10 ms·

I am very diligent about applying updates as soon as I'm able and generally read the changelogs of the updates I'm applying in Ubuntu's Software Updater. One t

by shock 6y ago

I am very diligent about applying updates as soon as I'm able and generally read the changelogs of the updates I'm applying in Ubuntu's Software Updater. One thing I will not do is willingly allow somebody else a way to deploy and execute code on my computer without my say so (which snap is). After reading the whole thread at https://forum.snapcraft.io/t/disabling-automatic-refresh-for-snap-from-store/707 https://forum.snapcraft.io/t/disabling-automatic-refresh-for... and seeing Gustavo Niemeyer's arrogance (we know better than you when you should be applying updates) I will be voting with my feet and will be installing Pop!_OS instead of Ubuntu, and if snapd is present I will remove it. The stated goal of Niemeyer, to have users use updated software, would have been fulfilled in my case if I had a way to see what updates would be applied beforehand, instead of the updates being force-installed. Lengthy dialog with Niemeyer in the forum thread seems to have been a waste of time for all the people who participated trying to convince him to allow disabling of force-installed updates so I suggest you do the same as me and vote with your feet!

deleted 6y ago
[deleted]
donmcronald 6y ago
If they make it automatic and unmanageable by default, they can sell those features back to us tomorrow as an enterprise edition or a private Snap store. It’s the same thing MS did with Windows 10. You buy the product, but have to pay again if you want any semblance of control. Us normal users are now test subjects for the real customers. Look how non-enterprise Office 365 customers are on a monthly cadence for forced updates and the expensive plans get SAC or better.
- shock 6y ago
  > If they make it automatic and unmanageable by default, they can sell those features back to us tomorrow as an enterprise edition or a private Snap store. I'm not sure whether you're being ironic, but they're doing just that.
  - deleted 6y ago
    [deleted]
qidydl 6y ago
I'm surprised that something like routing software is/was being distributed via snap instead of as a Docker container; snap seems much more targeted towards end-user workstations than to servers.
- topranks 6y ago
  Often won’t work running something like FRR in a container (and therefore it’s own netns,) because it has to update kernel tables etc. You can do it in a privaledged container afaik though.
- thekyle 6y ago
  I always felt that snap was designed for servers with desktop being an afterthought (thus why so many things still don't work in snap, ex: sys gtk themes). Flatpak on the other hand was designed desktop first and barely works for server stuff. But the Flatpak experience on the desktop is vastly superior to the snap one IMO.
  - kikoreis 6y ago
    Actually, snaps inherit from Ubuntu Phone's app packaging mechanism, so it's neither server nor desktop — but certainly closer to the end-user side of the spectrum. (For server apps, the auto-update mechanism has a really painful consequence, which is that for clustered apps you have a built-in race condition that might kill your cluster)
Uehreka 6y ago
I’ve been running Pop OS on the desktop for a year and I’m very happy with it. It might just be me getting better at running Linux, but this is the first Linux partition I haven’t had to hose after about 6-9 months due to some issue with incompatible libraries/updates/settings getting installed. With regards to updates, it seems that 20.04 continues in the mold of Pop OS 18.04: You get periodic notifications that updates are available, and can go to the Pop Shop to install them. If there are multiple apps receiving updates, you can review and install them piecemeal (although OS/library updates are bundled together as one item in the UI). The idea of using it for my servers feels weird at first (when I think of Pop OS the UI comes to mind) but after thinking about it, it is a really solid OS and there’s no reason I can think of that it wouldn’t work.
m463 6y ago
I have to use Ubuntu 18.04 for some things and even with a minimal installation, I found some things phoned home or pushed changes. I could remove some packages, like ubuntu-report or unattended-upgrades, but some seemed to be intertwined with other packages in a (purposeful?) labyrinth of nested dependencies. They made themselves critical and uninstalling would break or cripple other fundamental system components. Some I disabled in the config files, like apport, motd_news and kerneloops. Some I disabled and masked in systemd and others like snapd and whoopsie/whoopsie-preferences, I had to do: dpkg -L snapd | while read f do cat /dev/null > "$f" done I wonder how this kind of nonsense percolates through a company? Is it developers from commercial software vendors changing jobs and solving the problems the same way they solved them for other corporate customers? Or is it marketing carefully plotting a release by release path to dominance? Or is it people who truly believe that having a viable market for linux software will be good? I mean, there might be some truths - people lag with their updates, people don't defend their privacy, and people would like to pay for software but have no avenue to do so. But accepting those truths and unilaterally forcing "solutions" might find linux is a different sort of animal.
