5 ms·

Frankly, this is a very good example why I inevitably give up on using Debian. It is not the software writers' fault that your distro can't be arsed to keep it

by jarcane 11y ago

Frankly, this is a very good example why I inevitably give up on using Debian. It is not the software writers' fault that your distro can't be arsed to keep its package system up-to-date. Even the unstable branch is routinely multiple versions behind on software. The idea of linking end-user software versioning to the operating system version itself was always a dumb idea, but has become even more absurd over time. No other operating system but Linux (and possibly some BSDs) does this to the extent that the distro model does. I'm not limited to awkward work-around manual install methods just because the version of Notepad++ linked to Windows 8.1 hasn't been updated since it was released. The whole scenario is absurd. Yes, package repos are nice, but not when it means I'm perpetually multiple versions behind on common software just because a handful of nerds are trying to do the job of Github and Sourceforge combined, instead of just building an easier method of installing and updating third-party software.

sanbor 11y ago
Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce new bugs. Debian guarantees that when you install their distro things are going to work and are kind of secure. The tradeoff of having all the software in the distro being checked by people that have tested and checked that everything works well and smooth it's going delay updating the packages. But the idea of having a distro it's something that offers you that. That someone took the work of packaging and testing, so you can install things and everything works. I think that if more software would be offered statically compiled with all the libraries (like many apps in OSX), then we would be able to try the latest release of Gimp when it's released, instead of having to waste time trying to compile from source or waiting for being included in the next release of the distro.
- haddr 11y ago
  Spot on. I was always puzzled why some software just can't come statically compiled. I suppose not all apps can be distributed like that, but most of them can. I can't even remember how many hours I wasted on trying to compile a new version of some program, just to learn the infinite tree of dependencies, newer versions of existing libraries required, build prefixes tweaking etc... Most of that time could have been saved.
  - jhkaghjkga 11y ago
    Because any (possibly security-relevant) update to a library would mean that all software linking it statically has to be rebuilt. In reality that of course doesn't happen, so programs linking statically or including their own versions of shared libraries never get security updates for the included libraries.
    - digi_owl 11y ago
      If you want the perfect example of that problem, look to Windows. A couple of years back Microsoft discovered some kind of issue with their redistributable dlls. They patched Office etc, but could only offer a scanner that would check each and every dll to see if it was of a vulnerable version. And asked users to pester third party software providers for updates if the scanner found any.
    - sanbor 11y ago
      I wouldn't move from a package system to an "everything has to be statically compiled" system. But it would be a nice option to have when most of the software in your distro it's ok but you want to run some app without upgrading your whole distro/OS.
    - haddr 11y ago
      In the same way as you upgrade library you can just upgrade your software...
  - binarycrusader 11y ago
    Because statically linking everything has several negative consequences: * increased storage space * increased memory usage * increased downtime for updates (since more files have to be updated) * increased bandwidth usage (total size of download for update) * potentially increased security risks In short, trading off all of the above to simply avoid proper release engineering and simplified dependency management is the wrong answer. Our systems need less downtime and better security; not the opposite, which is what static linking brings. That's why Solaris, as an example, does not provide static archives for almost any of the components that are provided, especially libc.
- Ologn 11y ago
  > Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce new bugs. New versions of software also fix old stability and security bugs. If software became more secure with age, then the older your version of gnome screensaver, the more secure it would be ( https://www.jwz.org/blog/2015/04/i-told-you-so-again/ https://www.jwz.org/blog/2015/04/i-told-you-so-again/ ).
  - sanbor 11y ago
    > New versions of software also fix old stability and security bugs. Sometimes new versions of software fix bugs, sometimes they improve stability, sometimes they introduce new bugs, sometimes they decrease the performance, sometimes they become bloatware, sometimes several of this things happen in any combination.
- cmsj 11y ago
  Debian doesn't guarantee you anything. "stable" isn't bug free, what you're getting is a lack of newness. "stale" would be a better choice of word. It's not necessarily better, it's just not changing.
qplex 11y ago
It's called 'unstable' for a reason. New stuff breaks. Often.
- feld 11y ago
  This is the worst attitude to have about software
  - icebraining 11y ago
    What, having beta versions?
    - feld 11y ago
      That any new release is not to be trusted.
      - deleted 11y ago
        [deleted]
Ologn 11y ago
> It is not the software writers' fault that your distro can't be arsed to keep its package system up-to-date. That's it. Ubuntu releases every six months, it's not upstream's problem that an up-to-date version of your stable distro is using the program released in September 2014 (17 months ago). As XScreenSaver 5.32 was released in November 2014 and Debian stable was released in April 2015, you have to wonder why in those five months why it was not 5.32 which was released, or even 5.31, but 5.30 which was released seven months before. Does anyone remember July 2002 to June 2005, almost three years between Debian releases? I do. You can point figures for why that happened, but it makes little sense to point them at the upstreams who make your distribution possible. At the end of the day, the message jwz put in the code is crystal clear - if you are unhappy with the message and don't plan to keep your distro somewhat up to date, he'd prefer you just rip out xscreensaver from the distro and use an alternative. It doesn't make sense to compare him to a terrorist setting bombs as someone did in the thread. It goes back to the initial reply. For all the gnashing of teeth and finger-pointing and name-calling and effort to deal with this and other issues due to old packages - if Debian channeled all of that energy and effort into a shorter, saner release cycle, it would be much more beneficial to everyone. If stable Debian was as current as the last release of Ubuntu or Fedora or OpenSuse etc., this discussion would have never taken place. P.S. One good reason to download XScreenSaver 5.34 is the additional Android functionality. XScreenSaver 5.35 will possibly have much-expanded Android functionality when it is released (or if not, then 5.36 or one soon after). If you have Android Studio and an Android device (or emulator), compile it and give it a whirl. Once it gets into shape more for users, an APK will probably be put up, and possibly even a Google Play app. So if you're an Android developer, give it a whirl. Send an e-mail to the folks in the android/README with any bugs, questions, comments, patches etc. Probably best to e-mail first before doing the work on major patches. Give it a spin.
- icebraining 11y ago
  if Debian channeled all of that energy and effort into a shorter, saner release cycle, it would be much more beneficial to everyone. The whole point of Stable is that it doesn't change often. As a Debian user, I don't want to upgrade my servers every six months. I'm fine with stale packages (with backported security patches). There's a reason why Ubuntu, despite its standard release cycle, also maintains LTS releases for both servers and desktops for five years; but adopting that approach that requires much more effort than just switching the cycle as you're suggesting. Also, another advantage of longer cycles is that Testing has more time to mature, which is why a Stable release is - in my experience - much more stable than an Ubuntu release. So, yeah, I'm fine with having to compile XScreensaver myself. But I choose Debian because it's not like Ubuntu or Fedora.
dfc 11y ago
> No other operating system but Linux (and possibly some > BSDs) does this to the extent that the distro model does. I am not sure this is the case. What other operating systems except Linux and the BSDs offer users a choice for which XYZ should be used? Is the window manager functionality in Windows Vista not provided by a specific version of that software component? I think the version of OpenSSH in OSX is tied to the version of OSX? You don't recognize this in non-Linux+BSDs because you don't have a choice, you use whatever version of XYZ comes with your OS. > Even the unstable branch is routinely multiple versions > behind on software. Respectfully, I think this is a bit of an exaggeration. Maybe this is true for esoteric packages but I am curious to hear why you think this. Unstable has the latest Xscreensaver at the moment. There was a one day lag between the release of 5.34 and a packaged version for unstable.
- jarcane 11y ago
  At the moment, the Racket package in the current stable release of Debian is using 6.1. That is an 8 month old package. Even unstable is only on on 6.3, which itself is almost 6 months old. The last time I used Debian was at most a year ago, and at that time the stable package for Racket was still 5.3, which came out in 2013. And this same pattern repeated itself so often where programming tools were concerned that I eventually just gave up on using apt-get for developing and would wind up manually installing most languages, and then sometimes having to fight with conflicts because some package or other had already installed an out-of-date version, so now I either had to overwrite the package-installed version and risk breaking something, or just run it locally from some directory in /home. Contrast to Windows or OS X, where all I have to do to run Racket is go to the website, download the latest version, and possibly run an automated installer. On OS X, I just have to drag one icon onto another icon, and if the app's been set up right this even handles my command-line paths for me. Seriously, this is 2016. We have the internet now. We do not need to load every piece of software one would ever need onto a CD anymore like it's 1994 and the only reliable source of Linux software is Walnut Creek CD-ROMs. It is a perfectly reasonable expected use case that someone desiring a piece of software should be able to just go and download the most recent version, install it, and should need arise, uninstall it just as cleanly. Nowhere else is that process as broken as it is on Linux, especially under Debian's hopelessly slow update process.

by jarcane 11y ago

sanbor 11y ago

Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce new bugs. Debian guarantees that when you install their distro things are going to work and are kind of secure. The tradeoff of having all the software in the distro being checked by people that have tested and checked that everything works well and smooth it's going delay updating the packages. But the idea of having a distro it's something that offers you that. That someone took the work of packaging and testing, so you can install things and everything works. I think that if more software would be offered statically compiled with all the libraries (like many apps in OSX), then we would be able to try the latest release of Gimp when it's released, instead of having to waste time trying to compile from source or waiting for being included in the next release of the distro.

haddr 11y ago
Spot on. I was always puzzled why some software just can't come statically compiled. I suppose not all apps can be distributed like that, but most of them can. I can't even remember how many hours I wasted on trying to compile a new version of some program, just to learn the infinite tree of dependencies, newer versions of existing libraries required, build prefixes tweaking etc... Most of that time could have been saved.
- jhkaghjkga 11y ago
  Because any (possibly security-relevant) update to a library would mean that all software linking it statically has to be rebuilt. In reality that of course doesn't happen, so programs linking statically or including their own versions of shared libraries never get security updates for the included libraries.
  - digi_owl 11y ago
    If you want the perfect example of that problem, look to Windows. A couple of years back Microsoft discovered some kind of issue with their redistributable dlls. They patched Office etc, but could only offer a scanner that would check each and every dll to see if it was of a vulnerable version. And asked users to pester third party software providers for updates if the scanner found any.
  - sanbor 11y ago
    I wouldn't move from a package system to an "everything has to be statically compiled" system. But it would be a nice option to have when most of the software in your distro it's ok but you want to run some app without upgrading your whole distro/OS.
  - haddr 11y ago
    In the same way as you upgrade library you can just upgrade your software...
- binarycrusader 11y ago
  Because statically linking everything has several negative consequences: * increased storage space * increased memory usage * increased downtime for updates (since more files have to be updated) * increased bandwidth usage (total size of download for update) * potentially increased security risks In short, trading off all of the above to simply avoid proper release engineering and simplified dependency management is the wrong answer. Our systems need less downtime and better security; not the opposite, which is what static linking brings. That's why Solaris, as an example, does not provide static archives for almost any of the components that are provided, especially libc.
Ologn 11y ago
> Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce new bugs. New versions of software also fix old stability and security bugs. If software became more secure with age, then the older your version of gnome screensaver, the more secure it would be ( https://www.jwz.org/blog/2015/04/i-told-you-so-again/ https://www.jwz.org/blog/2015/04/i-told-you-so-again/ ).
- sanbor 11y ago
  > New versions of software also fix old stability and security bugs. Sometimes new versions of software fix bugs, sometimes they improve stability, sometimes they introduce new bugs, sometimes they decrease the performance, sometimes they become bloatware, sometimes several of this things happen in any combination.
cmsj 11y ago
Debian doesn't guarantee you anything. "stable" isn't bug free, what you're getting is a lack of newness. "stale" would be a better choice of word. It's not necessarily better, it's just not changing.

qplex 11y ago

It's called 'unstable' for a reason. New stuff breaks. Often.

feld 11y ago
This is the worst attitude to have about software
- icebraining 11y ago
  What, having beta versions?
  - feld 11y ago
    That any new release is not to be trusted.
    - deleted 11y ago
      [deleted]

Ologn 11y ago

> It is not the software writers' fault that your distro can't be arsed to keep its package system up-to-date. That's it. Ubuntu releases every six months, it's not upstream's problem that an up-to-date version of your stable distro is using the program released in September 2014 (17 months ago). As XScreenSaver 5.32 was released in November 2014 and Debian stable was released in April 2015, you have to wonder why in those five months why it was not 5.32 which was released, or even 5.31, but 5.30 which was released seven months before. Does anyone remember July 2002 to June 2005, almost three years between Debian releases? I do. You can point figures for why that happened, but it makes little sense to point them at the upstreams who make your distribution possible. At the end of the day, the message jwz put in the code is crystal clear - if you are unhappy with the message and don't plan to keep your distro somewhat up to date, he'd prefer you just rip out xscreensaver from the distro and use an alternative. It doesn't make sense to compare him to a terrorist setting bombs as someone did in the thread. It goes back to the initial reply. For all the gnashing of teeth and finger-pointing and name-calling and effort to deal with this and other issues due to old packages - if Debian channeled all of that energy and effort into a shorter, saner release cycle, it would be much more beneficial to everyone. If stable Debian was as current as the last release of Ubuntu or Fedora or OpenSuse etc., this discussion would have never taken place. P.S. One good reason to download XScreenSaver 5.34 is the additional Android functionality. XScreenSaver 5.35 will possibly have much-expanded Android functionality when it is released (or if not, then 5.36 or one soon after). If you have Android Studio and an Android device (or emulator), compile it and give it a whirl. Once it gets into shape more for users, an APK will probably be put up, and possibly even a Google Play app. So if you're an Android developer, give it a whirl. Send an e-mail to the folks in the android/README with any bugs, questions, comments, patches etc. Probably best to e-mail first before doing the work on major patches. Give it a spin.

icebraining 11y ago
if Debian channeled all of that energy and effort into a shorter, saner release cycle, it would be much more beneficial to everyone. The whole point of Stable is that it doesn't change often. As a Debian user, I don't want to upgrade my servers every six months. I'm fine with stale packages (with backported security patches). There's a reason why Ubuntu, despite its standard release cycle, also maintains LTS releases for both servers and desktops for five years; but adopting that approach that requires much more effort than just switching the cycle as you're suggesting. Also, another advantage of longer cycles is that Testing has more time to mature, which is why a Stable release is - in my experience - much more stable than an Ubuntu release. So, yeah, I'm fine with having to compile XScreensaver myself. But I choose Debian because it's not like Ubuntu or Fedora.

dfc 11y ago

> No other operating system but Linux (and possibly some > BSDs) does this to the extent that the distro model does. I am not sure this is the case. What other operating systems except Linux and the BSDs offer users a choice for which XYZ should be used? Is the window manager functionality in Windows Vista not provided by a specific version of that software component? I think the version of OpenSSH in OSX is tied to the version of OSX? You don't recognize this in non-Linux+BSDs because you don't have a choice, you use whatever version of XYZ comes with your OS. > Even the unstable branch is routinely multiple versions > behind on software. Respectfully, I think this is a bit of an exaggeration. Maybe this is true for esoteric packages but I am curious to hear why you think this. Unstable has the latest Xscreensaver at the moment. There was a one day lag between the release of 5.34 and a packaged version for unstable.

jarcane 11y ago
At the moment, the Racket package in the current stable release of Debian is using 6.1. That is an 8 month old package. Even unstable is only on on 6.3, which itself is almost 6 months old. The last time I used Debian was at most a year ago, and at that time the stable package for Racket was still 5.3, which came out in 2013. And this same pattern repeated itself so often where programming tools were concerned that I eventually just gave up on using apt-get for developing and would wind up manually installing most languages, and then sometimes having to fight with conflicts because some package or other had already installed an out-of-date version, so now I either had to overwrite the package-installed version and risk breaking something, or just run it locally from some directory in /home. Contrast to Windows or OS X, where all I have to do to run Racket is go to the website, download the latest version, and possibly run an automated installer. On OS X, I just have to drag one icon onto another icon, and if the app's been set up right this even handles my command-line paths for me. Seriously, this is 2016. We have the internet now. We do not need to load every piece of software one would ever need onto a CD anymore like it's 1994 and the only reliable source of Linux software is Walnut Creek CD-ROMs. It is a perfectly reasonable expected use case that someone desiring a piece of software should be able to just go and download the most recent version, install it, and should need arise, uninstall it just as cleanly. Nowhere else is that process as broken as it is on Linux, especially under Debian's hopelessly slow update process.