5 ms·

I dumped Ubuntu over Snap. Maybe I’m just ignorant but it seems like allowing developers to push software updates without any review invites the same sorts of i

I dumped Ubuntu over Snap. Maybe I’m just ignorant but it seems like allowing developers to push software updates without any review invites the same sorts of issues we’ve seen on npm, with very high risks for certain use cases. I don’t want that kind of relationship with my OS, forced updates are why I ditched Windows in the first place. Aside from the philosophical concerns I ran into a lot of glitches with various snap packages, frequently resulting in lost or corrupted data. And the sandbox approach prevented certain filesystem tweaking I previously took for granted. Overall I didn’t see the benefit and didn’t have time to futz with it. I’m curious if there are any distros with a recent version of Gnome and also a sane package manager.

schoolornot 6y ago
> forced updates are why I ditched Windows in the first place Samsung has followed suit w/ Android. Once an update is available, the user can defer it three times before the phone is rebooted. Not even Apple pulls this crap.
- deleted 6y ago
  [deleted]
- guug 6y ago
  As a short term solution, you can use netguard and always have it run in lockdown mode. It works on most phones and doesn't require root. You can use it to whitelist app access to the internet (inc. blocking samsung and google play updates). It's also open source. In the long term, just avoid samsung products that don't respect your authority as the owner.
techntoke 6y ago
Definitely try an Arch-based distro. I run Arch myself, but I've heard good things about Manjaro.
- henriquez 6y ago
  Doesn’t arch also allow arbitrary package upgrades straight from the developers? Again I’m pretty ignorant but my impression looking at it previously was there isn’t any sort of “peer review” by repo maintainers.
  - Sevaris 6y ago
    You're never forced to update. I'm don't even think Arch natively supports automatic updates. You can also tell pacman to skip a package from being updated if you're aware of a problematic update but you want to update the rest of your system. And yes, Arch takes in the upstream vanilla packages, though there are testing phases before updates reach stable repos. I'm not sure any of this is a bad thing. It also means you don't have to wait 6-12 months for the newest version.
    - dathinab 6y ago
      I think what he/she means is that core maintainers (or AUR maintainers) might be able to change a package without another core maintainer (or AUR maintainer) reviewing it.
      - Sevaris 6y ago
        Afaik, upstream packages aren't changed by Arch maintainers. It's the whole point of using Arch. And if you're using AUR, you'd better be checking the PKGBUILD (because no, it isn't verified by anybody). At the very least, you need to be checking where the package is being downloaded from.
        dathinab 6y ago
        The PKGBUILD of packages in the official repository can be changed, which people theoretically could use to inject malware. That's what I meant.
        deleted 6y ago
karatestomp 6y ago
Launch times and (silly, but it really bugged me) pollution of my `df` output drove me away.
- ahartmetz 6y ago
  Cluttering up df and mount output is a real problem. They are useful tools - cluttering their output makes them much less convenient / more time-consuming to use. I have about 8 mounts for snap and like 15 for cgroups here. And actually about 10 others that I don't remember seeing before at all. pstore? securityfs? tracefs? debugfs?
- bxparks 6y ago
  Yup, the output of df became so cluttered that it became useless. So I created this alias: > alias df='df -x tmpfs -x squashfs -x devtmpfs'
  - edoceo 6y ago
    Adding to my dotfiles, thx!
  - apple4ever 6y ago
    Oh my this is awesome! Thank you. So much better.
  - omertuchfeld 6y ago
    Here's one that doesn't hide the snaps but but still keeps it not cluttered (relies on ripgrep) : function df { OUTPUT=$(/usr/bin/df $@) snaps=$(echo ${OUTPUT} | rg "^.+/snap/(.+)/.+$" -r '$1' | tr '\n' ' ') printf "\x1b[33m\x1b[1mFILTERING SNAP MOUNTPOINTS:\x1b[0m\x1b[33m\n$snaps\x1b[0m\n\n" >&2 echo $OUTPUT | grep -v "/snap/" }
hamaluik 6y ago
I've been using Manjaro for about a year now, after also getting fed up with Ubuntu. It is based on Arch, but just as easy to set up and get running as Ubuntu. I find its package management sane enough for my day-to-day use, and though I install packages from all over I have yet to have anything break on me. I can definitely recommend it.
ccmcarey 6y ago
I dumped snapd because of the maintainers absolutely refusing to allow the users to customize the update schedule, or even disable automatic updates at all. Reading the thread with the discussion on it, seems there was real contempt towards letting the user decide not to update their packages.
- simosx 6y ago
  https://snapcraft.io/docs/keeping-snaps-up-to-date https://snapcraft.io/docs/keeping-snaps-up-to-date
  - SirYandi 6y ago
    I didn't see anything about completely disabling automatic updates there. Closest I could find was: "After a refresh, the next refresh can be delayed by up to 60 days, after which a refresh will be performed regardless of the refresh.hold value."
    - phatfish 6y ago
      With windows update the trick since MS enforced a similar update policy is to change the user the Windows Update service runs under to an account that doest have the required permissions. Not sure if that would work with Ubuntu though ;)
      - em-bee 6y ago
        i am surprised that this is possible under windows. for ubuntu, it should be possible to disable the daemon that runs the update checks. at worst by hacking a script where the process is started.
    - scoot_718 6y ago
      There's a solution you're not seeing https://ubuntu-mate.community/t/how-to-completely-remove-snap/19395 https://ubuntu-mate.community/t/how-to-completely-remove-sna...
somewhereoutth 6y ago
Mint!
simosx 6y ago
> Maybe I’m just ignorant but it seems like allowing developers to push software updates without any review When you create a snap package and post it to the Snap Store, you only get the default limited rights for your snap. For example, your application is not able to access external disks. But if your application has a real case to do so, then you need to request to have that access added to your snap.
beefbroccoli 6y ago
haven't had that issue for years with npm/yarn, thanks to lockfiles.
sergeykish 6y ago
It could be worse. Software push is how browser distribute extensions. And they are ridden with spyware [0]. Pull by maintainers, deferred rollout, veto and rollback might what saves us yet. [1] https://blocked.cdn.mozilla.net/ https://blocked.cdn.mozilla.net/

