Snap store from Canonical (Ubuntu) hit with another crypto scam app

If Google and Apple, with all that power, cannot keep their stores clean all the time, how is that a surprise that a malicious app got into Canonical's app store?

i know a way that can fix this problem but it may be easier said than done

1. mark any snap that has been uploaded by any one that is not part of the project team or Canonical as unofficial
2. all unofficial apps need to be checked to make shore the snap dose not contain malicious code
3. all snaps need to be randomly checked to make shore the snap dose not contain malicious code

Quoting: MadWolfi know a way that can fix this problem but it may be easier said than done

1. mark any snap that has been uploaded by any one that is not part of the project team or Canonical as unofficial
2. all unofficial apps need to be checked to make shore the snap dose not contain malicious code
3. all snaps need to be randomly checked to make shore the snap dose not contain malicious code

Well it is how to perform #2 and #3 that is the question, not that it should be done, but how. AFAIK they are closed source.

The one thing that this demonstrates is that some people seem to trust the snap store as a safe place where it should be treated with the same caution as if it was the open internet. Of course that still wouldn't help some people, but I most Linux users should be able to manage.

They're trying to do something that full blown governments struggle to do.
Trustworthy international financial services.

I only see 3 real solutions to this issue they could try.
1. Find 1+ less scammy open source projects providing crypto wallets and just make theirs the only ones on your store.
2. one build the wallet yourself and make it the only one on your store.
3. obtain the cd containing the program personally at the producer's house and inspect their id-cart.


3 is basically how it is done for every individual intra european banking customer, which also shows its weakness. This is the level the EU checks consumers not banks. Snap simply doesn't have the recources to do that for proprietary apps.


Last edited by LoudTechie on 23 February 2024 at 8:41 pm UTC

Quoting: Purple Library GuyI'm not sure I understand the problem. Was this not the behaviour he was expecting? Is the problem that the crypto app stole his money instead of the exchange doing it?

I'm reading Tracers in the Dark at the moment. I'm up to the part where Mt. Gox lost 500,000 bitcoins (every single Bitcoin they were entrusted with), managed to find 200,000 from an old wallet, and the rest remains lost.

Cryptocurrency exchanges (huge ones) have fallen again and again over the years.

If you're going to hold a lot of cryptocurrency, you want to hold that in a private wallet... ironically, you might be better at protecting it yourself than these exchanges with so many resources.

And I wouldn't trust just any store. Get the wallet software directly from the developer.

This is something AppImage is best suited for, actually...

Quoting: Hannes

Quoting: SzkodnixOh no!

Anyway speaking of Flatpak...

I use mostly snaps and very few flatpaks because Snapcraft is way ahead of Flathub in terms of verified (mainstream-ish) apps. Unverified apps should always have a big fat warning sign.

Yep, this ^^^^!

Quoting: Tuxee

Quoting: ShabbyXHappy to say I finally switched to Debian last week, no more Canonical nonsense for me thank you very much.

Does Debian have a crypto wallet app in its core repositories? If no (and given that you need such one) - how would you evade a potential scam? The dude entered his 12-word super secret recovery key...

I don't know nothing about using crypto currencies, but I found these apps e.g.:
https://packages.debian.org/bookworm-backports/electrum
https://packages.debian.org/bookworm/monero
https://packages.debian.org/sid/dogecoin

Quoting: Eike

Quoting: Tuxee

Quoting: ShabbyXHappy to say I finally switched to Debian last week, no more Canonical nonsense for me thank you very much.

Does Debian have a crypto wallet app in its core repositories? If no (and given that you need such one) - how would you evade a potential scam? The dude entered his 12-word super secret recovery key...

I don't know nothing about using crypto currencies, but I found these apps e.g.:
https://packages.debian.org/bookworm-backports/electrum
https://packages.debian.org/bookworm/monero
https://packages.debian.org/sid/dogecoin

Ah yes, Dogecoin. The most sensible of the crypto IMO. After all, it's perfectly reasonable for the ruler of Venice to be issuing coinage.

Spoiler, click me

On second thought, I should probably explain the obscure joke: Renaissance Venice was ruled by a sort of elected duke, called the doge. Useless facts for your entertainment and edification!

Last edited by Purple Library Guy on 24 February 2024 at 6:26 pm UTC

I published to the snap store. It is largely unmoderated. They have 100 something automated tests that check for formalities and if one of those fails, they tell you to fix it because they don't want to manually review your app and they also don't do it in a timely manner.