4 ms·

Many things. Mostly PPAs. I can install Ubuntu Stable and use the most recent version of PHP, which has been built and is stored in Canonical's servers. With De

by deith 7y ago

Many things. Mostly PPAs. I can install Ubuntu Stable and use the most recent version of PHP, which has been built and is stored in Canonical's servers. With Debian, that's a gamble: either wait until the Debian developers stop bikeshedding and upload a new version of PHP to experimental, breaking all my system if I install it, or I have to add a repo from some guy I don't know or trust.

deleted 7y ago
[deleted]
throw0101a 7y ago
> ... or I have to add a repo from some guy I don't know or trust. The Debian PHP maintainer, Ondřej Surý, maintains his own repo: * https://deb.sury.org https://deb.sury.org * https://packages.sury.org/php/README.txt https://packages.sury.org/php/README.txt * https://qa.debian.org/developer.php?login=ondrej%40debian.org https://qa.debian.org/developer.php?login=ondrej%40debian.or...
- deith 7y ago
  Okay, you've shot down my example, but that was not the point.
  - throw0101a 7y ago
    What is your point? That Debian doesn't churn versions of software very quickly? Some of us view that as a good thing.
rubyn00bie 7y ago
I still don't understand why folks don't just build things like PHP from source. On either my desktop or production servers building a package missing from APT has never been a problem (on either Debian or Ubuntu, but I strongly prefer Debian). Then you don't have to trust anyone... /shrug And what's even worse, if you install Docker containers you don't build and manage yourself, you're pretty much right there again with "I don't know or trust" as your means of security.
- babarock 7y ago
  Not a downvoter, but if you think that compiling from source means you don't have to trust anyone, then I encourage you to read a paper called "Reflections on Trusting Trust" by Ken Thompson. It's a very famous computer science paper, pretty easy to read. Nothing niche or controversial. I'm sure you'll find it interesting.
  - gdxhyrd 7y ago
    The point is that you don't have to trust anyone outside the source given by the official project you are downloading. The fact that you can't achieve the ideal does not mean we should claim defeat.
- xorcist 7y ago
  Just to expand on the "build from source" bit, apt-get can not only download packages in source form but also build binary packages in literally one single command. This makes the cases where you want the full Debian build but with a patch or just stepping the version easy. That's useful when you need to patch a package or can't wait for an upstream security fix. Too often I see people building upstream packages "by hand" in those cases. The packaging tools are great and any Linux user is greatly helped by taking a few minutes and learning the basics of apt preference files, package selection and source packages.
shakna 7y ago
What's the difference between a PPA and a repo from some guy you don't know or trust?
- deith 7y ago
  With a PPA you can't upload binaries, you upload sources that can be audited, and Canonical builds them.
  - ori_b 7y ago
    I strongly suspect they don't audit the sources.
    - wolrah 7y ago
      They're not saying that Canonical audits the sources. They're saying that because the person running the PPA uploads the source and Canonical's servers build the packages from there, as long as you trust Canonical you don't have to worry about the binary matching the source. For the majority of us who aren't qualified to audit the source itself directly, being able to trace the binary we're running to source that someone could audit is the best we can hope for. Of course in the years since the PPA system was introduced we've seen a lot of projects push in to reproducible builds which somewhat negates that concern, but there are still a lot of us who would rather not go through that process for every random binary we want to run. Having a third party that we inherently trust because they built the rest of the operating system building the random packages we want has an appeal. Also for the devs/packagers free hosting by the OS vendor is nice too.
hiram112 7y ago
> The act of wasting time on trivial details while important matters are inadequately attended is sometimes known as bikeshedding. Never heard that term before, but it does, in fact, seem to describe a lot of Canonical's issues in the past decade.
- jlgaddis 7y ago
  See "Why should I care what color the bikeshed is?" [0] for the reference, if you're interested (and/or "Law of triviality" [1]). --- [0]: https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.html#bikeshed-painting https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.h... [1]: https://en.wikipedia.org/wiki/Law_of_triviality https://en.wikipedia.org/wiki/Law_of_triviality
  - jancsika 7y ago
    Do you have an example of bikeshedding from a FLOSS mailing list?
    - jlgaddis 7y ago
      PHK's e-mail from 20 years ago (included/linked above) is the canonical example. I, personally, don't have any examples ready to provide you but I no longer subscribe to any "general discussion" lists.

