Open Store's warning sucks big. Can we have a "Safe Store"?

MarkG_108 · 9 Sept 2019, 04:52

"OpenStore allows installing unconfined applications. [..] An unconfined application has the ability to break the system, reduce its performance and/or spy on you."

Who in their right f***ing mind would agree to such a thing? Can we not have a "Safe Store" where such an outlandish warning is not required?

TotalSonic · 8 Sept 2019, 22:05

@MarkG_108 said in Open Store's warning sucks big. Can we have a "Safe Store"?:

"OpenStore allows installing unconfined applications. [..] An unconfined application has the ability to break the system, reduce its performance and/or spy on you."

Who in their right fucking mind would agree to such a thing? Can we not have a "Safe Store" where such an outlandish warning is not required?

The unconfined apps are manually checked by the UBports team before they are allowed onto the Open Store. But, given that the Open Store team has limited resources for audits, if those things are still of in any way a concern to you for any particular app - then you should most definitely not install it. fwiw - I have used a number of unconfined apps (such as the UT Tweak Tool, Launcher Modular, etc.) with no problems for 10 months as a daily driver. But if you have deeper security concerns for your own usage- you should stick only to the Core apps and the confined apps. As far as a "Safe Store" goes - if you can volunteer your own time and expertise towards making one happen - that will likely expedite it happening.

Best regards,
Steve Berson

hummlbach · 9 Aug 2019, 22:12

First, please change your wording and try to be respectful.
Second, people who more or less know and trust the developers would agree to such things. There are some popular apps, where you can be pretty sure, they do no harm, but nonetheless the warning should be there. Also all the unconfined apps must be open source and are reviewed before they are published to the store.
Third: If an app is unconfined its usually to get around shortcomings of the system. Its really not nice, but that is how it is atm. Most people will prefer to have apps there with a warning over not having them available. Maybe a switch in the settings to hide unconfined apps would suit your needs?

MarkG_108 · 8 Sept 2019, 23:37

Be interesting to apply this to a food store:

"OpenFoodStore allows installing unconfined foods. [..] An unconfined food has the ability to break your body, reduce its performance and/or spy on you."

Hopefully no one would agree to such a thing regarding their health. That people feel it's okay for their devices and their privacy to be treated with such disregard is alarming.

TotalSonic · 8 Sept 2019, 23:47

@MarkG_108 said in Open Store's warning sucks big. Can we have a "Safe Store"?:

Be interesting to apply this to a food store:

"OpenFoodStore allows installing unconfined foods. [..] An unconfined food has the ability to break your body, reduce its performance and/or spy on you."

Hopefully no one would agree to such a thing regarding their health. That people feel it's okay for their devices and their privacy to be treated with such disregard is alarming.

They are NOT being "disregarded". Again - unconfined apps have their source code reviewed before being posted in the Open Store. And again - with such a small community of contributors, people can make their own decisions as to what app developers they trust, and they can make their own decisions as to what risks they are willing to take on. Frankly - Google and Apple allow much greater potential abuses while portraying themselves as fully secure. The warnings provided by the Open Store are to make known the fact that UBports does not have the resources to do 100% guaranteed audits of every single part of every single click provided in the Open Store - but they do due diligence by making people aware of what exactly permissions an app is in fact granted, and by making people aware of potential risks in any unconfined app (for which are rarer exceptions of what is available in the Open Store - most apps are in fact confined)

Best regards,
Steve Berson

Photojoe4 · 9 Sept 2019, 00:07

So, you can't be trusted to not download an app that you've been warned about? One of the things that appeals to me most about using a Linux system (phone or computer) is that it puts ownership back in the hands of the user- if you break your system YOU can fix it. And luckily there's also a great community that will help you if it does break

MarkG_108 · 9 Sept 2019, 00:16

@Photojoe4 Whether or not I (or anyone) decides to take risks is fine. But there should be a safe option for downloads as well. With Debian, there's "stable", "testing", and "sid" (aka unstable). Many choose not to install packages from "sid" and stick with "stable", to remain more safe.
In this case, with Open Store, there only seems to be one option, that being the potentially system breaking, performance reducing spying option. Where's the stable option?

