22 ms·

Maybe I'm in the minority but I like Snaps. I wish all software would auto-update silently in the background -- when's the last time you even thought about upgr

Maybe I'm in the minority but I like Snaps. I wish all software would auto-update silently in the background -- when's the last time you even thought about upgrading Chrome? The author of this article claims it's too difficult to find Flatpak apps and that the Ubuntu software center prioritizes Snaps over .deb. Are platforms never allowed to migrate to a new standard? Why is it Canonical's fault that authors of individual applications have yet to migrate Snaps? If we all agree that on the whole auto-updating software is generally better and more secure than manually updated software, why not single out the applications that haven't migrated instead of blaming the whole standard? Maybe I'm just naive and not doing advanced super user stuff these Snap haters are doing but from a distance to me this resembles the systemd vs init controversy. One which, IMHO, Linux super users seemed unusually attached to an older standard for not always clear reasons. Snaps offer real benefits: maybe instead of complaining that 'this sucks' users could offer constructive criticism about how to improve the new standard. Just my opinion tho.

bluedino 6y ago
Chrome auto updates cause issues on the Mac. No thanks.
- ordinaryperson 6y ago
  OK, what issues does it cause? And are those issues outweighed by the security and standardization issues raised by non-updating software? I don't know who all remembers having to develop websites compatible with outdated versions of Internet Explorer but I do and still have nightmares about it.
  - bluedino 6y ago
    Crashes, freezes, stopping systems from sleeping... I don't want Google's (or anyone else's) code running in the background doing whatever it wants. Want to check for an update and notify me? Great. But don't do anything else.
    - capableweb 6y ago
      You might be on the wrong operating system if you don't like "code running in the background doing whatever it wants" as Apple has never shied away from doing just so. Try inspecting what your computer does when you've been away from it for 30 or so minutes, and you'll see a lot of chatter from Apple apps.
    - ordinaryperson 6y ago
      > I don't want Google's (or anyone else's) code running in the background doing whatever it wants. Is it really "doing whatever it wants" or just updating itself? Doing whatever it wants seems like a much broader range of activities. Crashing or freezing is a problem, but isn't all software susceptible to those bugs? What if Chrome was crashing or freezing on other people's computers and the latest update fixed it for them? The problem with your preferred methodology of opting in to updates is that 90% of users won't do it, which leads to security and compatibility nightmares. I get that an update can cause problems. But to say that all auto-updating is terrible and it just breaks things and software is doing "whatever it wants" in the background seems like an exaggeration and misses the larger benefits.
    - lonelappde 6y ago
      If you want to professionally sysadmin your system, don't use a consumer convenience-oriented OS and userspace apps.
  - vageli 6y ago
    Software companies are not infallible, and I've received updates in the past that have broken things. Enterprises don't get compensated for lost productivity when an auto-updating app results in broken workflows. Also, we recently got hit with a bug in a new auto-updated version. [0] It's great that this was finally fixed but silently rolling out updates like this make it harder to catch these issues before they are problems in the wild. [0]: https://paul.kinlan.me/correct-image-orientation-for-images-chrome-81/ https://paul.kinlan.me/correct-image-orientation-for-images-...
    - ordinaryperson 6y ago
      OK, so there was an image orientation bug in that specific release of Chrome. But it's estimated there are 1 billion users of Chrome. One billion! How wide of an attack surface does that present? Or how much of a nightmare would it be if they were all on wildly different versions? I get that this specific bug may have caused problems for you. But if I had to choose between security and compatibility for 1 billion software users vs an occasional image orientation bug, I'll choose the former, personally.
      - vageli 6y ago
        > But if I had to choose between security and compatibility for 1 billion software users vs an occasional image orientation bug, This is a disingenuous characterization of my argument. The image orientation bug was a simple example. Further, why can't there be some kind of compromise where security updates are automatically applied and feature updates are not (of course I understand that the line can get blurry)? Lastly, in a philosophical sense, I don't want to cede control of my machine to a third party. Automatically updating apps removes the chance for me to consent to changes and puts me at the mercy of a third party. It removes my ability to make an informed choice.
        ordinaryperson 6y ago
        It's a simple example but that's the kind of tradeoffs platforms are trying to make. Small bugs in favor of security and compatibility. It could be a thousand image orientation bugs. Same arguments still apply. And yes, you can't cordon off security updates from everything else. They accidentally break other things. But this is a general problem of software development. If you're using a third-party's software, aren't you already consenting to their "control"? How much control do you have over someone else's software?
  - qilo 6y ago
    Google has confirmed a Chrome update is at fault for a mysterious reported wave of unbootable Macs. The update was causing issues by corrupting an operating system folder, which prevented those impacted from being able to log in to macOS. https://www.forbes.com/sites/kateoflahertyuk/2019/09/26/google-confirms-buggy-chrome-update-is-breaking-apple-macs/ https://www.forbes.com/sites/kateoflahertyuk/2019/09/26/goog...
  - yyyk 6y ago
    Some of us also remember Internet Explorer 'updates' breaking printing and having to deal with upset PHBs. Microsoft itself ended up developing a somewhat more nuanced understanding of autoupdates than the current Canonical standard - business clients have various ways to override autoupdates. Surely Canonical can improve upon this standard, rather than learn the hard way the same lessons.
kzemek 6y ago
Chrome, no. But I am running FRR on Ubuntu server, and it's also distributed as a Snap - in fact, that has spurred the most known discussion about Snap autoupdates[1]. Of course I can - and do - use the deb version, but it's just one of the critical-always-on things that can creep onto a system as a Snap. For example, LXD is moving with Snap as the default way to distribute on Ubuntu[2]. [1]: https://forum.snapcraft.io/t/disabling-automatic-refresh-for-snap-from-store/707 https://forum.snapcraft.io/t/disabling-automatic-refresh-for... [2]: https://discuss.linuxcontainers.org/t/is-the-snap-the-recommended-way-to-install-lxd-in-ubuntu-18-04/2248 https://discuss.linuxcontainers.org/t/is-the-snap-the-recomm...
- ordinaryperson 6y ago
  OK, but why is the problem FRR not addressing bugs it may be auto releasing and instead the entire principle of auto-updates in general? If we agree that auto-updates on the whole improve security for the platform, why is that not a goal worth pursuing? Why are application devs totally blameless in releasing buggy software?
  - Shared404 6y ago
    All software has bugs. Also, how are the application developers supposed to test for every single environment? In an ideal world, you could get away with pushing all updates automatically, but I for one would rather not get my production server get totalled because of a botched update. *edit to fix question mark
    - GordonS 6y ago
      I think Windows updates illustrates your point nicely. Microsoft are a vast organisation and do a huge amount of testing before pushing updates, yet time after time, there are reports of serious issues with updates. As a software developer myself, I completely understand the desire to have consumers running the latest version - but I also recognise that real world users have different workloads, different levels of acceptable risk, and different consequences when things go wrong. I think automatic updates probably are the best thing for most desktop users, and for some server users but certainly not for everyone all of the time - I don't even mind if auto update is the default, but make it clear and give people a config option where they can control updates themselves!
capableweb 6y ago
My two cents, you don't have to agree but thought I'd just add a different perspective. I prefer my own package manager (pacman) over snaps for the following reasons: 1) I like to upgrade on my own schedule. I use my computer for work, and I cannot have things break in the middle of the day or in the morning, just as I get started with work. I usually save upgrades for when I less things to do, so that in case stuff breaks, I can spend time fixing it. This has happened twice during the last 2 years, or something like that. One time Firefox got broken (or rather, the version upgrade broke an extension I use) and second time some API in neovim changes to a couple of plugins broke. If this breakage would just happen by itself, it would break the two most common tools I use on a day-to-day basis. I've used both Windows and OSX for my professional work and while Windows is the worst offender when it comes to automatic updates, OSX is pretty horrible as well. At least with Windows you can expect some sort of backwards compatibility, while on OSX, one day you have to upgrade your entire OS, otherwise Notes or some stupid application won't launch. On the other hand, Windows eventually forces you to upgrade no matter if you like it or not. So both of them suck equally, but in different ways. 2) snap seems to create mountpoints for the applications and never removes them. When trying snap apps I always end up with bunch of pollution in my environment. Could be that I'm using snap/snapd wrong, but left a sour taste in my mouth, as I saw snap as something that wants to solve a problem that existed for a long time. Instead, they look a bit amateurish because of this.
- ordinaryperson 6y ago
  My position is not that certain users would prefer to update on their own schedule. Of course there are. Or that new updates sometimes break things and that's a hassle. Of course they do and it is. The problem is if you want to distribute an important security update, what do you do? Ask everyone nicely to upgrade? How? Again, what % of users will manually update their software? Not a lot. For #2, that seems like a resolvable problem that can be brought to Canonical. I'd prefer to see auto-updates fine-tuned rather than have super users immediately dismiss the idea in general. It's just my opinion but I think the greater good of the Linux community is served by auto updates, even if occasionally it means an update to an individual application has a bug here or there. Maybe this doesn't apply to you but I wonder how much of the Linux community just doesn't like change. Sometimes Canonical stuff does crazy stuff (Mir?) but auto-updates seem like a noble principle worth attempting to adopt.
lmm 6y ago
> I wish all software would auto-update silently in the background -- when's the last time you even thought about upgrading Chrome? Updating everything has always been one click in Ubuntu (and I'm sure there's an option to have it go automatically). > The author of this article claims it's too difficult to find Flatpak apps and that the Ubuntu software center prioritizes Snaps over .deb. Are platforms never allowed to migrate to a new standard? Why is it Canonical's fault that authors of individual applications have yet to migrate Snaps? Churn is bad, and having to migrate your application is burdensome. Maybe the benefits justify it, but what are those benefits supposed to be? > Maybe I'm just naive and not doing advanced super user stuff these Snap haters are doing but from a distance to me this resembles the systemd vs init controversy. One which, IMHO, Linux super users seemed unusually attached to an older standard for not always clear reasons. Snaps offer real benefits: maybe instead of complaining that 'this sucks' users could offer constructive criticism about how to improve the new standard. I hate systemd because it breaks a bunch of stuff but I'm still forced to use it. So far that's been my experiences of snap as well (specifically it breaks Japanese input for some applications). What are those "real benefits"? You've only talked about auto-update, which was already working fine thank you very much. Snap, like systemd, seems to be more a case of https://www.jwz.org/doc/cadt.html https://www.jwz.org/doc/cadt.html than something that actually makes my system better.
- Legogris 6y ago
  This is getting OT, but could you elaborate on your issues with systemd? I’m genuinely curious. I often see people complain but haven’t seen or experienced specifics apart from it being complex and having higher learning curve than initd. (I don’t know if you’ve tried MX Linux BTW; Debian derivative without systemd by default) I will never defend pulseaudio though, that’s a horrible mess.
  - z3t4 6y ago
    Systemd gives you less control. I used to pipe stderr to email, cant do that with sustemd. The journaling system is very slow compared to plain text files. Systemd overwrite mounts made by ip netns. Network settings is complicated with systemd. Not all bad though, setting up services is easy, and it has never failed to start a service for me so far, and it do start services in the correct order, which is all it should do imho.
Legogris 6y ago
> If we all agree that on the whole auto-updating software is generally better and more secure than manually updated software, why not single out the applications that haven't migrated instead of blaming the whole standard? Everyone certainly don’t agree on that. It really depends on the situation. And if that’s what you want, you had that already with unattended-upgrades. I really prefer to manage what updates, how, when, and under what conditions myself. What’s next, forced unscheduled reboots a la Windows 10?
- ordinaryperson 6y ago
  Unattended upgrades is a great example. You must manually install it, it's difficult to configure (you must edit some complex text file) and even then with it on and set to update all types of packages it often still doesn't. Maybe I'm doing something wrong but in my long experience with Ubuntu I've found unattended-upgrades very unreliable. I get that some people prefer a less secure ecosystem and never want to update their software. But it seems like the greater community is better served by auto updates.
  - toyg 6y ago
    > I've found unattended-upgrades very unreliable. The solution to that would be to fix unattended-upgrades and ship it as working by default, with an easy-to-use script to remove it. I bet that would have been orders of magnitude easier than developing snap. But that would have kept the onus of packaging, testing, and delivering updates on Ubuntu. Instead, with snaps, they can offload all that to upstream developers. That is really the endgame here. Snap is a play for developers, not for users. Ubuntu are saying to developers "if you build a snap, you don't have to worry ever again about distro differences! And you can update anything you need, at will!" and in exchange Ubuntu get to reduce their support costs. Win-win, right? And it is... except for power-users, who will get autoupdates shoved down their throats and their mount tables polluted up the wazoo. But nobody in Ubuntu ever cared about power-users on the desktop, really, so no news there.
apostacy 6y ago
