3 ms·

I don't think that possibly slow package manager is main Debian problem. There are more serious issues: - bug tracker is email-based, not web-based, very old,

I don't think that possibly slow package manager is main Debian problem. There are more serious issues: - bug tracker is email-based, not web-based, very old, and without keyword search. - old versions of software - unnesessary duplication: repositories contain Python packages that can be installed with Python package managers. - Debian is not friendly to third-party software, to closed-source software. For example, to install Slack or VS code you have to add third-party repository and give permanent root access to your system to Slack Inc or Microsoft. You have a choice between backdooring your system or not using third-party apps. Compare this to Android that is also linux-based but provides a reliable and comfortable jail for every application except Google's. - Debian doesn't protect your information from malicious software. For example, if you install third-party app, it will be able to read your browser's history and cookies in your home directory. Also, any unprivileged program can read hardware identifiers like MAC address, hardware list, disk serial number, BIOS data etc. This is perfect for tracking users even if they reinstall or change their operating system. Again, compare this to Android. - package manager doesn't allow to install several versions of PHP or Node.JS if you are working on several projects. But for language like Python they allow to install two different versions, why Python gets such a privileged treatment and PHP or Node doesn't I don't understand. There are projects aiming to solve some of these problems like Snapcraft, but as far as I am aware, they are not integrated into Debian yet. Also, it is a bad idea to hardcode paths (like /use/share) within application, so that you have to recompile it to change the path. All applications should be portable by default to make installation into home directory easier.

johnmarcus 7y ago
how does slack have permanent root access to my system again?
- CameronNemo 7y ago
  The repo can theoretically hijack a package like util-linux, unless you creatively set up apt pinning.
  - MayeulC 7y ago
    That, plus I guess the package could easily contain suid binaries.
- codedokode 7y ago
  If you download and unpack Slack's .deb package [1] , you'll find a script "/etc/cron.daily/slack" (contained within "data.tar.xz") that is a bash script run by cron daily under root account. This cron script adds a line "deb https://packagecloud.io/slacktechnologies/slack/debian/ https://packagecloud.io/slacktechnologies/slack/debian/ jessie main" into apt sources list. Also it adds Slack Inc. public key into list of trusted keys. This allows Slack Inc. to replace any package on your system including bash, firefox, libreoffice or sshd by publishing a package with the same name but higher version number. Note that they can provide malicious updates only to specific users, identifying them by country or IP address, so that other users won't see anything suspicious. For example, law enforcement agencies can ask them to backdoor a suspect's computer to gather evidence or important data for intelligence. This is the problem with apt and with Linux package managers in general: they assume you only add package sources you completely trust and do not support installing third-party packags without this trust (unlike Windows that supports portable applications or Android that doesn't give root privileges to installed packages). Linux package managers are not suited for installing untrusted third-party applications. [1] https://downloads.slack-edge.com/linux_releases/slack-desktop-4.0.1-amd64.deb https://downloads.slack-edge.com/linux_releases/slack-deskto...
antpls 7y ago
I agree. Furthermore, it feels like creating and maintaining a Debian package becomes redundant with various git/docker/pip/maven repositories and tools. Half of the package management problems are social issues such as security, audit, openness to newcomers, collaboration, and trust. We could probably solves those problems for all package managers (pip, various image registries, npm, etc) at once. We would maybe need a new package manager protocol that everyone agrees on rather than new filesystem tricks. Something like a federated package manager (sounds a bit buzzword).

johnmarcus 7y ago

how does slack have permanent root access to my system again?

CameronNemo 7y ago
The repo can theoretically hijack a package like util-linux, unless you creatively set up apt pinning.
- MayeulC 7y ago
  That, plus I guess the package could easily contain suid binaries.
codedokode 7y ago
If you download and unpack Slack's .deb package [1] , you'll find a script "/etc/cron.daily/slack" (contained within "data.tar.xz") that is a bash script run by cron daily under root account. This cron script adds a line "deb https://packagecloud.io/slacktechnologies/slack/debian/ https://packagecloud.io/slacktechnologies/slack/debian/ jessie main" into apt sources list. Also it adds Slack Inc. public key into list of trusted keys. This allows Slack Inc. to replace any package on your system including bash, firefox, libreoffice or sshd by publishing a package with the same name but higher version number. Note that they can provide malicious updates only to specific users, identifying them by country or IP address, so that other users won't see anything suspicious. For example, law enforcement agencies can ask them to backdoor a suspect's computer to gather evidence or important data for intelligence. This is the problem with apt and with Linux package managers in general: they assume you only add package sources you completely trust and do not support installing third-party packags without this trust (unlike Windows that supports portable applications or Android that doesn't give root privileges to installed packages). Linux package managers are not suited for installing untrusted third-party applications. [1] https://downloads.slack-edge.com/linux_releases/slack-desktop-4.0.1-amd64.deb https://downloads.slack-edge.com/linux_releases/slack-deskto...

antpls 7y ago

I agree. Furthermore, it feels like creating and maintaining a Debian package becomes redundant with various git/docker/pip/maven repositories and tools. Half of the package management problems are social issues such as security, audit, openness to newcomers, collaboration, and trust. We could probably solves those problems for all package managers (pip, various image registries, npm, etc) at once. We would maybe need a new package manager protocol that everyone agrees on rather than new filesystem tricks. Something like a federated package manager (sounds a bit buzzword).