            link
            fedilink
            English
            arrow-up
            4
            ·
            edit-2
            5 months ago

            Are you sure snapcraft requires the original developer publish snaps? This seems unlikely, but they may have updated their policies.

            Edit: they aren’t, Signal for example is an unofficial snap not published by the Signal developers but rather “snapcrafters” - https://snapcraft.io/signal-desktop. This is very similar to how Flathub handles unofficial packages, except Flathub seems to have more gatekeeping (Snapcrafters doesn’t allow just anyone, but you don’t have to be part of that group to publish).

            Snapcraft has hosted multiple malicious applications, so I wouldn’t exactly call it a safe place either.

          • pastermil@sh.itjust.works
            link
            fedilink
            arrow-up
            2
            arrow-down
            1
            ·
            5 months ago

            the attack surface for something that isn’t officially maintained by the developers, and that doesn’t have more vetting (e.g. distribution packages) opens up room for malicious actors.

            There are actors like #jiatan out there.

            Funny that Jia Tan was an official maintainer of xz until he was found to be problematic.

            Speaking of verifying, you know you can’t really verify anything on the snap server since they’re proprietary, right? On the contrary everything on flathub is laid to bare for anyone to look at.

            In the end, you’re free to choose. Since you’ve kindly provided your argument, I’ve provided mine in hope you’d reconsider.

  • bravemonkey@lemmy.ca
    link
    fedilink
    arrow-up
    4
    ·
    5 months ago

    This is why I prefer using Distrobox on my personal computer. No package for Signal-Desktop? No problem, run it through a Debian container using Distrobox.