It is wrong to frame this as people not liking auto-updates. That is not the issue. The issue is FORCED auto-updates. Or even just obfuscating how to turn off updates. I've always said that if your updates are such a benefit, then surely users would almost never even need to turn them off without a good reason, so why not give them the option? Most of the time this happens, it is because a company is doing it to maintain their platform, at the expense of their users. Don't say it is just for safety. Why is it easier to install an outdated kernel than an outdated web browser? Operating systems and toolchains are FRAGILE. If I have a computer doing anything important, I have to be vigilant about keeping rolling images of it. Updates break things all the time, if you are doing more than just the basics. I travel a lot. Sometimes I have to reschedule a flight from a 2G cellular connection and can't share that bandwidth with updates. I have computers that run proprietary CNC machines, use specialized musical hardware, or need to have ancient toolchains to build highly specialized software (like J2ME and other embedded toolchains) for internal use for some of my clients. This self serving evergreen mentality is filled with contradictions. Like that I can't use an insecure version of SSL to fix a SCADA device on a secured closed network because they would be insecure, but nobody has a problem with me using telnet or HTTP, without any warnings whatsoever. It's my computer, I don't have to justify why I want to say no to updates! We should not even be having this conversation about why it is not ok for Google or Microsoft to make permanent changes to my data when I have said no. Yes, I probably should make more backups, and I have had to become way more careful about that. But the response to a lot of botched updates is just to blame users for trusting them and not making backups. I shouldn't have to worry about data loss or loss of functionality from updates -- it used to be unheard of for updates to not to have built in rollback functionality. And don't get me started on Google. They are the worst offender. And what bothers me even more, is that they lie about why they are doing it. They've treated their users as unwilling beta testers for years. They installed a persistent menu bar widget without my consent on my mac, which you could either hide, or disable using obscure undiscovered flags.[1] It is only because I got fed up and made Chrome.app immutable and completely removed and locked their Keystone updater, that my Mac wasn't rendered unbootable by Google's recent involuntary update.[2] This should tell you everything you need to know. They have such hubris that not just are they modifying their users's computers, but they are making it nearly impossible for the average users to say no. If companies were truly being honest and stood behind their updates, then there would be a clearly labeled and discoverable checkbox to disable updates, like what OSX has. I'm fine with putting that checkbox behind a bunch of scary warnings, and having the OS check back to make sure you really want to keep updates disabled. But what Google and Microsoft are doing with updates is blatantly dishonest and immoral. [1]: https://www.reddit.com/r/osx/comments/26eorb/chrome_notification_bell_keeps_coming_back/ https://www.reddit.com/r/osx/comments/26eorb/chrome_notifica... [2]: https://news.ycombinator.com/item?id=21064663 https://news.ycombinator.com/item?id=21064663
snailmailman 6y ago
I'm still on 18.04, but I agree. Discord and VSCode keep occasionally prompting me to manually download and install .deb files. I'd really prefer if they just updated automatically. Discord gives a full page "download this update to keep doing things" message that interrupts everything. (i think only on larger updates? i havent seen it in a while) A quick google is telling me that both have snap packages - I guess I'll probably be switching to those when I setup 20.04. Hopefully the snap versions work as well as the non-snaps. I think its interesting that they are pushing snaps so hard on this LTS release though. I always thought of the LTS versions as getting stuck with older versions and being very strict about updates not breaking things. I guess perhaps with the snap-sandboxing this should work smoother? Personally, as long as my system works I don't care. If the software gets updated, that's fine with me.
- shaan7 6y ago
  > Discord and VSCode keep occasionally prompting me to manually download and install .deb files. I'd really prefer if they just updated automatically I installed VSCode from the .deb package on the VSCode website and it automatically added the update repository so that it auto updates via apt. "Installing the .deb package will automatically install the apt repository and signing key to enable auto-updating using the system's package manager" See https://code.visualstudio.com/docs/setup/linux https://code.visualstudio.com/docs/setup/linux Discord doesn't, though.
  - snailmailman 6y ago
    oh cool! I do see the repository in the list. Come to think of it I haven't noticed the popup recently. It used to be basically be a thing in the corner of vscode with a link to the download page. I would usually do the update manually when i saw it, cause I thought it couldn't update on its own.
shaan7 6y ago
> Maybe I'm in the minority but I like Snaps. I wish all software would auto-update silently in the background -- when's the last time you even thought about upgrading Chrome? FWIW Snap isn't a requirement to do that. You can set Ubuntu to update .deb packaged software automatically.
alerighi 6y ago
The problem with snaps is that they are a stupid way to distribute software that doesn't solve any problem, while introducing many other. Basically a snap package is a container, that means an image of an operating system just to run one software. Just this idea should be considerered stupid, is like saying every software is distributed in a Docker container. It's a great way to waste disk space, and also RAM since shared library are no longer really shared... You can have software that update automatically also with debs, where is the problem? Unattended upgrades exists since decades, you install it, and it updates all your packages automatically. You can even have proprietary software packaged in .deb packages, why not, if for Canonical that is a concern. You can even have software that runs in a container packaged as a .deb package, why not? Snap has no real purpose to me. Flatpack is something that makes more sense, since it aims at providing a way to package software for multiple distributions, doesn't really need a runtime, a daemon like snap, but it builds application bundles that you double click and run, without installing them.
- Barrin92 6y ago
  There's flat out wrong stuff in this post. First off snap packages don't waste a lot of disk space because they avoid duplication of shared dependencies by using file hashes. Snap packages that need the same dependencies won't duplicate them. Secondly, snap works on pretty much all major distributions just like flatpak (for a list go here https://snapcraft.io/docs/installing-snapd https://snapcraft.io/docs/installing-snapd). One big advantage that snap has over flatpak is the "--classic" option to allow non-sandboxed applications given that some applications are hard to ship completely sandboxed without getting into some serious usability issues.
  - Conan_Kudo 6y ago
    > There's flat out wrong stuff in this post. First off snap packages don't waste a lot of disk space because they avoid duplication of shared dependencies by using file hashes. Snap packages that need the same dependencies won't duplicate them. This is not true. Snaps are just squashfs images, there's nothing fancy there. No deduplication or anything. You're thinking of Flatpaks with OSTree, which does do this.
finnthehuman 6y ago
Snap is not auto-updating, auto-updating is not snap. Snap is more than just an update system. Even if snap's only concern was auto-updating, it would still carry a set of implementation decisions regarding auto-updating and it's irresponsible to rhetorically treat criticism/praise of an implementation as inseparable from the concept in general. >from a distance to me this resembles the systemd vs init controversy. Yes, people are again playing fast and loose with the distinction between features, and holistic analysis of systems that implement those features.
lucb1e 6y ago
> when's the last time you even thought about upgrading Chrome? But that's exactly what apt does. I last thought about updating Firefox (to use a more fitting example in the context of FOSS) around the same time as I thought about updating GIMP: not that I can remember.
vetinari 6y ago
> when's the last time you even thought about upgrading Chrome? On Linux, Chrome does not autoupdate as it does on Windows or Mac. It installs apt or yum repository and then it is updated together with other packages, when YOU run the update using apt/yum/dnf/whatever frontend you use.
michaelmrose 6y ago
You claim that snap offers real benefits but list none and dismiss detractors as irrational and suggest that instead of complaining about Snap users who have no desire to use snap should invest their own efforts to improve something they have no desire to use instead of being critical. You are correct that this appears to be EXACTLY like the systemd debate. Snap HOPES to provide an easier environment for developers to target and thus provide a richer ecosystem for users to enjoy. This like trickle down economics probably isn't real. Like literally every other time Canonical decided to go their own way they will provide an inferior option that isn't taken up outside their own ecosystem before eventually giving up and joining the crowd. Unless it attracts highly hypothetical new developers to linux it offers nothing but downsides to users. - It's tied to a close source server run by and solely controlled by Canonical with no ability to add software channels like virtually every other major software distribution model for Linux. This means not only could Canonical exercise undue control over how their users use software on their platform it means others including repressive governments could force it to on their behalf. - Users may only install the most recent version of software and will be updated to the most recent as soon as it comes out. -- This means that if devs push a buggy version you are stuck with it until its fixed. If it isn't fixed for months you just can't use the software. Bugs that effect everyone will probably get fixed immediately. Bugs that effect niche features or a smaller number of users are liable to go unfixed for longer. Please see bugs that are open for years at a time. -- In case of developer getting compromised ability to push updates to all users as soon as users machine is online means that a substantial portion of user base can be hit within minutes and almost all within hours. If a new version had to get pulled in and then distributed at irregular intervals a new version would take at least weeks to compromise most users. This would give users/packagers/distros/developers time to realize what is going on before all users are effected. - For some reason they are slow to start - Waste users bandwidth and storage even with one or the other is dear. - Results in 17 different apps having 17 different version of a dep 16 of which have known security vulnerabilities because apps don't use system libraries that get updates.
- thawaway1837 6y ago
  The difference between systemd and snap is that systemd has been validated by almost all the major distro makers. The exceptions are largely people who don’t want systemd precisely because of systemd’s popularity, and they want to retain some diversity in the ecosystem. Canonical could barely get its own users to prefer snaps over the alternatives, which is why they are forcing it onto them.
thawaway1837 6y ago
Without commenting on the quality of snaps, I find Canonical replacing the App Store that supported all 3 distribution methods, with one that drops support for flatpak, and prioritizes snaps over .deb to the extent it will display a snap result over an exact matching .deb result in a search extremely user hostile. And the fact that they first did it in an LTS release seriously jeopardises the trust is have in canonical. This is a deprecation which may have significant undetermined consequences. This is exactly the kind of change they should have introduced in 19.04 and then used the ensuing year to iron out any issues before 20.04 LTS. What this tells me, however, is that for Canonical their business interests are placed above ensuring the stability of the LTS release, and that’s extremely disappointing to say the least.
Avamander 6y ago
> when's the last time you even thought about upgrading Chrome? Every. Fucking. Week. Because it breaks my session every update thanks to the inane switch to snap.
coleifer 6y ago
>t. Not a Linux user.
thayne 6y ago
> Why is it Canonical's fault that authors of individual applications have yet to migrate Snaps? Canonical is the one pushing for snaps, and they own the centralized Snap store. On most other distros snap support is either non-existent or much less than for package manager or even flatpak. Let me turn that question around. Why should individual application developers have to package their apps as snaps, which are mostly just used on ubuntu? > Maybe I'm just naive and not doing advanced super user stuff these Snap haters are doing Most of the complaints here have been about the automatic updates (and specifically that you can't disable it, not that they are on by default). But, personally, I am more concerned with the fact that snap apps run slower. Snap uses squashfs for the program and any associated files, and squashfs is not designed to be fast, it's designed to store a file system in a small amount of (usually read-only) space, such as on a Live CD. Besides slower startup times, snaps also take up more space on disk (which may not be a huge issue for most people), and more time to download (a bigger issue) since each snap has to include its own copy of all its dependencies. The containerization of snaps provides some security benefits, but there are also a couple security concerns with snaps: - Unlike the official apt repos, the snap store is not curated. It is much easier to put malicious software on the snap store than get in the official apt repos. - Since all dependencies are bundled with the snap, if there is a vulnerability in a common dependency, such as libc or openssl, then instead of updating a single package on your system to get a fix, you need to update all of the snaps. And you are dependent on the maintainers of all of those snaps to watch for such vulnerabilities and make sure their dependencies are kept up-to-date.
lightrush 6y ago
You're absolutely right. Snaps do solve legitimate problems that we've struggled for years with and are the right thing to do architecturally. Corner cases that might affect certain users like holding versions or disabling updates entirely "when the user really knows what they're doing" should just be fixed as they arise. But again, snaps or any equivalent system that allows stupid-simple packaging, bundling dependencies, doing fail-proof transactional updates and running in per-app confinement has been proven valuable by the mobile world and not only (automotive and embedded come to mind). It's high time the typical desktop/server Linux operating system got such a system by default. What we need is to iterate over it to cover its gaps. For example the one sticking point I see in this thread when people really get pressed to argument their unhappiness with snap seems to come down to being unable to stop the auto-updating behavior. I could easily see Canonical implementing a feature to control that and putting it behind an explanation of the downsides and a "Disable this only if you know what you're doing!" warning. And so on for the rest of the corner cases. And from developer's point of view, I can attest that if I'm to package and publish something for Linux, I'd certainly use snap or Flatpak or both before using deb or rpm so long as they're not affecting me in some major negative way. I assure the reader this is not the minority opinion and the software catalog is only going to grow because of it. This is our way out of PPAs and dependency problems (among other things) for publishing up to date out-of-distro software. I have no problem with a particular set of users not wanting the latest version if they know what they're doing but that doesn't negate the benefits this kind of a system brings. We've seen this play out with other new and needed Linux systems before and that's OK.

