Reply to post: Snaps from L. Poettering ?

Oh Snapd! Gimme-root-now security bug lets miscreants sock it to your Ubuntu boxes

TJ1

Snaps from L. Poettering ?

Snaps (snappy) is developed at Canonical, and originated for the now-defunct Ubuntu Phone.

Unless I missed something L. Poettering works for Red Hat and has never been a developer of Snappy/snapcraft.io/snapd et al.

The *idea* is a reasonable one - for an OS that uses system libraries that are not compatible with some application, make it possible for the application developer to publish, at will, a blob that contains all the required dependencies, and isolate it from the host OS to limit opportunities for compromise.

The bigger the delta between the host OS and the application though, the more needs to be included in the blob.

In your particular case "just a media player" is a vast under-appreciation of VLC. It needs all the plugin libraries, and the libraries they depend on, possibly down to libc itself.

I would assume the snap has to ship almost all plugins rather than them being able to install on demand as the Host OS can do, so you'll end up with that is effectively another OS image.

The typical dependency tree for 'vlc' on a Debian/Ubuntu/Mint system (even ignoring Recommends: and Suggests:) is 5,700 packages! Here's the rough calculation:

$ apt-cache depends --no-suggests --no-recommends --recurse vlc | egrep 'Depends:' | cut -d: -f 2 | sort | uniq | wc -l

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon