Please revoke telegram-latest

[lucyllewy]

@niemeyer

Also, your snap info output shows a different output than mine. Mine says the publisher is “Saleh”?

My output is identical to @sergiusens’ above. publisher listed as “pain7”:

name:      telegram-latest
summary:   Telegram Desktop Client latest
publisher: pain7
contact:   Dev9Ar@gmail.com
description: |
  Telegram is a popular messaging protocol with encryption ...
snap-id:     2HRsGY7THIQWdKvzbrHACxrwUZuuDiWA
channels:              
  stable:    1.0.5 (4) 29MB -
  candidate: ↑              
  beta:      ↑              
  edge:      ↑

[Ads20000]

$ snap info telegram-latest
name:      telegram-latest
summary:   Telegram Desktop Client latest
publisher: Saleh

bizarre!

$ snap version
snap    2.31
snapd   2.31
series  16
ubuntu  17.10
kernel  4.13.0-32-generic
$ # core 16-2.31 (4017, candidate)

[noise]

Looks like 2.31 changed the developer username column to show display name, was that was intentional?

Note in the details API response these are “origin” and “publisher” respectively, for historical reasons.

[niemeyer]

No, that’s definitely not intentional. The display name is not unique and can be changed, so not sensible by itself. We’re working on 2.23.1 2.31.1 already, and will neee to fix that too.

cc @mvo

[sparkiegeek]

@niemeyer

We’re working on 2.23.1

I suspect that it’s not 2.23.1 that’s being worked on? Can you please clarify?

[niemeyer]

Sorry, 2.31.1.

I’ll be happy to move out of the ones twos and threes.

[simos]

telegram-latest was last updated more than one year go (2017-02-07). It is currently in the fourth revision, therefore it has been in the store for more than a year.

It uses the following plugs,

plugs:
- unity7
- network
- network-bind
- home
- pulseaudio

therefore, if it were malicious, it could send over the network both the Telegram user credentials, and any X.Org information.

I would expect that in telegram-latest, the latest denotes the username of the user. Is that notation enforced? (it’s not the case here).

[niemeyer]

@simos The “latest” in this case seems to demonstrate an intention of keeping it up to date, but it’s clearly not being met. If we can’t get in touch with the publisher, we may end up having to revoke this name on the basis of it being misleading.

The topic of the username presentation was moved here:

How to display account names and usernames

In the last sprint a few weeks ago the topic of how to display the name and username of publishers and other accounts came up again. Right now we have a few different ways to do that, and we’d like to standardize on something that is reasonable and consistent across the several frontends. Then, as a coincidence we’ve also landed a change just recently that went out in 2.31, modifying how usernames are presented in the terminal. The change looked simple and obviously correct, yet it wasn’t becau…

[sergiusens]

I reached out in September Please revoke telegram-latest

[niemeyer]

Okay, no replies? I suggest trying once more now, and if we don’t get a reply again it seems fine to go ahead and revoke, on the basis that it has a misleading name, and it’s out of date for a long time, contradicting its name.

[noise]

I attempted to contact the developer last week as well and having received no response I’ve gone ahead and unpublished telegram-latest.

[bashfulrobot]

That is a good point. I guess I was looking at it as being a “trusted” source for the users who may not have the knowledge on how to “vet” packages - and maybe a friendly way for the non-developer/non-snapcrafters community members to “trust” packages. point taken though!