TotalSonic · 9 Sept 2019, 00:37

@MarkG_108 said in Open Store's warning sucks big. Can we have a "Safe Store"?:

@Photojoe4 Whether or not I (or anyone) decides to take risks is fine. But there should be a safe option for downloads as well. With Debian, there's "stable", "testing", and "sid" (aka unstable). Many choose not to install packages from "sid" and stick with "stable", to remain more safe.
In this case, with Open Store, there only seems to be one option, that being the potentially system breaking, performance reducing spying option. Where's the stable option?

The descriptions in the Open Store tells you exactly what permissions every single app requires. Once again - the vast majority of apps within the Open Store are confined. Once again - if an app is unconfined it is explicitly made known. YOU can choose which ones you want to install.

As for Ubuntu Touch OS itself - there is indeed a Stable channel, a Release Candidate channel (which receives tested weekly updates, and which I use with no problems for my daily driver device), a Developer channel (which receives mostly tested daily updates, but can once in a while have some regressions), and an "Edge" channel (which uses untested bleeding edge stuff).

Best regards,
Steve Berson

MarkG_108 · 9 Sept 2019, 03:01

@TotalSonic You're correct Steve. The OS, with the basic apps, comes with these options. Still, the apps store just being one group with such an ominous warning is...well...it is what it is, I suppose.

TotalSonic · 9 Sept 2019, 03:13

If they were honest - both Google Play Store and Apple iOS App Store would come with gigantic ominous warnings for tons of apps as well - but they don't, even though you have way more to be concerned from the likes of them. I appreciate the blunt frankness, that UBports gives instead.

Best regards,
Steve Berson

Lakotaubp · 9 Sept 2019, 05:01

@MarkG_108 On a different note I have taken the liberty to alter one of the words in your question. Can we please not use swear words on the Forum. Thank you

arubislander · 9 Sept 2019, 05:38

@hummlbach said in Open Store's warning sucks big. Can we have a "Safe Store"?:

Maybe a switch in the settings to hide unconfined apps would suit your needs?

I cannot speak to the needs of the OP, but he above suggestion does seem to go a long way to addressing the concerns raised. If the OP agrees maybe they could submit a feature request to this effect against the OpenStore?

Emphrath · 9 Sept 2019, 07:22

@MarkG_108 stable doesn't mean safe . It means stable. By the way Debian is one of the oldest GNU projects out there and there's no way one can compare such an open source mastodon, with tens of hundreds of contributors over decades, to sth as young as ut - which yet vastly benefits from debian code, but not yet from its whole community !

bhdouglass · 9 Sept 2019, 15:13

@MarkG_108 I've created an issue to improve the user experience around this popup and unconfined apps: https://gitlab.com/theopenstore/openstore-meta/issues/249

dobey · 10 Sept 2019, 12:10

@MarkG_108 With Debian, given your example, there is no safe option. In fact, by definition, every .deb will be less safe than all unconfined clicks, because every time you install a debian package, you are giving its creator full root superuser access to your system. With .click packages, especially on UT, they still cannot directly install files into any place in the system, nor do they get to provide pre/post install/remove scripts which are run as root user. Even the most unconfined .click is still significantly more confined than any .deb package is.

Granted, yes, the language in the warning is perhaps a bit scary, and shouldn't be the first thing seen, only once when opening the app, but at least you get some warning. With traditional PC Linux distributions, you get no warning. You only have the implied trust and assumption that the software you're running won't (or maybe can't, depending on one's level of understanding) do anything harmful. But that is simply a lack of understanding, and nobody having told you of the possible breaches of trust that can happen.

dobey · 10 Sept 2019, 12:13

@TotalSonic said in Open Store's warning sucks big. Can we have a "Safe Store"?:

If they were honest - both Google Play Store and Apple iOS App Store would come with gigantic ominous warnings for tons of apps as well - but they don't

Well, they do, but the wording isn't scary, and you need to understand the permissions systems to be able to understand what's being asked for when installing apps; but people aren't taught to understand this.

Also, the Ubuntu Touch security model is largely based on what iOS does here, so they are quite close, though I don't think iOS has an unconfined profile like we do.