7 ms·

Packaging was a solved issue in Linux, congrats on the 3 steps back. The rush towards containers because they're "easy" strikes yet again. My fear is that the

Packaging was a solved issue in Linux, congrats on the 3 steps back. The rush towards containers because they're "easy" strikes yet again. My fear is that the handful of companies that build packages for their desktop apps with abandon them and move to Flatpak/Snap. From the Flatpak docs it looks like anyone and everyone can just get access, even if you don't own the thing you're packaging. So if you pack $newpopularsoftware first you can now install malware on everyone's computers with a single push. It's like they looked at everything bad about Chocolatey/NPM/pip/AUR and just ran with it.

alkonaut 8y ago
> if you pack $newpopularsoftware first you can now install malware on everyone's computers with a single push. How does this compare to the traditional package managers?
- cpburns2009 8y ago
  Well, looking at the procedure for Snap [1] there's no review at all. Flatpak [2] defers to Flathub [3] which has some sort of review: a pull request on Github but I'm not sure how thorough that is. Traditional package repositories have a review phase before you can get your package into the system (that's how it is with Debian at least). [1]: https://docs.snapcraft.io/build-snaps/upload https://docs.snapcraft.io/build-snaps/upload [2]: http://docs.flatpak.org/en/latest/publishing.html http://docs.flatpak.org/en/latest/publishing.html [3]: https://github.com/flathub/flathub/wiki/App-Submission https://github.com/flathub/flathub/wiki/App-Submission
  - alkonaut 8y ago
    How does that review work in the case of binary/proprietary packages?
    - cpburns2009 8y ago
      I'm assuming you're talking about traditional package managers. Proprietary packages aren't uploaded to the main package repositories from what I've seen. The company will typically provide the packages themselves (e.g., a deb or rpm file), and sometimes they'll provide their own repositories for easier delivery. This has been my experience with Dropbox, SpiderOak, and Sublime Text.
      - alkonaut 8y ago
        Got ya. They create their own repositories, and don't use the central one.
    - TingPing 8y ago
      Flathub reviewer here. We do not security audit code of any project as thats just unreasonable. The user puts ultimate trust in the upstream projects we just ensure that the right upstream is used, libraries are up to date and sanely built, permissions are as reasonable as they can be, etc. This is identical to every traditional distro like Debian or Fedora.
    - deadbunny 8y ago
      The review is to get your access to publish, not the code submitted. So pass that, package honestly for 6 months, deploy malware.
- deadbunny 8y ago
  If I need software not found in my upstream repos you have 3 options: 1. Packaged by the developer/publisher, see Virtualbox, Spotify, Chrome, Slack etc... 2. Packaged by a single 3rd party, see PPAs 3. A central 3rd party repo populated by anyone, NPM, AUR, pip, Snap/Flatpak etc.. Case 1: I have to trust the developer/publisher which is sensible, you're already trusting their code to run. Case 2: I have to trust some random 3rd party, sometimes this is possible, sometimes not but if I do trust them I'm trusting them for one package (and maybe it's dependencies). I may have multiple options of who to trust to provide this package. Case 3: Anyone can package anything if they get there first they can publish things however they like. The problem is that they are implicitly trusted by the repo, not me. The first 2 are acts of active trust, I have to verify the person/company I'm downloading and make a decision whether I trust them or not. With a 3rd party central repo (it doesn't matter what format) I do not have that option, I either trust everything that anyone can publish to be correct or I don't use it.
  - j605 8y ago
    AUR, snap and flatpak all work differently. AUR is free for all with no trust implied or given but packages will be removed upon user intervention. So curation is basically done by users and other administrations but it doesn't prevent bad packages from being uploaded in the first place. Most of the AUR is building from source so you just have to read the build scripts (PKGBUILDs) of each package before installing and do what a maintainer does. It gets easier on updates since you only have to check diffs between versions. I believe you are making a wrong decision if you trust anything on the AUR implicitly.
    - deadbunny 8y ago
      > I believe you are making a wrong decision if you trust anything on the AUR implicitly. That's basically my entire point.
scrollaway 8y ago
