8 ms·
Snaps and flatpaks are just a vector for malware. They're worse in every way than a traditional package manager. I'm all for packages which containerize their s
by Sir_Cmpwn 8y ago
Snaps and flatpaks are just a vector for malware. They're worse in every way than a traditional package manager. I'm all for packages which containerize their software (we already chroot a lot of software like this), but snaps/flatpaks are just dumb. There's no substitute for your package maintainer personally auditing and preparing the package for you.
- stemc43 8y agonoone is going to prep packages for dozens distros with different distribution mechanism. too complicated|time consuming - why Linux doesn't have first world apps.
- Sir_Cmpwn 8y agoNo one is expecting you to, nor do I trust you to. Distro maintainers do this, not software developers.
- ansgri 8y agoHow do I get my favorite app included as a user? As a publisher? The maintainer has his own schedule. What if I have a closed-source app? I presume it's just better than PPA and *.deb-s (which would be acceptable if all desktop Linux was based on Ubuntu).
- Sir_Cmpwn 8y agoYou ask. Find a maintainer who works on similar or related software and send them an email. Send them a patch. Your closed source app can shove it.
- stemc43 8y agoyeah. that's wishy-washy dreamworld. For 20 years Ive been using Linux - noone bothered packaging A-level apps for Linux, definitely not closed source ones. That's been enough of a trial run I would say.
- AnIdiotOnTheNet 8y agoThis attitude is the reason Linux Desktops suck and will continue to suck.
- ansgri 8y agoActually they don't. I use Linux Mint Cinnamon for 5 years and find it a very convenient operating system, better than Windows (at least 7 — I hear nothing good about Win7 except its Linux support) and OSX (at least Snow Leopard) in almost every respect, except commercial app support. I very reluctantly reboot into Windows for things like Office, Lightroom and CorelDraw. Maybe Visual Studio. edit: btw, I agree with you on the "attitude" thing. There should be more commercial options on Linux desktop.
- AnIdiotOnTheNet 8y agoIt was a subjective assessment to be sure, but one shared by many. You can tell because of how few users it has, though I'm sure someone will pop up and blame the fact that it doesn't come pre-installed on PCs as the reason, without consideration for the concept that if people actually wanted to use it, it might.
- sincerely 8y agoeh, i disagree. even if linux distros were objectively better than windows in every possible way (not speaking to the truth of that claim) if computers shipped with windows the vast majority of people would use windows.
- AnIdiotOnTheNet 8y agoThe vast majority of Windows PCs do not ship with Chrome.
- zapzupnz 8y agoBut the vast majority of internet users do use Google search and other Google products like Gmail. That's how Chrome became popular — because Google will spam you with ads for Chrome at every available opportunity.
- mort96 8y agoSo your argument is that anyone who wants to use any proprietary software should just switch to Windows? I suppose I should stop using Linux then, because I occasionally play games from Steam.
- Sir_Cmpwn 8y agoAnd your games are spying on you. Many of these games employ invasive anti-cheat systems which shake down your computer and send a bunch of data to their servers. This shit doesn't fly with distro packages.
- mort96 8y agoYeah, they definitely wouldn't be in distro packages, but I want to play them nonetheless. That means I either have to run software which isn't in my distro repo, or switch to Windows.
- JdeBP 8y agoJust don't ask about using WINE. (-: * https://unix.stackexchange.com/questions/460036/ https://unix.stackexchange.com/questions/460036/
- mynewtb 8y agoYou wish! Which distro are you talking about? Can't be Ubuntu for sure...
- Sir_Cmpwn 8y agoUbuntu is an outlier, not a representative of all of Linux. Linux is open source, you can make a distro that does anything you want, including spying on others. This doesn't make the distros that don't any worse.
- JdeBP 8y ago… and then wait 13 years with no response. (-: * https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=334120 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=334120 * https://unix.stackexchange.com/a/459566/5132 https://unix.stackexchange.com/a/459566/5132
- conradk 8y agoThere is AppImage (https://appimage.org/ https://appimage.org/). I have no affiliation with it whatsoever, but if you're not going to have a verified Snap account, I think you're better off offering an AppImage from your website. And it seems like some companies are thinking about something like this (https://github.com/itchio/itch/issues/683 https://github.com/itchio/itch/issues/683). If your Snap account is unverified, there seems to be no way to know who created the snap. It looks like I can create an account with the name of any company and distribute stuff in their name, including malware. With something like AppImage, your users know that the AppImage is actually coming from you if you host the file on your domain. Then again, AppImage has its own drawbacks. But at least, if Slack put an official AppImage on its homepage, I'd be able to download it. Installing a Slack snap from the account of "Felix Rieseberg" doesn't sound to good to me (https://snapcraft.io/slack https://snapcraft.io/slack). If you dig around, you can see that Felix Rieseberg does work at Slack, but for this big a company, that just looks fishy IMO.
- kyrofa 8y agoVerified accounts are pretty new, I suspect we'll see Slack verified soon.
- deleted 8y ago[deleted]
- rlpb 8y ago> Snaps and flatpaks are just a vector for malware. That depends entirely on your perspective. If you're happy using packages entirely from your distribution and from no other sources, then sure, carry on as you are. Snaps (not sure about flatpaks and confinement) are far better than the "curl ...|bash", PPA and other installer type vectors, even from your perspective.
- Sir_Cmpwn 8y ago>Snaps (not sure about flatpaks and confinement) are far better than the "curl ...|bash", PPA and other installer type vectors, even from your perspective A bad thing compared to other bad things does not make the bad thing good. If you're missing a package on your distro, bug a package maintainer to build it, or step up and volunteer.
- AnIdiotOnTheNet 8y agoYeah, because that's totally how software distribution should work. What's so wrong with the vendor just compiling and distributing an application? Why must this be needlessly complicated?
- Sir_Cmpwn 8y agoYes, that is totally how software distribution should work. Vendors cannot be trusted, this has been proven over and over and over again. Having a dispassionate third party do the packaging keeps malware out of your computer. This is why we have browser extensions and android apps that spy on you. This is why we have a snap which was mining cryptocurrency on your computer a few weeks ago. This is why Mozilla can add spyware to Firefox. Vendor publishing is fundamentally broken.
- AnIdiotOnTheNet 8y agoWell, you're free to believe that a platform that places you at the mercy of third party comrades who dictate what you can and cannot install or distribute "for your own good" is a good idea. I disagree. Wholeheartedly.
- AnIdiotOnTheNet 8y agoI passionately disagree. Package managers are inflexible conflict causing garbage and repos are appstore-like walled gardens which often contain out of date software, when they have what you're looking for at all. Snap and Flatpak aren't much better, though. Give me AppImage any day.
- digi_owl 8y agoThe reason for the conflicts are rarely if ever at the package layer, and more often than not with upstream changing dependencies on a .x update. This leaves the distro maintainers two choices: either recompile/restructure the whole distro to placate one upstream, or freeze said upsteam on an older version and suffer their social media wrath.
- kyrofa 8y agoOr because it's a new feature release instead of just bugfixes. At least in e.g. Ubuntu, SRUs aren't accepted unless they're security or bug fixes, which makes it impossible to get newer features back to stable releases. Snaps provide a way out of this by removing the ability to break other applications with an update (since there are no dependencies).
- binomialxenon 8y agoThe repository system on Debian, Arch, Fedora is clearly not a walled garden like Apple or Microsoft's app stores. Any site can host a repository that you can add to your package manager's sources, and you're free to install .deb/.rpm packages from any source you want, not to mention tarballs or compiling from source code. Also, there's no motive for lock-in like mainstream app stores have.
- AnIdiotOnTheNet 8y agoOnly if those sources keep things up to date with the changes in the main repository, and every other repository the user uses, so as to avoid conflicts. > not to mention tarballs or compiling from source code Seriously? You may as well say iOS is open because you can root it.
- bengotow 8y ago> There's no substitute for your package maintainer personally auditing and preparing the package for you. This is true, but it's not a feasible approach for software like Slack, Spotify, and VSCode that gets updated /weekly/. These aren't packages like 'libgit' that you could validate once and leave the same until you ship the next OS release. Some of these apps completely stop working if you fall behind by too many versions. Having people running older versions is also a huge pain in the ass as a developer, because those users inevitably email support, complain online about how the product is bad, etc. and only after lots of emailing does it turn out they're using a year-old version. (Full disclosure: I maintain Mailspring and switched to Snapcraft /very/ enthusiastically to have an auto-update mechanism that works across linux distros!)
- flukus 8y ago> This is true, but it's not a feasible approach for software like Slack, Spotify, and VSCode that gets updated /weekly/. These aren't packages like 'libgit' that you could validate once and leave the same until you ship the next OS release Package managers don't prevent this at all. If you host the repository then you can update as often as you'd like. Some whole distros (arch) do just this.
- evand 8y agoYou can update as often as you like, but that does not ensure users will get that update, nor does traditional packaging make it safe to install the update (no rollbacks, maintainer scripts run as root and have full access to the filesystem, library mismatches, etc). I'm all for debs and rpms, but they seem best suited to providing the base system. [disclaimer: I'm on the Snapcraft team]
- xmmrm 8y agoYou‘re really complaining about how the Snap Store works. Simple fix: Only maintainers can promote snaps to 'stable'.