3 ms·

> I think that package management has no place in a desktop OS Why? Is this from a developer or an end-user perspective? From an end-user perspective, why does

> I think that package management has no place in a desktop OS Why? Is this from a developer or an end-user perspective? From an end-user perspective, why does it matter? For any sufficiently complicated application, most developers are going to rely on existing libraries and other components. So either you have a centralised way of managing this (i.e. a package manager) or you have every app with its own packaged (and thus potentially duplicated) dependencies and hope that every developer pushes out a new version whenever there's a security vulnerability in one of the dependent components. Whatever the drawbacks of package managers, that seems like the only sustainable model if you remotely care about security.

AnIdiotOnTheNet 8y ago
From an end user perspective I want control over what I have installed, and where it is installed. I want to be able to install multiple versions of an application, I want to be able to put that application on any volume, I want to be able to put that application on a thumb drive and run it on a different PC, I want to be able to install the latest version without having to wait for the repo to be updated, I want to be able to install applications that aren't in the repo, and I want to be able to do it without library conflicts and version mismatches. I have never in my life seen a package manager that can do those things. From a developer perspective I just make appdirs anyway, because to me part of what makes personal computing great is being able to make an application and distribute it myself without having to kowtow to 200 different package repositories. >Whatever the drawbacks of package managers, that seems like the only sustainable model if you remotely care about security. If your OS doesn't give you any application sandboxing features whatsoever because its stuck in the idea that permissions apply only to users, then maybe. Most of the shared libraries you'd care about security patches for should be part of the base system so appdirs don't have to include them. Of course, that means actually having a stable and well defined base system. On the whole, however, I think people who make this argument should probably be using OpenBSD if they claim to care about security so much. Like I said, it's a tradeoff, you don't have to agree.
- _emacsomancer_ 8y ago
  > I want to be able to install applications that aren't in the repo, and I want to be able to do it without library conflicts and version mismatches. I have never in my life seen a package manager that can do those things. Well, you're generally not limited to the repos. You can pull down a git repo and build from source (which is generally a one-liner command). Arch's AUR is pretty good for packages not in the official repos, including, in some cases, earlier versions. > From a developer perspective I just make appdirs anyway, because to me part of what makes personal computing great is being able to make an application and distribute it myself without having to kowtow to 200 different package repositories. Right. And will you keep checking on your appdir-bundled components to make sure they're updated when necessary? This is what seems to me the real drawback of this method. >>Whatever the drawbacks of package managers, that seems like the only sustainable model if you remotely care about security. >If your OS doesn't give you any application sandboxing features whatsoever because its stuck in the idea that permissions apply only to users, then maybe. Most of the shared libraries you'd care about security patches for should be part of the base system so appdirs don't have to include them. Of course, that means actually having a stable and well defined base system. Sandboxing is a separate issue. Probably the BSD-model is better in some ways than the Linux model for having a well-defined base system. > On the whole, however, I think people who make this argument should probably be using OpenBSD if they claim to care about security so much. Like I said, it's a tradeoff, you don't have to agree. Perhaps, but there a lots of intermediate positions in the tradeoff. I myself settle for Linux-level usability and Linux-level security (because Windows-level security is unacceptable).
  - AnIdiotOnTheNet 8y ago
    > Well, you're generally not limited to the repos. You can pull down a git repo and build from source (which is generally a one-liner command). Yeah, it says a lot that this is the standard fallback. No thanks. > Right. And will you keep checking on your appdir-bundled components to make sure they're updated when necessary? This is what seems to me the real drawback of this method. I disagree that it is a big deal. For one, applications can check for updates on their own, they don't need the package manager/repository model to do that. AppImage has an alternative method where the AppImage provides a URI that the system can check for updates. > because Windows-level security is unacceptable Have you not used Windows since 98? There really isn't a single security feature Linux has that Windows doesn't. The biggest threat you face is ransomware, where Linux has the advantage only because it's such a pain to install software that doesn't come from the repository.

AnIdiotOnTheNet 8y ago

From an end user perspective I want control over what I have installed, and where it is installed. I want to be able to install multiple versions of an application, I want to be able to put that application on any volume, I want to be able to put that application on a thumb drive and run it on a different PC, I want to be able to install the latest version without having to wait for the repo to be updated, I want to be able to install applications that aren't in the repo, and I want to be able to do it without library conflicts and version mismatches. I have never in my life seen a package manager that can do those things. From a developer perspective I just make appdirs anyway, because to me part of what makes personal computing great is being able to make an application and distribute it myself without having to kowtow to 200 different package repositories. >Whatever the drawbacks of package managers, that seems like the only sustainable model if you remotely care about security. If your OS doesn't give you any application sandboxing features whatsoever because its stuck in the idea that permissions apply only to users, then maybe. Most of the shared libraries you'd care about security patches for should be part of the base system so appdirs don't have to include them. Of course, that means actually having a stable and well defined base system. On the whole, however, I think people who make this argument should probably be using OpenBSD if they claim to care about security so much. Like I said, it's a tradeoff, you don't have to agree.

_emacsomancer_ 8y ago
> I want to be able to install applications that aren't in the repo, and I want to be able to do it without library conflicts and version mismatches. I have never in my life seen a package manager that can do those things. Well, you're generally not limited to the repos. You can pull down a git repo and build from source (which is generally a one-liner command). Arch's AUR is pretty good for packages not in the official repos, including, in some cases, earlier versions. > From a developer perspective I just make appdirs anyway, because to me part of what makes personal computing great is being able to make an application and distribute it myself without having to kowtow to 200 different package repositories. Right. And will you keep checking on your appdir-bundled components to make sure they're updated when necessary? This is what seems to me the real drawback of this method. >>Whatever the drawbacks of package managers, that seems like the only sustainable model if you remotely care about security. >If your OS doesn't give you any application sandboxing features whatsoever because its stuck in the idea that permissions apply only to users, then maybe. Most of the shared libraries you'd care about security patches for should be part of the base system so appdirs don't have to include them. Of course, that means actually having a stable and well defined base system. Sandboxing is a separate issue. Probably the BSD-model is better in some ways than the Linux model for having a well-defined base system. > On the whole, however, I think people who make this argument should probably be using OpenBSD if they claim to care about security so much. Like I said, it's a tradeoff, you don't have to agree. Perhaps, but there a lots of intermediate positions in the tradeoff. I myself settle for Linux-level usability and Linux-level security (because Windows-level security is unacceptable).
- AnIdiotOnTheNet 8y ago
  > Well, you're generally not limited to the repos. You can pull down a git repo and build from source (which is generally a one-liner command). Yeah, it says a lot that this is the standard fallback. No thanks. > Right. And will you keep checking on your appdir-bundled components to make sure they're updated when necessary? This is what seems to me the real drawback of this method. I disagree that it is a big deal. For one, applications can check for updates on their own, they don't need the package manager/repository model to do that. AppImage has an alternative method where the AppImage provides a URI that the system can check for updates. > because Windows-level security is unacceptable Have you not used Windows since 98? There really isn't a single security feature Linux has that Windows doesn't. The biggest threat you face is ransomware, where Linux has the advantage only because it's such a pain to install software that doesn't come from the repository.