Purging of GNOME SNAP packages - Dependencies & Risks?

MATE Desktop
, ,
1

The disk usage under /snap was reported for the following as:

1.7G  gnome-3-34-1804
1.8G  gnome-3-38-2004
2.6G  gnome-42-2204
3.2G  gnome-46-2404

I don’t have the installation to use the GNOME desktop as an option, at least I don’t think so. It is not a choice offered on the login window.

Does MATE have dependencies on those?

If so, do I need to keep all 4 instances, or can I purge the 3 oldest and keep only “46-2404” ?

1 Like
2

If you don’t use snap you can delete them all.
You can use my script to remove all traces of snap completely from your system (or reinstall it if you regret it)

I removed all snap because it is securitywise the most vulnerable packagesystem for supplychain attacks.

  1. The snap-store is proprietary so you risk vendor lock-in
  2. there is only one snap-store, a single point of failure and therefore an attractive target.
  3. Anyone can upload without oversight and because the snap-store is proprietary, only a few people can vet the software in the store, no “many eyeballs” from the community (supplychain attack danger)
  4. it already has a history of peddeling malware(Issue 03 · Security Crisis) victims were made, in one case over $400,000.- lost in crypto.
  5. Ubuntu has a history of reacting very slow to snap security issues

Here is a quote from the forementioned link:

  • Alan Pope, a former Canonical employee and Snap Store maintainer, publicly stated that malware reports could go unresolved for days — and that the cycle had repeated itself more than once across different fake wallet apps.
  • Domain takeover hijacking was also used — attackers registered typosquat domains that intercepted update checks from installed fake wallets, allowing the malicious payload to persist and evolve even after initial detection.
  • ~50 Snap packages were estimated by insiders to have malware reports outstanding at any given time — with removal delays spanning multiple days after initial reports, according to publicly available community threads.
  • Canonical’s response speed was not proportionate to a company generating $292M in annual revenue, 83% gross margins, and growing its headcount year over year. The security team’s reaction time suggested understaffing relative to the store’s scale.

Technically, a sandbox around an application should increase security so the idea of snap is sound. It’s the snap-store implementation that sucks.

1 Like
3

snap packages don’t technically have dependencies in regards deb packages; but they do have connections to other snap packages that are the same as dependencies except in name (design choice). (‘tomato’ vs ‘tomato’ pronunciation I guess ; The Mustang | Opinion: The Only Correct Pronunciation of “Tomato” )

Those aren’t used by the GNOME desktop; but maybe used by other snap packages you may have installed; and you’ll break them if removed.

As example, I did a snap list on this box, and I see gnome-46-2404 installed on my box here; and that’s not a snap package I’ve installed, so a quick check and I’ll see what uses it, and thus what maybe broken if I removed it

guiverc@d7050-next:~$   snap connections gnome-46-2404
Interface               Plug                                     Slot                         Notes
content[gnome-46-2404]  chromium:gnome-46-2404                   gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  desktop-security-center:gnome-46-2404    gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  element-desktop:gnome-46-2404            gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  firefox:gnome-46-2404                    gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  firmware-updater:gnome-46-2404           gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  opera:gnome-46-2404                      gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  prompting-client:gnome-46-2404           gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  snap-store:gnome-46-2404                 gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  snapd-desktop-integration:gnome-46-2404  gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  telegram-desktop:gnome-46-2404           gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  vivaldi:gnome-46-2404                    gnome-46-2404:gnome-46-2404  -
content[gnome-46-2404]  zoitechat:gnome-46-2404                  gnome-46-2404:gnome-46-2404  -

I’m replying here using the brave browser which uses gnome-42-2204 and thus that wouldn’t be impacted if I removed gnome-46-2404, but it would be impacted if I removed that older version.

Which connections are used is determined by the builder of the snap package; somewhat like depends rules for deb packages actually…

1 Like