bluedino 6y ago

Chrome auto updates cause issues on the Mac. No thanks.

ordinaryperson 6y ago
OK, what issues does it cause? And are those issues outweighed by the security and standardization issues raised by non-updating software? I don't know who all remembers having to develop websites compatible with outdated versions of Internet Explorer but I do and still have nightmares about it.
- bluedino 6y ago
  Crashes, freezes, stopping systems from sleeping... I don't want Google's (or anyone else's) code running in the background doing whatever it wants. Want to check for an update and notify me? Great. But don't do anything else.
  - capableweb 6y ago
    You might be on the wrong operating system if you don't like "code running in the background doing whatever it wants" as Apple has never shied away from doing just so. Try inspecting what your computer does when you've been away from it for 30 or so minutes, and you'll see a lot of chatter from Apple apps.
  - ordinaryperson 6y ago
    > I don't want Google's (or anyone else's) code running in the background doing whatever it wants. Is it really "doing whatever it wants" or just updating itself? Doing whatever it wants seems like a much broader range of activities. Crashing or freezing is a problem, but isn't all software susceptible to those bugs? What if Chrome was crashing or freezing on other people's computers and the latest update fixed it for them? The problem with your preferred methodology of opting in to updates is that 90% of users won't do it, which leads to security and compatibility nightmares. I get that an update can cause problems. But to say that all auto-updating is terrible and it just breaks things and software is doing "whatever it wants" in the background seems like an exaggeration and misses the larger benefits.
  - lonelappde 6y ago
    If you want to professionally sysadmin your system, don't use a consumer convenience-oriented OS and userspace apps.
- vageli 6y ago
  Software companies are not infallible, and I've received updates in the past that have broken things. Enterprises don't get compensated for lost productivity when an auto-updating app results in broken workflows. Also, we recently got hit with a bug in a new auto-updated version. [0] It's great that this was finally fixed but silently rolling out updates like this make it harder to catch these issues before they are problems in the wild. [0]: https://paul.kinlan.me/correct-image-orientation-for-images-chrome-81/ https://paul.kinlan.me/correct-image-orientation-for-images-...
  - ordinaryperson 6y ago
    OK, so there was an image orientation bug in that specific release of Chrome. But it's estimated there are 1 billion users of Chrome. One billion! How wide of an attack surface does that present? Or how much of a nightmare would it be if they were all on wildly different versions? I get that this specific bug may have caused problems for you. But if I had to choose between security and compatibility for 1 billion software users vs an occasional image orientation bug, I'll choose the former, personally.
    - vageli 6y ago
      > But if I had to choose between security and compatibility for 1 billion software users vs an occasional image orientation bug, This is a disingenuous characterization of my argument. The image orientation bug was a simple example. Further, why can't there be some kind of compromise where security updates are automatically applied and feature updates are not (of course I understand that the line can get blurry)? Lastly, in a philosophical sense, I don't want to cede control of my machine to a third party. Automatically updating apps removes the chance for me to consent to changes and puts me at the mercy of a third party. It removes my ability to make an informed choice.
      - ordinaryperson 6y ago
        It's a simple example but that's the kind of tradeoffs platforms are trying to make. Small bugs in favor of security and compatibility. It could be a thousand image orientation bugs. Same arguments still apply. And yes, you can't cordon off security updates from everything else. They accidentally break other things. But this is a general problem of software development. If you're using a third-party's software, aren't you already consenting to their "control"? How much control do you have over someone else's software?
- qilo 6y ago
  Google has confirmed a Chrome update is at fault for a mysterious reported wave of unbootable Macs. The update was causing issues by corrupting an operating system folder, which prevented those impacted from being able to log in to macOS. https://www.forbes.com/sites/kateoflahertyuk/2019/09/26/google-confirms-buggy-chrome-update-is-breaking-apple-macs/ https://www.forbes.com/sites/kateoflahertyuk/2019/09/26/goog...
- yyyk 6y ago
  Some of us also remember Internet Explorer 'updates' breaking printing and having to deal with upset PHBs. Microsoft itself ended up developing a somewhat more nuanced understanding of autoupdates than the current Canonical standard - business clients have various ways to override autoupdates. Surely Canonical can improve upon this standard, rather than learn the hard way the same lessons.

kzemek 6y ago

Chrome, no. But I am running FRR on Ubuntu server, and it's also distributed as a Snap - in fact, that has spurred the most known discussion about Snap autoupdates[1]. Of course I can - and do - use the deb version, but it's just one of the critical-always-on things that can creep onto a system as a Snap. For example, LXD is moving with Snap as the default way to distribute on Ubuntu[2]. [1]: https://forum.snapcraft.io/t/disabling-automatic-refresh-for-snap-from-store/707 https://forum.snapcraft.io/t/disabling-automatic-refresh-for... [2]: https://discuss.linuxcontainers.org/t/is-the-snap-the-recommended-way-to-install-lxd-in-ubuntu-18-04/2248 https://discuss.linuxcontainers.org/t/is-the-snap-the-recomm...

ordinaryperson 6y ago
OK, but why is the problem FRR not addressing bugs it may be auto releasing and instead the entire principle of auto-updates in general? If we agree that auto-updates on the whole improve security for the platform, why is that not a goal worth pursuing? Why are application devs totally blameless in releasing buggy software?
- Shared404 6y ago
  All software has bugs. Also, how are the application developers supposed to test for every single environment? In an ideal world, you could get away with pushing all updates automatically, but I for one would rather not get my production server get totalled because of a botched update. *edit to fix question mark
  - GordonS 6y ago
    I think Windows updates illustrates your point nicely. Microsoft are a vast organisation and do a huge amount of testing before pushing updates, yet time after time, there are reports of serious issues with updates. As a software developer myself, I completely understand the desire to have consumers running the latest version - but I also recognise that real world users have different workloads, different levels of acceptable risk, and different consequences when things go wrong. I think automatic updates probably are the best thing for most desktop users, and for some server users but certainly not for everyone all of the time - I don't even mind if auto update is the default, but make it clear and give people a config option where they can control updates themselves!