> Packaging was a solved issue in Linux, congrats on the 3 steps back. Dude, seriously. Flatpak has issues, but saying "Packaging was a solved issue" when every distro rolls out its own packaging system is the reason we can't have nice things. Ignoring the problems won't make them go away.
- dragonwriter 8y ago
  > every distro rolls out its own packaging system But, they don't. Lots use Debian’s, for instance.
- dec0dedab0de 8y ago
  Dude, seriously. Flatpak has issues, but saying "Packaging was a solved issue" when every distro rolls out its own packaging system is the reason we can't have nice things. If every distribution was using the same packaging system, would they still be separate distributions? EDIT: By packaging system I assumed we meant the same repositories, and packages. Since that is how Flatpak seems to work.
  - detaro 8y ago
    Are Debian and Kubuntu separate distributions? Would RedHat switching to apt make Debian redundant?
    - jcelerier 8y ago
      > Are Debian and Kubuntu separate distributions? yes because Debian (stable) and Kubuntu have different KDE packages > Would RedHat switching to apt make Debian redundant? - no because they apply different patches - yes because I think that both Debian and Red Hat and any distro which applies patches is already redundant with Arch
      - deadbunny 8y ago
        You seem to be confusing packages and package managers.
nickik 8y ago
> Packaging was a solved issue in Linux That's an insane thing to say. Literally 100s of people doing the same thing adding no value to the end user. That is a waste amount of resources waste by the open source community. > My fear is that the handful of companies that build packages for their desktop apps with abandon them and move to Flatpak/Snap. Good? Why does it matter to you. > From the Flatpak docs it looks like anyone and everyone can just get access, even if you don't own the thing you're packaging. So if you pack $newpopularsoftware first you can now install malware on everyone's computers with a single push. Nothing stops you or any distribution from having a repo with reviewed or specially selected software. Also, the waste majority of packagers would not have found that malware anyway.
- deadbunny 8y ago
  > That's an insane thing to say. Literally 100s of people doing the same thing adding no value to the end user. That is a waste amount of resources waste by the open source community. Or you know developers could package their own software. It's some upfront effort but usually set and forget. Things like FPM[1] make this even easier. Personally I don't know why developers find packaging so hard, I've had to package hundreds of bit of software for different distros (and versions of said distro) over my career and it's usually set and forget with some changes when there are big underlying changes to the OS like sysv > systemd. Granted my experience is with non GUI apps so I can imagine there is likely some pain points between different distros/version when it comes to the hot mess that is DEs. > Good? Why does it matter to you. Because I have to go from trusting 1 vendor to install 1 package (and dependencies) to 1 3rd party repo that anyone can push to. That is a huge change in the trust model. > Nothing stops you or any distribution from having a repo with reviewed or specially selected software. We already have those. > Also, the waste majority of packagers would not have found that malware anyway. This isn't about trusting the software in the package it's about trusting the package maintainer, who could now be absolutely anyone with no verification or validation. See malware in other user run repos like NPM, pip, AUR etc... 1. https://github.com/jordansissel/fpm https://github.com/jordansissel/fpm
  - nickik 8y ago
digi_owl 8y ago
> It's like they looked at everything bad about Chocolatey/NPM/pip/AUR and just ran with it. Basically they did just that. The only "desktop" devs left in Linux land are really cloud devs that dabble in desktop on the side. Damn it, i have been basically told to clam up when i complained about the cloud mentality having no home on the desktop. Because apparently only could mattered because it was the big Linux user case.
tracker1 8y ago
Umn, the software developers for X don't necessarily run the packagins systems for deb, apt, etc. There's nothing stopping RedHat from maintaining their own Flatpak "store", ditto for Ubuntu, etc. What this does is allow software to keep working when a library update happens without having to spend hours/days tracking down wierd scripts you don't even understand and running them as root to fix your problem. Not everyone wants to write OS-level software or fix every bug themselves. Hell, my GF watched me install something that wasn't in the UI app center (whatever it is called) via command line, and was like, "WTF do you have to do that? That's the most stupid thing I've ever seen." The fact is, she's not wrong.

