45

Today I wanted to install a Snap Package on Ubuntu Xenial, but it prompted me to register an account on Ubuntu Single Sign-On.

Why does Ubuntu ask us for such a thing?

Installing a Snap Package:

image

This is the reported bug on Launchpad, https://bugs.launchpad.net/ubuntu/+source/software-center/+bug/1581713

Improve this question
4
  • Because it wants to watch you everywhere... Just kidding! Snaps are following the apk policy. Future appstore sales are intended for creating an innovative and commercially-viable environment.
    – ipse lute
    Jun 15, 2016 at 7:49
  • 11
    Why is it whenever I hear "innovative" I think furtive privacy-ignorant data harvesting? I think it's a massively backward step to start compiling a list of who has what software installed. In wrong hands it is also a security risk. It should be optional.
    – artfulrobot
    Mar 21, 2017 at 10:38
  • 2
    The “account required” thing is why I so far has walked immediately away from snaps when encountered. Who ever thought this up completely misunderstood the audience.
    – Thorbjørn Ravn Andersen
    Dec 15, 2017 at 4:43
  • Now a bit later I've found that being able to install snaps from the command line is fine with me. I still don't like the store.
    – Thorbjørn Ravn Andersen
    Jun 14, 2018 at 9:46

2 Answers 2

Reset to default
8

This behavior is consistent with Ubuntu Software Centre. Canonical works with third-party software providers to provide payment and hosting for commericial software in the partner repository. In Ubuntu 16.04 LTS, this is being replaced by the Ubuntu App Store which powers the snap repository's backend.

While the command line tools provide access to free-of-charge snaps without issue, the Ubuntu Software store uses Ubuntu One to handle payment processing and order history (so that previous purchases can be downloaded and installed on any number of systems that you own).

So this is an implementation detail that matches the behavior of the software being replaced by Ubuntu Software.

Improve this answer
2
  • 5
    But.. Why do I need an account to install Videolan? Isn't it fully open source? I understand if it was an application that I need to buy , but for an open source application? Prior versions never required an account to install open source software, why start now?
    – Ismael
    Apr 15, 2017 at 1:31
  • Prior versions did not exist, because this requirement for snaps has existed since snaps were integrated with Ubuntu Software. You do not need to log in to install VLC. Either install it from the repositories or install the snap via the command line with 'sudo snap install vlc'.
    – Nathan Haines
    Apr 16, 2017 at 20:59
3

There is a technical reason and a design reason for the current behaviour.

Firstly, snapd requires some form of authentication since it is performing a system-level operation. On the command line you can use sudo, just like when you apt install, so no online account required. When using Software, the only form of authentication currently available is the Snap store. Alternatives are being discussed...

I did an attempt to resolve this by trying to get snapd to generate a Macaroon without store access. But as I understand it getting a Macaroon requires a round trip to the store.

So I think the solution to this is to either allow snapd to generate local Macaroons or use some other type of authentication token for local access. (comment 27)

Secondly, SSO authentication was the primary design pattern because Snappy's primary use-case is managing multiple IoT devices. The negative effect on desktop/laptop users was unplanned.

The net effect is much better security for these devices... look at modern wifi access points, for example. You get a single management account, usually in the cloud, and you manage all devices through that. (comment 25)

It looks like there is a plan to change the behaviour so that desktop/laptop users aren't required to use an online account to authenticate. You can subscribe to the bug to receive news as changes are made.

Handing out a token to root that provides an authorization to manipulate the system is analogous to allowing root itself to be doing removals without further store information, which we allow... The necessary infrastructure for that is pretty much in place since we already have to maintain the local and remote macaroons separately, and the situation where the remote macaroon is missing or incorrect is already handled. (comment 29)

Improve this answer
3
  • «snapd requires some form of authentication since it is performing a system-level operation. On the command line you can use sudo, just like when you apt install, so no online account required. When using Software, the only form of authentication currently available is the Snap store.» When using Software for a normal package, I'm prompted for my local password.
    – tuxayo
    Dec 12, 2017 at 8:44
  • It appears that snapd uses Polkit to authenticate system actions, but also requires you to log into an online account as well as having system authentication.
    – Ashelyn Dawn
    Oct 3, 2018 at 19:08
  • 2
    Aren't snaps supposed to be sandboxed? Why do they need system level access? So, what? Now the Snap store is acting as a sudoers authority? How is this not insane to anyone?
    – rich remer
    Jun 8, 2019 at 17:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .