3 ms·

> I love the part about simplifying packaging via 'snap'. Bleargh. More container bullshit, now with even less control over it by end users. Now each tiny lib

by creshal 11y ago

> I love the part about simplifying packaging via 'snap'. Bleargh. More container bullshit, now with even less control over it by end users. Now each tiny library update (think OpenSSL security fixes) will pull hundreds of "snaps" instead of a single package… assuming the developers even realize they have to rebuild their snaps.

criddell 11y ago
> Now each tiny library update (think OpenSSL security fixes) will pull hundreds of "snaps" Do you think that's worse than the alternative where each tiny (shared) library update potentially breaks hundreds of programs?
- creshal 11y ago
  ABI breaks from security patches for stable releases, especially of Linux distributions, happen how often? In comparison, outdated npm/gem/pip/hipster-package-manager-of-the-week or docker installations happen how often? With the former, the burden of updating and testing lies with a small handful of distribution maintainers. With the latter, every single developer has to worry about deployment and maintenance.
  - cat-dev-null 11y ago
    Distros shouldn't waste time and effort on supporting and packaging language-specific, high-churn code packages except in very limited circumstances. Let the language specific-tools do those. Upstream is best, local fragmentation is wasteful.
- jandrese 11y ago
  While that potential was always there (and people were paranoid about it), in real life it was extremely rare. ABIs don't tend to change much between minor versions on sane libraries. I can't remember it ever happening to me.
- cat-dev-null 11y ago
  False dichotomy fallacy. Linux distributions need to engineer for side-by-side installation of multiple versions and not get tied up to those common locations. nix is just one example as an interesting idea, while Homebrew and stow are better ideas.
majewsky 11y ago
A hundred times this. When some library upgrade happened to break stuff on my system, I could roll it back selectively, while still getting the updates for everything else (as long as it does not strictly depend on this new library version). That's gone now. Good thing I abandoned Ubuntu a long time ago.
- bryanlarsen 11y ago
  What did you switch to? Fedora is switching to xdg-app, which basically does the same thing. Now that those two are using such an approach, I imagine that app developers are increasingly going to drop support for distros that don't use snap, xdg-app or docker. Snap/xdg-app/docker are a lot more convenient for those app developers. Edit: forgot appc. Thank goodness they're all planning on supporting the Open Container Initiative.
  - majewsky 11y ago
    I'm on Arch, which has none of that bullshit.
    - digi_owl 11y ago
      Given their history, expect Arch to adopt xdg-app.
curt15 11y ago
Something as core as OpenSSL should be provided by the system and updated by the system maintainers. That's what happens in Windows and OS X land, where the system provides a broad base of functionality that every application can count on (e.g. https://msdn.microsoft.com/en-us/library/windows/desktop/ff818516(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ff8...). Thus third party programs only need to bundle the elements not already provided by the system. When goto fail was discovered in the OS X crypto libraries, Apple simply issued a system update and that was the end of the story.
- JdeBP 11y ago
  In other words: you agree with Florian Haas. * https://plus.google.com/+FlorianHaas/posts/4xjQP1q6DEN https://plus.google.com/+FlorianHaas/posts/4xjQP1q6DEN * https://www.hastexo.com/blogs/florian/2016/02/21/containers-just-because-everyone-else/ https://www.hastexo.com/blogs/florian/2016/02/21/containers-...
Certhas 11y ago
While I see your point, the idea that I as an end user have any real control now is absurd. All I can do is hope the people who package stuff for their distribution know what they are doing. If I want to install software that's outside the stuff that the packagers have prepared, like Firefox with correct KDE integration on Kubuntu, I am relying on a number of hard to track things working correctly together. Which tehy have regularly failed to do for me in the past. Contrast to the OSX install experience: An application is a folder which contains everything related to the application that the base system does not provide. It's brilliant. Installing is copying. Uninstalling is deleting. As a user I feel more in control of the process than with apt. Depending on the software stack you're looking at, dependency isolation might or might not make sense. I think OSX and Windows both are good case stuides that show that some level of isolation is sensible.
- JdeBP 11y ago
  See https://news.ycombinator.com/item?id=10505897 https://news.ycombinator.com/item?id=10505897
- creshal 11y ago
  > If I want to install software that's outside the stuff that the packagers have prepared, like Firefox with correct KDE integration on Kubuntu, I am relying on a number of hard to track things working correctly together. Which tehy have regularly failed to do for me in the past. Firefox isn't that hard, all considered. KDE is necessarily hard because of how invasive that is – but no container fuckery will save you from that, because it has to be invasive to work in the first place! Either every container has to ship a full KDE, or you do it like OSX does it, and only have One Desktop To Rule Them All. (That's why Canonical and Gnome are both interested in app containers, presumably, to get rid of that filthy freedom of choice.) > Contrast to the OSX install experience: An application is a folder which contains everything related to the application that the base system does not provide. The difference is that OSX (and Windows) provides a lot, and you only have applications building on top of that huge, stable code base that's diligently updated by Apple (/Microsoft). OSX/Windows apps only have to keep their few third party dependencies updated. Linux app containers have to literally ship everything outside the kernel to work, because the kernel ABI is the only stable interface in the Linux ecosystem. Everything else, up to and including the libc, varies between distributions, and versions of the same distribution, and will be incompatible. An openssl update would trigger a repackaging of every single app container. And where it doesn't, users are at risk. In contrast, without containers, I upgrade one package and the whole system is secured. (On servers, it's a bit more nuanced, because here operations is in charge or repackaging docker/lxd/nspawn containers, and can start that process whenever they want.) > As a user I feel more in control of the process than with apt. That's more because apt is bullshit, even by Linux standards. pacman and other package managers not made in the 1990s are much nicer to deal with.