- guug 6y ago
  I was aware of `motd_news` and disable it on each new install, but I somehow completely missed `apport` and `kerneloops`. Trying to keep up with Canonical's attempts is why I switched all my new systems to Debian. Far more stable and predictable.
- dcow 6y ago
  I think there’s a proliferation of well meaning but ultimately _uncultured_ developers (perhaps some are lazy, but I don‘t think that’s the main problem). It’s almost inevitable as software, and internet culture, has itself proliferated. Seeing how businesses make decisions with such abysmal disregard for anything that puts users in control probably only serves to normalize the mentality further. But at the end if the day the problem really is that people don’t speak with their feet. I find it darkly humorous when someone complains about online privacy yet in the next sentence verbs _google_ or is still using their gmail from 15 years ago or hasn't switched to a privacy respecting browser or would never consider a librem device because it has previous gen specs. Software that gives users freedom and respects their privacy is not the default. Good software is hard to find. Too often software is measured solely on how good it looks as an electron app. So how about the next time you hear someone raking the GPL through the mud you help educate them. If you encounter a business leader deciding to cookie everyone because it lets them target the CISO of Oracle with personalized crafted ads, refuse to acquiesce. Not only donate to the EFF but actually participle. When asked what to do about the widening software culture gap at BSides SF, John Perry Barlow reminded everyone that education is the only real solution.
kikoreis 6y ago
It's probably not a surprise to you, but this is a hotly debated topic inside Canonical. And I apologize for that thread, as it really doesn't represent our best attempt at external debate. Changing a paradigm usually involves pushing the envelope and breaking some existing assumptions; systemd is everybody's favorite example of that in the Linux world. The root of this issue with snaps is the trade-off between built-in security and user control. Some points to consider: 1. Browsers like FF and Chromium [on Windows] simply self-update, and disabling that requires configuration. So there is at least some precedent for taking the position that user applications should just update themselves. Server apps are more complex and are a strong argument counter to the existing behavior, as is the fact that many apps cannot be refreshed without user impact. 2. Ubuntu, since 16.04 LTS, ships with unattended-upgrades enabled, which means that for debian packages the default behavior is already auto-updating (although automated reboots are not enabled by default, as that would be crazy for the general purpose case). That feels like the correct default, too, given the risk of running code exposed to exploitable, public CVEs — and how reluctant users (like my dad and my wife!) are to click on "Install now" in the update-manager dialog. 3. Debian package updates run as root. Snap updates run in userspace, and confined. So in principle the risk exposure for snap updates is much smaller. And snaps do have an auto-rollback mechanism for failed updates [a]. Counter to that argument is the fact that snaps are meant to be under third-party control, and that there is no clear mechanism to separate security patches vs updates which you get with the debian pocket mechanism (i.e. focal-security vs focal-updates). The lack of any official [b] means of user control over the snap auto-update mechanism feels wrong to many of us, including me. And while we may seem somewhat opaque in these debates, the feedback we get in threads like this one (and the snapcraft.io one) actually feeds into our decision making. So please do keep pushing on this topic and we'll do our part internally. [a] See https://kyrofa.com/posts/snap-updates-automatic-rollbacks https://kyrofa.com/posts/snap-updates-automatic-rollbacks for a detailed guide on this topic. Of course, if your snap refreshes and you hate the new version, downgrading isn't quite always possible. [b] There are ways to, hmmm, control auto-updating (i.e. refresh.metered, refresh.hold) if you really want to; that thread has a few. That doesn't help the debate, but I'm sharing in case someone has a technical need for it.
- koolba 6y ago
heavyset_go 6y ago
This attitude extends to other areas of the project, like the fact that you can't move or rename ~/snap. Developers don't care that not only are there users who would like to be able change it, but that there is a freedesktop.org spec that they aren't following.

