43

Today I wanted to install a Snap Package on Ubuntu Xenial, but it prompted me to register an account on Ubuntu Single Sign-On.

Why does Ubuntu ask us for such a thing?

Installing a Snap Package:

image

This is the reported bug on Launchpad, https://bugs.launchpad.net/ubuntu/+source/software-center/+bug/1581713

  • Because it wants to watch you everywhere... Just kidding! Snaps are following the apk policy. Future appstore sales are intended for creating an innovative and commercially-viable environment. – ipse lute Jun 15 '16 at 7:49
  • 11
    Why is it whenever I hear "innovative" I think furtive privacy-ignorant data harvesting? I think it's a massively backward step to start compiling a list of who has what software installed. In wrong hands it is also a security risk. It should be optional. – artfulrobot Mar 21 '17 at 10:38
  • 2
    The “account required” thing is why I so far has walked immediately away from snaps when encountered. Who ever thought this up completely misunderstood the audience. – Thorbjørn Ravn Andersen Dec 15 '17 at 4:43
  • Now a bit later I've found that being able to install snaps from the command line is fine with me. I still don't like the store. – Thorbjørn Ravn Andersen Jun 14 '18 at 9:46
8

This behavior is consistent with Ubuntu Software Centre. Canonical works with third-party software providers to provide payment and hosting for commericial software in the partner repository. In Ubuntu 16.04 LTS, this is being replaced by the Ubuntu App Store which powers the snap repository's backend.

While the command line tools provide access to free-of-charge snaps without issue, the Ubuntu Software store uses Ubuntu One to handle payment processing and order history (so that previous purchases can be downloaded and installed on any number of systems that you own).

So this is an implementation detail that matches the behavior of the software being replaced by Ubuntu Software.

  • 5
    But.. Why do I need an account to install Videolan? Isn't it fully open source? I understand if it was an application that I need to buy , but for an open source application? Prior versions never required an account to install open source software, why start now? – Ismael Apr 15 '17 at 1:31
  • Prior versions did not exist, because this requirement for snaps has existed since snaps were integrated with Ubuntu Software. You do not need to log in to install VLC. Either install it from the repositories or install the snap via the command line with 'sudo snap install vlc'. – Nathan Haines Apr 16 '17 at 20:59
3

There is a technical reason and a design reason for the current behaviour.

Firstly, snapd requires some form of authentication since it is performing a system-level operation. On the command line you can use sudo, just like when you apt install, so no online account required. When using Software, the only form of authentication currently available is the Snap store. Alternatives are being discussed...

I did an attempt to resolve this by trying to get snapd to generate a Macaroon without store access. But as I understand it getting a Macaroon requires a round trip to the store.

So I think the solution to this is to either allow snapd to generate local Macaroons or use some other type of authentication token for local access. (comment 27)

Secondly, SSO authentication was the primary design pattern because Snappy's primary use-case is managing multiple IoT devices. The negative effect on desktop/laptop users was unplanned.

The net effect is much better security for these devices... look at modern wifi access points, for example. You get a single management account, usually in the cloud, and you manage all devices through that. (comment 25)

It looks like there is a plan to change the behaviour so that desktop/laptop users aren't required to use an online account to authenticate. You can subscribe to the bug to receive news as changes are made.

Handing out a token to root that provides an authorization to manipulate the system is analogous to allowing root itself to be doing removals without further store information, which we allow... The necessary infrastructure for that is pretty much in place since we already have to maintain the local and remote macaroons separately, and the situation where the remote macaroon is missing or incorrect is already handled. (comment 29)

  • «snapd requires some form of authentication since it is performing a system-level operation. On the command line you can use sudo, just like when you apt install, so no online account required. When using Software, the only form of authentication currently available is the Snap store.» When using Software for a normal package, I'm prompted for my local password. – tuxayo Dec 12 '17 at 8:44
  • It appears that snapd uses Polkit to authenticate system actions, but also requires you to log into an online account as well as having system authentication. – Cole Erickson Oct 3 '18 at 19:08
  • Aren't snaps supposed to be sandboxed? Why do they need system level access? So, what? Now the Snap store is acting as a sudoers authority? How is this not insane to anyone? – rich remer Jun 8 at 17:35

protected by Community Sep 13 '17 at 16:19

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.