- cross-posted to:
- linux@lemmy.ml
- technology@beehaw.org
- cross-posted to:
- linux@lemmy.ml
- technology@beehaw.org
A Bitcoin investor was recently scammed out of 9 Bitcoin (worth around $490K) in a fake “Exodus wallet” desktop application for Linux, published in the Canonical Snap Store. This isn’t the first time; if nothing changes, it likely won’t be the last.
It is on the FlatHub as well.
That’s is the genuine one. There is a genuine company called Exodus for Crypto. The problem is that a scammer made their own clone and nobody verified whether they really are from the Exodus company.
If you check the manifest on Flathub you’ll see they verified it belongs to the real Exodus
Yes. You are right. Thanks. Just listened to the Linux Matters podcast episode about this. Crazy.
That one apparently is legit: https://floss.social/@sonny/111966204515001155
42,396 installs… Holy shit.
Edit, from the article:
Any chance that the FlatHub one is legit?
Apparently the Flathub one is indeed legit
It’s produced without upstream involvement but does seem to be legit so far. I placed a post seeking clarification about the Flatpak situation on Reddit 6 months ago. I quickly got a response after posting it. However, the response was from some scammers and I never got a response from the company behind it itself.
deleted by creator
I mean FlatHub isn’t safe in general. You could just target someone downloading the package and give them a malicious package instead. FlatHub doesn’t check sigs, so its a hot mess
The repo is gpg signed. I don’t know why you think thats not sufficient.
“packages” don’t exist like traditional distros. Its a large repo of data.
Point me to the documentation that describes this
https://ostreedev.github.io/ostree/man/ostree.html - GPG verification section
This isn’t even the right project’s documentation
… I assumed you knew the basics.
Flatpak uses ostree for all data. https://docs.flatpak.org/en/latest/under-the-hood.html
I’m disappointed you criticize the project so harshly with no knowledge of it.