by deith 7y ago

deleted 7y ago

[deleted]

throw0101a 7y ago

> ... or I have to add a repo from some guy I don't know or trust. The Debian PHP maintainer, Ondřej Surý, maintains his own repo: * https://deb.sury.org https://deb.sury.org * https://packages.sury.org/php/README.txt https://packages.sury.org/php/README.txt * https://qa.debian.org/developer.php?login=ondrej%40debian.org https://qa.debian.org/developer.php?login=ondrej%40debian.or...

deith 7y ago
Okay, you've shot down my example, but that was not the point.
- throw0101a 7y ago
  What is your point? That Debian doesn't churn versions of software very quickly? Some of us view that as a good thing.

rubyn00bie 7y ago

I still don't understand why folks don't just build things like PHP from source. On either my desktop or production servers building a package missing from APT has never been a problem (on either Debian or Ubuntu, but I strongly prefer Debian). Then you don't have to trust anyone... /shrug And what's even worse, if you install Docker containers you don't build and manage yourself, you're pretty much right there again with "I don't know or trust" as your means of security.

babarock 7y ago
Not a downvoter, but if you think that compiling from source means you don't have to trust anyone, then I encourage you to read a paper called "Reflections on Trusting Trust" by Ken Thompson. It's a very famous computer science paper, pretty easy to read. Nothing niche or controversial. I'm sure you'll find it interesting.
- gdxhyrd 7y ago
  The point is that you don't have to trust anyone outside the source given by the official project you are downloading. The fact that you can't achieve the ideal does not mean we should claim defeat.
xorcist 7y ago
Just to expand on the "build from source" bit, apt-get can not only download packages in source form but also build binary packages in literally one single command. This makes the cases where you want the full Debian build but with a patch or just stepping the version easy. That's useful when you need to patch a package or can't wait for an upstream security fix. Too often I see people building upstream packages "by hand" in those cases. The packaging tools are great and any Linux user is greatly helped by taking a few minutes and learning the basics of apt preference files, package selection and source packages.

shakna 7y ago

What's the difference between a PPA and a repo from some guy you don't know or trust?

deith 7y ago
With a PPA you can't upload binaries, you upload sources that can be audited, and Canonical builds them.
- ori_b 7y ago
  I strongly suspect they don't audit the sources.
  - wolrah 7y ago
    They're not saying that Canonical audits the sources. They're saying that because the person running the PPA uploads the source and Canonical's servers build the packages from there, as long as you trust Canonical you don't have to worry about the binary matching the source. For the majority of us who aren't qualified to audit the source itself directly, being able to trace the binary we're running to source that someone could audit is the best we can hope for. Of course in the years since the PPA system was introduced we've seen a lot of projects push in to reproducible builds which somewhat negates that concern, but there are still a lot of us who would rather not go through that process for every random binary we want to run. Having a third party that we inherently trust because they built the rest of the operating system building the random packages we want has an appeal. Also for the devs/packagers free hosting by the OS vendor is nice too.

hiram112 7y ago

> The act of wasting time on trivial details while important matters are inadequately attended is sometimes known as bikeshedding. Never heard that term before, but it does, in fact, seem to describe a lot of Canonical's issues in the past decade.

jlgaddis 7y ago
See "Why should I care what color the bikeshed is?" [0] for the reference, if you're interested (and/or "Law of triviality" [1]). --- [0]: https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.html#bikeshed-painting https://www.freebsd.org/doc/en_US.ISO8859-1/books/faq/misc.h... [1]: https://en.wikipedia.org/wiki/Law_of_triviality https://en.wikipedia.org/wiki/Law_of_triviality
- jancsika 7y ago
  Do you have an example of bikeshedding from a FLOSS mailing list?
  - jlgaddis 7y ago
    PHK's e-mail from 20 years ago (included/linked above) is the canonical example. I, personally, don't have any examples ready to provide you but I no longer subscribe to any "general discussion" lists.