Today Ubuntu (and some other distros) offer a new way to install software, which is snaps. It's software packaged with all its dependencies, run with some kind of containerization, and auto-updated. This might make it sound like it's definitely a safer option, but when you think about it it actually depends on several factors, and probably the most important are:
- Containerization sounds like a good thing to have, but what kind of containerization is it exactly? Does it really help? Plus, you aren't asked what you want to allow or disallow when you install a package, so I suppose the application itself decides whatever it want to access on the system. I guess it might prevent the exploitation of some vulnerabilities only if the application is correctly restricted by the developer (or whoever packages it), but will it help against a compromised or malicious application?
- Maintenance seems to be much better for snaps, which appear to be all up-to-date (latest branch and patches) and updated pretty quickly when a new version is available. Software in official repos is always old versions (although hopefully patched but in a way that is not evident from the version numbers), so it's not clear how quickly and what, if ever, will be patched in the repos. However the problem for both snaps and repos is: who the hell is maintaining the software, and is the supply chain equally secure (or insecure) in both cases? I tried checking the maintainer for several popular packages in the official repos, and it's always "Ubuntu Developers" (whatever that means). If you do the same with snap (
snap find <whatever>), you will see lots of different "publishers" (whatever that means). For example
android-studioand lots of others are published by "snapcrafters";
vlcis published by "videolan" with a green checkmark (verified publisher, whatever "verified" means, since at the moment there isn't even a way to become verified, it's just "Canonical's friends" I guess);
keepassxcis published by "keepassxreboot";
john-the-ripperis published by "claudioandre-br", who on GitHub seems to be a developer who forked and patched the official John The Ripper. So it's all very confusing.
So the question is: are snaps a more secure alternative to the official repos? If a user wanted to install, say, Keepassxc would it be safer to install it from the official repos or with snap? Or what would a user need to check before making a choice?
Note that for example the latest version of Keepassxc is 2.6.6 (from the official website), and snap provides version 2.6.6 (so it's easy to see this is fully patched) while Ubuntu's official repos have 2.4.3+dfsg.1-1build1 (I suppose and hope it's an old version that has been fully patched for security issues, but it's not clear from the name). You would definitely be tempted to install it from snap, until you remember that snap is a relatively new thing and I have no idea how much I can trust the whole process. And that's what made me ask this question.