by shock 6y ago

deleted 6y ago

[deleted]

donmcronald 6y ago

If they make it automatic and unmanageable by default, they can sell those features back to us tomorrow as an enterprise edition or a private Snap store. It’s the same thing MS did with Windows 10. You buy the product, but have to pay again if you want any semblance of control. Us normal users are now test subjects for the real customers. Look how non-enterprise Office 365 customers are on a monthly cadence for forced updates and the expensive plans get SAC or better.

shock 6y ago
> If they make it automatic and unmanageable by default, they can sell those features back to us tomorrow as an enterprise edition or a private Snap store. I'm not sure whether you're being ironic, but they're doing just that.
- deleted 6y ago
  [deleted]

qidydl 6y ago

I'm surprised that something like routing software is/was being distributed via snap instead of as a Docker container; snap seems much more targeted towards end-user workstations than to servers.

topranks 6y ago
Often won’t work running something like FRR in a container (and therefore it’s own netns,) because it has to update kernel tables etc. You can do it in a privaledged container afaik though.
thekyle 6y ago
I always felt that snap was designed for servers with desktop being an afterthought (thus why so many things still don't work in snap, ex: sys gtk themes). Flatpak on the other hand was designed desktop first and barely works for server stuff. But the Flatpak experience on the desktop is vastly superior to the snap one IMO.
- kikoreis 6y ago
  Actually, snaps inherit from Ubuntu Phone's app packaging mechanism, so it's neither server nor desktop — but certainly closer to the end-user side of the spectrum. (For server apps, the auto-update mechanism has a really painful consequence, which is that for clustered apps you have a built-in race condition that might kill your cluster)

Uehreka 6y ago

I’ve been running Pop OS on the desktop for a year and I’m very happy with it. It might just be me getting better at running Linux, but this is the first Linux partition I haven’t had to hose after about 6-9 months due to some issue with incompatible libraries/updates/settings getting installed. With regards to updates, it seems that 20.04 continues in the mold of Pop OS 18.04: You get periodic notifications that updates are available, and can go to the Pop Shop to install them. If there are multiple apps receiving updates, you can review and install them piecemeal (although OS/library updates are bundled together as one item in the UI). The idea of using it for my servers feels weird at first (when I think of Pop OS the UI comes to mind) but after thinking about it, it is a really solid OS and there’s no reason I can think of that it wouldn’t work.

m463 6y ago

I have to use Ubuntu 18.04 for some things and even with a minimal installation, I found some things phoned home or pushed changes. I could remove some packages, like ubuntu-report or unattended-upgrades, but some seemed to be intertwined with other packages in a (purposeful?) labyrinth of nested dependencies. They made themselves critical and uninstalling would break or cripple other fundamental system components. Some I disabled in the config files, like apport, motd_news and kerneloops. Some I disabled and masked in systemd and others like snapd and whoopsie/whoopsie-preferences, I had to do: dpkg -L snapd | while read f do cat /dev/null > "$f" done I wonder how this kind of nonsense percolates through a company? Is it developers from commercial software vendors changing jobs and solving the problems the same way they solved them for other corporate customers? Or is it marketing carefully plotting a release by release path to dominance? Or is it people who truly believe that having a viable market for linux software will be good? I mean, there might be some truths - people lag with their updates, people don't defend their privacy, and people would like to pay for software but have no avenue to do so. But accepting those truths and unilaterally forcing "solutions" might find linux is a different sort of animal.