capableweb 6y ago

My two cents, you don't have to agree but thought I'd just add a different perspective. I prefer my own package manager (pacman) over snaps for the following reasons: 1) I like to upgrade on my own schedule. I use my computer for work, and I cannot have things break in the middle of the day or in the morning, just as I get started with work. I usually save upgrades for when I less things to do, so that in case stuff breaks, I can spend time fixing it. This has happened twice during the last 2 years, or something like that. One time Firefox got broken (or rather, the version upgrade broke an extension I use) and second time some API in neovim changes to a couple of plugins broke. If this breakage would just happen by itself, it would break the two most common tools I use on a day-to-day basis. I've used both Windows and OSX for my professional work and while Windows is the worst offender when it comes to automatic updates, OSX is pretty horrible as well. At least with Windows you can expect some sort of backwards compatibility, while on OSX, one day you have to upgrade your entire OS, otherwise Notes or some stupid application won't launch. On the other hand, Windows eventually forces you to upgrade no matter if you like it or not. So both of them suck equally, but in different ways. 2) snap seems to create mountpoints for the applications and never removes them. When trying snap apps I always end up with bunch of pollution in my environment. Could be that I'm using snap/snapd wrong, but left a sour taste in my mouth, as I saw snap as something that wants to solve a problem that existed for a long time. Instead, they look a bit amateurish because of this.

ordinaryperson 6y ago
My position is not that certain users would prefer to update on their own schedule. Of course there are. Or that new updates sometimes break things and that's a hassle. Of course they do and it is. The problem is if you want to distribute an important security update, what do you do? Ask everyone nicely to upgrade? How? Again, what % of users will manually update their software? Not a lot. For #2, that seems like a resolvable problem that can be brought to Canonical. I'd prefer to see auto-updates fine-tuned rather than have super users immediately dismiss the idea in general. It's just my opinion but I think the greater good of the Linux community is served by auto updates, even if occasionally it means an update to an individual application has a bug here or there. Maybe this doesn't apply to you but I wonder how much of the Linux community just doesn't like change. Sometimes Canonical stuff does crazy stuff (Mir?) but auto-updates seem like a noble principle worth attempting to adopt.

lmm 6y ago

> I wish all software would auto-update silently in the background -- when's the last time you even thought about upgrading Chrome? Updating everything has always been one click in Ubuntu (and I'm sure there's an option to have it go automatically). > The author of this article claims it's too difficult to find Flatpak apps and that the Ubuntu software center prioritizes Snaps over .deb. Are platforms never allowed to migrate to a new standard? Why is it Canonical's fault that authors of individual applications have yet to migrate Snaps? Churn is bad, and having to migrate your application is burdensome. Maybe the benefits justify it, but what are those benefits supposed to be? > Maybe I'm just naive and not doing advanced super user stuff these Snap haters are doing but from a distance to me this resembles the systemd vs init controversy. One which, IMHO, Linux super users seemed unusually attached to an older standard for not always clear reasons. Snaps offer real benefits: maybe instead of complaining that 'this sucks' users could offer constructive criticism about how to improve the new standard. I hate systemd because it breaks a bunch of stuff but I'm still forced to use it. So far that's been my experiences of snap as well (specifically it breaks Japanese input for some applications). What are those "real benefits"? You've only talked about auto-update, which was already working fine thank you very much. Snap, like systemd, seems to be more a case of https://www.jwz.org/doc/cadt.html https://www.jwz.org/doc/cadt.html than something that actually makes my system better.

Legogris 6y ago
This is getting OT, but could you elaborate on your issues with systemd? I’m genuinely curious. I often see people complain but haven’t seen or experienced specifics apart from it being complex and having higher learning curve than initd. (I don’t know if you’ve tried MX Linux BTW; Debian derivative without systemd by default) I will never defend pulseaudio though, that’s a horrible mess.
- z3t4 6y ago
  Systemd gives you less control. I used to pipe stderr to email, cant do that with sustemd. The journaling system is very slow compared to plain text files. Systemd overwrite mounts made by ip netns. Network settings is complicated with systemd. Not all bad though, setting up services is easy, and it has never failed to start a service for me so far, and it do start services in the correct order, which is all it should do imho.

Legogris 6y ago

> If we all agree that on the whole auto-updating software is generally better and more secure than manually updated software, why not single out the applications that haven't migrated instead of blaming the whole standard? Everyone certainly don’t agree on that. It really depends on the situation. And if that’s what you want, you had that already with unattended-upgrades. I really prefer to manage what updates, how, when, and under what conditions myself. What’s next, forced unscheduled reboots a la Windows 10?

ordinaryperson 6y ago
Unattended upgrades is a great example. You must manually install it, it's difficult to configure (you must edit some complex text file) and even then with it on and set to update all types of packages it often still doesn't. Maybe I'm doing something wrong but in my long experience with Ubuntu I've found unattended-upgrades very unreliable. I get that some people prefer a less secure ecosystem and never want to update their software. But it seems like the greater community is better served by auto updates.
- toyg 6y ago
  > I've found unattended-upgrades very unreliable. The solution to that would be to fix unattended-upgrades and ship it as working by default, with an easy-to-use script to remove it. I bet that would have been orders of magnitude easier than developing snap. But that would have kept the onus of packaging, testing, and delivering updates on Ubuntu. Instead, with snaps, they can offload all that to upstream developers. That is really the endgame here. Snap is a play for developers, not for users. Ubuntu are saying to developers "if you build a snap, you don't have to worry ever again about distro differences! And you can update anything you need, at will!" and in exchange Ubuntu get to reduce their support costs. Win-win, right? And it is... except for power-users, who will get autoupdates shoved down their throats and their mount tables polluted up the wazoo. But nobody in Ubuntu ever cared about power-users on the desktop, really, so no news there.