by creshal 11y ago

criddell 11y ago

> Now each tiny library update (think OpenSSL security fixes) will pull hundreds of "snaps" Do you think that's worse than the alternative where each tiny (shared) library update potentially breaks hundreds of programs?

creshal 11y ago
ABI breaks from security patches for stable releases, especially of Linux distributions, happen how often? In comparison, outdated npm/gem/pip/hipster-package-manager-of-the-week or docker installations happen how often? With the former, the burden of updating and testing lies with a small handful of distribution maintainers. With the latter, every single developer has to worry about deployment and maintenance.
- cat-dev-null 11y ago
  Distros shouldn't waste time and effort on supporting and packaging language-specific, high-churn code packages except in very limited circumstances. Let the language specific-tools do those. Upstream is best, local fragmentation is wasteful.
jandrese 11y ago
While that potential was always there (and people were paranoid about it), in real life it was extremely rare. ABIs don't tend to change much between minor versions on sane libraries. I can't remember it ever happening to me.
cat-dev-null 11y ago
False dichotomy fallacy. Linux distributions need to engineer for side-by-side installation of multiple versions and not get tied up to those common locations. nix is just one example as an interesting idea, while Homebrew and stow are better ideas.

majewsky 11y ago

A hundred times this. When some library upgrade happened to break stuff on my system, I could roll it back selectively, while still getting the updates for everything else (as long as it does not strictly depend on this new library version). That's gone now. Good thing I abandoned Ubuntu a long time ago.

bryanlarsen 11y ago
What did you switch to? Fedora is switching to xdg-app, which basically does the same thing. Now that those two are using such an approach, I imagine that app developers are increasingly going to drop support for distros that don't use snap, xdg-app or docker. Snap/xdg-app/docker are a lot more convenient for those app developers. Edit: forgot appc. Thank goodness they're all planning on supporting the Open Container Initiative.
- majewsky 11y ago
  I'm on Arch, which has none of that bullshit.
  - digi_owl 11y ago
    Given their history, expect Arch to adopt xdg-app.

curt15 11y ago

Something as core as OpenSSL should be provided by the system and updated by the system maintainers. That's what happens in Windows and OS X land, where the system provides a broad base of functionality that every application can count on (e.g. https://msdn.microsoft.com/en-us/library/windows/desktop/ff818516(v=vs.85).aspx https://msdn.microsoft.com/en-us/library/windows/desktop/ff8...). Thus third party programs only need to bundle the elements not already provided by the system. When goto fail was discovered in the OS X crypto libraries, Apple simply issued a system update and that was the end of the story.

JdeBP 11y ago
In other words: you agree with Florian Haas. * https://plus.google.com/+FlorianHaas/posts/4xjQP1q6DEN https://plus.google.com/+FlorianHaas/posts/4xjQP1q6DEN * https://www.hastexo.com/blogs/florian/2016/02/21/containers-just-because-everyone-else/ https://www.hastexo.com/blogs/florian/2016/02/21/containers-...

Certhas 11y ago

While I see your point, the idea that I as an end user have any real control now is absurd. All I can do is hope the people who package stuff for their distribution know what they are doing. If I want to install software that's outside the stuff that the packagers have prepared, like Firefox with correct KDE integration on Kubuntu, I am relying on a number of hard to track things working correctly together. Which tehy have regularly failed to do for me in the past. Contrast to the OSX install experience: An application is a folder which contains everything related to the application that the base system does not provide. It's brilliant. Installing is copying. Uninstalling is deleting. As a user I feel more in control of the process than with apt. Depending on the software stack you're looking at, dependency isolation might or might not make sense. I think OSX and Windows both are good case stuides that show that some level of isolation is sensible.

JdeBP 11y ago
See https://news.ycombinator.com/item?id=10505897 https://news.ycombinator.com/item?id=10505897
creshal 11y ago
> If I want to install software that's outside the stuff that the packagers have prepared, like Firefox with correct KDE integration on Kubuntu, I am relying on a number of hard to track things working correctly together. Which tehy have regularly failed to do for me in the past. Firefox isn't that hard, all considered. KDE is necessarily hard because of how invasive that is – but no container fuckery will save you from that, because it has to be invasive to work in the first place! Either every container has to ship a full KDE, or you do it like OSX does it, and only have One Desktop To Rule Them All. (That's why Canonical and Gnome are both interested in app containers, presumably, to get rid of that filthy freedom of choice.) > Contrast to the OSX install experience: An application is a folder which contains everything related to the application that the base system does not provide. The difference is that OSX (and Windows) provides a lot, and you only have applications building on top of that huge, stable code base that's diligently updated by Apple (/Microsoft). OSX/Windows apps only have to keep their few third party dependencies updated. Linux app containers have to literally ship everything outside the kernel to work, because the kernel ABI is the only stable interface in the Linux ecosystem. Everything else, up to and including the libc, varies between distributions, and versions of the same distribution, and will be incompatible. An openssl update would trigger a repackaging of every single app container. And where it doesn't, users are at risk. In contrast, without containers, I upgrade one package and the whole system is secured. (On servers, it's a bit more nuanced, because here operations is in charge or repackaging docker/lxd/nspawn containers, and can start that process whenever they want.) > As a user I feel more in control of the process than with apt. That's more because apt is bullshit, even by Linux standards. pacman and other package managers not made in the 1990s are much nicer to deal with.