alkonaut 8y ago

> if you pack $newpopularsoftware first you can now install malware on everyone's computers with a single push. How does this compare to the traditional package managers?

cpburns2009 8y ago
Well, looking at the procedure for Snap [1] there's no review at all. Flatpak [2] defers to Flathub [3] which has some sort of review: a pull request on Github but I'm not sure how thorough that is. Traditional package repositories have a review phase before you can get your package into the system (that's how it is with Debian at least). [1]: https://docs.snapcraft.io/build-snaps/upload https://docs.snapcraft.io/build-snaps/upload [2]: http://docs.flatpak.org/en/latest/publishing.html http://docs.flatpak.org/en/latest/publishing.html [3]: https://github.com/flathub/flathub/wiki/App-Submission https://github.com/flathub/flathub/wiki/App-Submission
- alkonaut 8y ago
  How does that review work in the case of binary/proprietary packages?
  - cpburns2009 8y ago
    I'm assuming you're talking about traditional package managers. Proprietary packages aren't uploaded to the main package repositories from what I've seen. The company will typically provide the packages themselves (e.g., a deb or rpm file), and sometimes they'll provide their own repositories for easier delivery. This has been my experience with Dropbox, SpiderOak, and Sublime Text.
    - alkonaut 8y ago
      Got ya. They create their own repositories, and don't use the central one.
  - TingPing 8y ago
    Flathub reviewer here. We do not security audit code of any project as thats just unreasonable. The user puts ultimate trust in the upstream projects we just ensure that the right upstream is used, libraries are up to date and sanely built, permissions are as reasonable as they can be, etc. This is identical to every traditional distro like Debian or Fedora.
  - deadbunny 8y ago
    The review is to get your access to publish, not the code submitted. So pass that, package honestly for 6 months, deploy malware.
deadbunny 8y ago
If I need software not found in my upstream repos you have 3 options: 1. Packaged by the developer/publisher, see Virtualbox, Spotify, Chrome, Slack etc... 2. Packaged by a single 3rd party, see PPAs 3. A central 3rd party repo populated by anyone, NPM, AUR, pip, Snap/Flatpak etc.. Case 1: I have to trust the developer/publisher which is sensible, you're already trusting their code to run. Case 2: I have to trust some random 3rd party, sometimes this is possible, sometimes not but if I do trust them I'm trusting them for one package (and maybe it's dependencies). I may have multiple options of who to trust to provide this package. Case 3: Anyone can package anything if they get there first they can publish things however they like. The problem is that they are implicitly trusted by the repo, not me. The first 2 are acts of active trust, I have to verify the person/company I'm downloading and make a decision whether I trust them or not. With a 3rd party central repo (it doesn't matter what format) I do not have that option, I either trust everything that anyone can publish to be correct or I don't use it.
- j605 8y ago
  AUR, snap and flatpak all work differently. AUR is free for all with no trust implied or given but packages will be removed upon user intervention. So curation is basically done by users and other administrations but it doesn't prevent bad packages from being uploaded in the first place. Most of the AUR is building from source so you just have to read the build scripts (PKGBUILDs) of each package before installing and do what a maintainer does. It gets easier on updates since you only have to check diffs between versions. I believe you are making a wrong decision if you trust anything on the AUR implicitly.
  - deadbunny 8y ago
    > I believe you are making a wrong decision if you trust anything on the AUR implicitly. That's basically my entire point.

scrollaway 8y ago

> Packaging was a solved issue in Linux, congrats on the 3 steps back. Dude, seriously. Flatpak has issues, but saying "Packaging was a solved issue" when every distro rolls out its own packaging system is the reason we can't have nice things. Ignoring the problems won't make them go away.