apostacy 6y ago

It is wrong to frame this as people not liking auto-updates. That is not the issue. The issue is FORCED auto-updates. Or even just obfuscating how to turn off updates. I've always said that if your updates are such a benefit, then surely users would almost never even need to turn them off without a good reason, so why not give them the option? Most of the time this happens, it is because a company is doing it to maintain their platform, at the expense of their users. Don't say it is just for safety. Why is it easier to install an outdated kernel than an outdated web browser? Operating systems and toolchains are FRAGILE. If I have a computer doing anything important, I have to be vigilant about keeping rolling images of it. Updates break things all the time, if you are doing more than just the basics. I travel a lot. Sometimes I have to reschedule a flight from a 2G cellular connection and can't share that bandwidth with updates. I have computers that run proprietary CNC machines, use specialized musical hardware, or need to have ancient toolchains to build highly specialized software (like J2ME and other embedded toolchains) for internal use for some of my clients. This self serving evergreen mentality is filled with contradictions. Like that I can't use an insecure version of SSL to fix a SCADA device on a secured closed network because they would be insecure, but nobody has a problem with me using telnet or HTTP, without any warnings whatsoever. It's my computer, I don't have to justify why I want to say no to updates! We should not even be having this conversation about why it is not ok for Google or Microsoft to make permanent changes to my data when I have said no. Yes, I probably should make more backups, and I have had to become way more careful about that. But the response to a lot of botched updates is just to blame users for trusting them and not making backups. I shouldn't have to worry about data loss or loss of functionality from updates -- it used to be unheard of for updates to not to have built in rollback functionality. And don't get me started on Google. They are the worst offender. And what bothers me even more, is that they lie about why they are doing it. They've treated their users as unwilling beta testers for years. They installed a persistent menu bar widget without my consent on my mac, which you could either hide, or disable using obscure undiscovered flags.[1] It is only because I got fed up and made Chrome.app immutable and completely removed and locked their Keystone updater, that my Mac wasn't rendered unbootable by Google's recent involuntary update.[2] This should tell you everything you need to know. They have such hubris that not just are they modifying their users's computers, but they are making it nearly impossible for the average users to say no. If companies were truly being honest and stood behind their updates, then there would be a clearly labeled and discoverable checkbox to disable updates, like what OSX has. I'm fine with putting that checkbox behind a bunch of scary warnings, and having the OS check back to make sure you really want to keep updates disabled. But what Google and Microsoft are doing with updates is blatantly dishonest and immoral. [1]: https://www.reddit.com/r/osx/comments/26eorb/chrome_notification_bell_keeps_coming_back/ https://www.reddit.com/r/osx/comments/26eorb/chrome_notifica... [2]: https://news.ycombinator.com/item?id=21064663 https://news.ycombinator.com/item?id=21064663

snailmailman 6y ago

I'm still on 18.04, but I agree. Discord and VSCode keep occasionally prompting me to manually download and install .deb files. I'd really prefer if they just updated automatically. Discord gives a full page "download this update to keep doing things" message that interrupts everything. (i think only on larger updates? i havent seen it in a while) A quick google is telling me that both have snap packages - I guess I'll probably be switching to those when I setup 20.04. Hopefully the snap versions work as well as the non-snaps. I think its interesting that they are pushing snaps so hard on this LTS release though. I always thought of the LTS versions as getting stuck with older versions and being very strict about updates not breaking things. I guess perhaps with the snap-sandboxing this should work smoother? Personally, as long as my system works I don't care. If the software gets updated, that's fine with me.

shaan7 6y ago
> Discord and VSCode keep occasionally prompting me to manually download and install .deb files. I'd really prefer if they just updated automatically I installed VSCode from the .deb package on the VSCode website and it automatically added the update repository so that it auto updates via apt. "Installing the .deb package will automatically install the apt repository and signing key to enable auto-updating using the system's package manager" See https://code.visualstudio.com/docs/setup/linux https://code.visualstudio.com/docs/setup/linux Discord doesn't, though.
- snailmailman 6y ago
  oh cool! I do see the repository in the list. Come to think of it I haven't noticed the popup recently. It used to be basically be a thing in the corner of vscode with a link to the download page. I would usually do the update manually when i saw it, cause I thought it couldn't update on its own.

shaan7 6y ago

> Maybe I'm in the minority but I like Snaps. I wish all software would auto-update silently in the background -- when's the last time you even thought about upgrading Chrome? FWIW Snap isn't a requirement to do that. You can set Ubuntu to update .deb packaged software automatically.

alerighi 6y ago

The problem with snaps is that they are a stupid way to distribute software that doesn't solve any problem, while introducing many other. Basically a snap package is a container, that means an image of an operating system just to run one software. Just this idea should be considerered stupid, is like saying every software is distributed in a Docker container. It's a great way to waste disk space, and also RAM since shared library are no longer really shared... You can have software that update automatically also with debs, where is the problem? Unattended upgrades exists since decades, you install it, and it updates all your packages automatically. You can even have proprietary software packaged in .deb packages, why not, if for Canonical that is a concern. You can even have software that runs in a container packaged as a .deb package, why not? Snap has no real purpose to me. Flatpack is something that makes more sense, since it aims at providing a way to package software for multiple distributions, doesn't really need a runtime, a daemon like snap, but it builds application bundles that you double click and run, without installing them.

Barrin92 6y ago
There's flat out wrong stuff in this post. First off snap packages don't waste a lot of disk space because they avoid duplication of shared dependencies by using file hashes. Snap packages that need the same dependencies won't duplicate them. Secondly, snap works on pretty much all major distributions just like flatpak (for a list go here https://snapcraft.io/docs/installing-snapd https://snapcraft.io/docs/installing-snapd). One big advantage that snap has over flatpak is the "--classic" option to allow non-sandboxed applications given that some applications are hard to ship completely sandboxed without getting into some serious usability issues.
- Conan_Kudo 6y ago
  > There's flat out wrong stuff in this post. First off snap packages don't waste a lot of disk space because they avoid duplication of shared dependencies by using file hashes. Snap packages that need the same dependencies won't duplicate them. This is not true. Snaps are just squashfs images, there's nothing fancy there. No deduplication or anything. You're thinking of Flatpaks with OSTree, which does do this.

finnthehuman 6y ago

Snap is not auto-updating, auto-updating is not snap. Snap is more than just an update system. Even if snap's only concern was auto-updating, it would still carry a set of implementation decisions regarding auto-updating and it's irresponsible to rhetorically treat criticism/praise of an implementation as inseparable from the concept in general. >from a distance to me this resembles the systemd vs init controversy. Yes, people are again playing fast and loose with the distinction between features, and holistic analysis of systems that implement those features.