guug 6y ago
I was aware of `motd_news` and disable it on each new install, but I somehow completely missed `apport` and `kerneloops`. Trying to keep up with Canonical's attempts is why I switched all my new systems to Debian. Far more stable and predictable.
dcow 6y ago
I think there’s a proliferation of well meaning but ultimately _uncultured_ developers (perhaps some are lazy, but I don‘t think that’s the main problem). It’s almost inevitable as software, and internet culture, has itself proliferated. Seeing how businesses make decisions with such abysmal disregard for anything that puts users in control probably only serves to normalize the mentality further. But at the end if the day the problem really is that people don’t speak with their feet. I find it darkly humorous when someone complains about online privacy yet in the next sentence verbs _google_ or is still using their gmail from 15 years ago or hasn't switched to a privacy respecting browser or would never consider a librem device because it has previous gen specs. Software that gives users freedom and respects their privacy is not the default. Good software is hard to find. Too often software is measured solely on how good it looks as an electron app. So how about the next time you hear someone raking the GPL through the mud you help educate them. If you encounter a business leader deciding to cookie everyone because it lets them target the CISO of Oracle with personalized crafted ads, refuse to acquiesce. Not only donate to the EFF but actually participle. When asked what to do about the widening software culture gap at BSides SF, John Perry Barlow reminded everyone that education is the only real solution.

kikoreis 6y ago

It's probably not a surprise to you, but this is a hotly debated topic inside Canonical. And I apologize for that thread, as it really doesn't represent our best attempt at external debate. Changing a paradigm usually involves pushing the envelope and breaking some existing assumptions; systemd is everybody's favorite example of that in the Linux world. The root of this issue with snaps is the trade-off between built-in security and user control. Some points to consider: 1. Browsers like FF and Chromium [on Windows] simply self-update, and disabling that requires configuration. So there is at least some precedent for taking the position that user applications should just update themselves. Server apps are more complex and are a strong argument counter to the existing behavior, as is the fact that many apps cannot be refreshed without user impact. 2. Ubuntu, since 16.04 LTS, ships with unattended-upgrades enabled, which means that for debian packages the default behavior is already auto-updating (although automated reboots are not enabled by default, as that would be crazy for the general purpose case). That feels like the correct default, too, given the risk of running code exposed to exploitable, public CVEs — and how reluctant users (like my dad and my wife!) are to click on "Install now" in the update-manager dialog. 3. Debian package updates run as root. Snap updates run in userspace, and confined. So in principle the risk exposure for snap updates is much smaller. And snaps do have an auto-rollback mechanism for failed updates [a]. Counter to that argument is the fact that snaps are meant to be under third-party control, and that there is no clear mechanism to separate security patches vs updates which you get with the debian pocket mechanism (i.e. focal-security vs focal-updates). The lack of any official [b] means of user control over the snap auto-update mechanism feels wrong to many of us, including me. And while we may seem somewhat opaque in these debates, the feedback we get in threads like this one (and the snapcraft.io one) actually feeds into our decision making. So please do keep pushing on this topic and we'll do our part internally. [a] See https://kyrofa.com/posts/snap-updates-automatic-rollbacks https://kyrofa.com/posts/snap-updates-automatic-rollbacks for a detailed guide on this topic. Of course, if your snap refreshes and you hate the new version, downgrading isn't quite always possible. [b] There are ways to, hmmm, control auto-updating (i.e. refresh.metered, refresh.hold) if you really want to; that thread has a few. That doesn't help the debate, but I'm sharing in case someone has a technical need for it.

koolba 6y ago

heavyset_go 6y ago

This attitude extends to other areas of the project, like the fact that you can't move or rename ~/snap. Developers don't care that not only are there users who would like to be able change it, but that there is a freedesktop.org spec that they aren't following.