dragonwriter 8y ago
> every distro rolls out its own packaging system But, they don't. Lots use Debian’s, for instance.
dec0dedab0de 8y ago
Dude, seriously. Flatpak has issues, but saying "Packaging was a solved issue" when every distro rolls out its own packaging system is the reason we can't have nice things. If every distribution was using the same packaging system, would they still be separate distributions? EDIT: By packaging system I assumed we meant the same repositories, and packages. Since that is how Flatpak seems to work.
- detaro 8y ago
  Are Debian and Kubuntu separate distributions? Would RedHat switching to apt make Debian redundant?
  - jcelerier 8y ago
    > Are Debian and Kubuntu separate distributions? yes because Debian (stable) and Kubuntu have different KDE packages > Would RedHat switching to apt make Debian redundant? - no because they apply different patches - yes because I think that both Debian and Red Hat and any distro which applies patches is already redundant with Arch
    - deadbunny 8y ago
      You seem to be confusing packages and package managers.

nickik 8y ago

> Packaging was a solved issue in Linux That's an insane thing to say. Literally 100s of people doing the same thing adding no value to the end user. That is a waste amount of resources waste by the open source community. > My fear is that the handful of companies that build packages for their desktop apps with abandon them and move to Flatpak/Snap. Good? Why does it matter to you. > From the Flatpak docs it looks like anyone and everyone can just get access, even if you don't own the thing you're packaging. So if you pack $newpopularsoftware first you can now install malware on everyone's computers with a single push. Nothing stops you or any distribution from having a repo with reviewed or specially selected software. Also, the waste majority of packagers would not have found that malware anyway.

deadbunny 8y ago
> That's an insane thing to say. Literally 100s of people doing the same thing adding no value to the end user. That is a waste amount of resources waste by the open source community. Or you know developers could package their own software. It's some upfront effort but usually set and forget. Things like FPM[1] make this even easier. Personally I don't know why developers find packaging so hard, I've had to package hundreds of bit of software for different distros (and versions of said distro) over my career and it's usually set and forget with some changes when there are big underlying changes to the OS like sysv > systemd. Granted my experience is with non GUI apps so I can imagine there is likely some pain points between different distros/version when it comes to the hot mess that is DEs. > Good? Why does it matter to you. Because I have to go from trusting 1 vendor to install 1 package (and dependencies) to 1 3rd party repo that anyone can push to. That is a huge change in the trust model. > Nothing stops you or any distribution from having a repo with reviewed or specially selected software. We already have those. > Also, the waste majority of packagers would not have found that malware anyway. This isn't about trusting the software in the package it's about trusting the package maintainer, who could now be absolutely anyone with no verification or validation. See malware in other user run repos like NPM, pip, AUR etc... 1. https://github.com/jordansissel/fpm https://github.com/jordansissel/fpm
- nickik 8y ago

digi_owl 8y ago

> It's like they looked at everything bad about Chocolatey/NPM/pip/AUR and just ran with it. Basically they did just that. The only "desktop" devs left in Linux land are really cloud devs that dabble in desktop on the side. Damn it, i have been basically told to clam up when i complained about the cloud mentality having no home on the desktop. Because apparently only could mattered because it was the big Linux user case.

tracker1 8y ago

Umn, the software developers for X don't necessarily run the packagins systems for deb, apt, etc. There's nothing stopping RedHat from maintaining their own Flatpak "store", ditto for Ubuntu, etc. What this does is allow software to keep working when a library update happens without having to spend hours/days tracking down wierd scripts you don't even understand and running them as root to fix your problem. Not everyone wants to write OS-level software or fix every bug themselves. Hell, my GF watched me install something that wasn't in the UI app center (whatever it is called) via command line, and was like, "WTF do you have to do that? That's the most stupid thing I've ever seen." The fact is, she's not wrong.