lucb1e 6y ago

> when's the last time you even thought about upgrading Chrome? But that's exactly what apt does. I last thought about updating Firefox (to use a more fitting example in the context of FOSS) around the same time as I thought about updating GIMP: not that I can remember.

vetinari 6y ago

> when's the last time you even thought about upgrading Chrome? On Linux, Chrome does not autoupdate as it does on Windows or Mac. It installs apt or yum repository and then it is updated together with other packages, when YOU run the update using apt/yum/dnf/whatever frontend you use.

michaelmrose 6y ago

You claim that snap offers real benefits but list none and dismiss detractors as irrational and suggest that instead of complaining about Snap users who have no desire to use snap should invest their own efforts to improve something they have no desire to use instead of being critical. You are correct that this appears to be EXACTLY like the systemd debate. Snap HOPES to provide an easier environment for developers to target and thus provide a richer ecosystem for users to enjoy. This like trickle down economics probably isn't real. Like literally every other time Canonical decided to go their own way they will provide an inferior option that isn't taken up outside their own ecosystem before eventually giving up and joining the crowd. Unless it attracts highly hypothetical new developers to linux it offers nothing but downsides to users. - It's tied to a close source server run by and solely controlled by Canonical with no ability to add software channels like virtually every other major software distribution model for Linux. This means not only could Canonical exercise undue control over how their users use software on their platform it means others including repressive governments could force it to on their behalf. - Users may only install the most recent version of software and will be updated to the most recent as soon as it comes out. -- This means that if devs push a buggy version you are stuck with it until its fixed. If it isn't fixed for months you just can't use the software. Bugs that effect everyone will probably get fixed immediately. Bugs that effect niche features or a smaller number of users are liable to go unfixed for longer. Please see bugs that are open for years at a time. -- In case of developer getting compromised ability to push updates to all users as soon as users machine is online means that a substantial portion of user base can be hit within minutes and almost all within hours. If a new version had to get pulled in and then distributed at irregular intervals a new version would take at least weeks to compromise most users. This would give users/packagers/distros/developers time to realize what is going on before all users are effected. - For some reason they are slow to start - Waste users bandwidth and storage even with one or the other is dear. - Results in 17 different apps having 17 different version of a dep 16 of which have known security vulnerabilities because apps don't use system libraries that get updates.

thawaway1837 6y ago
The difference between systemd and snap is that systemd has been validated by almost all the major distro makers. The exceptions are largely people who don’t want systemd precisely because of systemd’s popularity, and they want to retain some diversity in the ecosystem. Canonical could barely get its own users to prefer snaps over the alternatives, which is why they are forcing it onto them.

thawaway1837 6y ago

Without commenting on the quality of snaps, I find Canonical replacing the App Store that supported all 3 distribution methods, with one that drops support for flatpak, and prioritizes snaps over .deb to the extent it will display a snap result over an exact matching .deb result in a search extremely user hostile. And the fact that they first did it in an LTS release seriously jeopardises the trust is have in canonical. This is a deprecation which may have significant undetermined consequences. This is exactly the kind of change they should have introduced in 19.04 and then used the ensuing year to iron out any issues before 20.04 LTS. What this tells me, however, is that for Canonical their business interests are placed above ensuring the stability of the LTS release, and that’s extremely disappointing to say the least.

Avamander 6y ago

> when's the last time you even thought about upgrading Chrome? Every. Fucking. Week. Because it breaks my session every update thanks to the inane switch to snap.

coleifer 6y ago

>t. Not a Linux user.

thayne 6y ago

> Why is it Canonical's fault that authors of individual applications have yet to migrate Snaps? Canonical is the one pushing for snaps, and they own the centralized Snap store. On most other distros snap support is either non-existent or much less than for package manager or even flatpak. Let me turn that question around. Why should individual application developers have to package their apps as snaps, which are mostly just used on ubuntu? > Maybe I'm just naive and not doing advanced super user stuff these Snap haters are doing Most of the complaints here have been about the automatic updates (and specifically that you can't disable it, not that they are on by default). But, personally, I am more concerned with the fact that snap apps run slower. Snap uses squashfs for the program and any associated files, and squashfs is not designed to be fast, it's designed to store a file system in a small amount of (usually read-only) space, such as on a Live CD. Besides slower startup times, snaps also take up more space on disk (which may not be a huge issue for most people), and more time to download (a bigger issue) since each snap has to include its own copy of all its dependencies. The containerization of snaps provides some security benefits, but there are also a couple security concerns with snaps: - Unlike the official apt repos, the snap store is not curated. It is much easier to put malicious software on the snap store than get in the official apt repos. - Since all dependencies are bundled with the snap, if there is a vulnerability in a common dependency, such as libc or openssl, then instead of updating a single package on your system to get a fix, you need to update all of the snaps. And you are dependent on the maintainers of all of those snaps to watch for such vulnerabilities and make sure their dependencies are kept up-to-date.

lightrush 6y ago

You're absolutely right. Snaps do solve legitimate problems that we've struggled for years with and are the right thing to do architecturally. Corner cases that might affect certain users like holding versions or disabling updates entirely "when the user really knows what they're doing" should just be fixed as they arise. But again, snaps or any equivalent system that allows stupid-simple packaging, bundling dependencies, doing fail-proof transactional updates and running in per-app confinement has been proven valuable by the mobile world and not only (automotive and embedded come to mind). It's high time the typical desktop/server Linux operating system got such a system by default. What we need is to iterate over it to cover its gaps. For example the one sticking point I see in this thread when people really get pressed to argument their unhappiness with snap seems to come down to being unable to stop the auto-updating behavior. I could easily see Canonical implementing a feature to control that and putting it behind an explanation of the downsides and a "Disable this only if you know what you're doing!" warning. And so on for the rest of the corner cases. And from developer's point of view, I can attest that if I'm to package and publish something for Linux, I'd certainly use snap or Flatpak or both before using deb or rpm so long as they're not affecting me in some major negative way. I assure the reader this is not the minority opinion and the software catalog is only going to grow because of it. This is our way out of PPAs and dependency problems (among other things) for publishing up to date out-of-distro software. I have no problem with a particular set of users not wanting the latest version if they know what they're doing but that doesn't negate the benefits this kind of a system brings. We've seen this play out with other new and needed Linux systems before and that's OK.