schoolornot 6y ago

> forced updates are why I ditched Windows in the first place Samsung has followed suit w/ Android. Once an update is available, the user can defer it three times before the phone is rebooted. Not even Apple pulls this crap.

deleted 6y ago
[deleted]
guug 6y ago
As a short term solution, you can use netguard and always have it run in lockdown mode. It works on most phones and doesn't require root. You can use it to whitelist app access to the internet (inc. blocking samsung and google play updates). It's also open source. In the long term, just avoid samsung products that don't respect your authority as the owner.

techntoke 6y ago

Definitely try an Arch-based distro. I run Arch myself, but I've heard good things about Manjaro.

henriquez 6y ago
Doesn’t arch also allow arbitrary package upgrades straight from the developers? Again I’m pretty ignorant but my impression looking at it previously was there isn’t any sort of “peer review” by repo maintainers.
- Sevaris 6y ago
  You're never forced to update. I'm don't even think Arch natively supports automatic updates. You can also tell pacman to skip a package from being updated if you're aware of a problematic update but you want to update the rest of your system. And yes, Arch takes in the upstream vanilla packages, though there are testing phases before updates reach stable repos. I'm not sure any of this is a bad thing. It also means you don't have to wait 6-12 months for the newest version.
  - dathinab 6y ago
    I think what he/she means is that core maintainers (or AUR maintainers) might be able to change a package without another core maintainer (or AUR maintainer) reviewing it.
    - Sevaris 6y ago
      Afaik, upstream packages aren't changed by Arch maintainers. It's the whole point of using Arch. And if you're using AUR, you'd better be checking the PKGBUILD (because no, it isn't verified by anybody). At the very least, you need to be checking where the package is being downloaded from.
      - dathinab 6y ago
        The PKGBUILD of packages in the official repository can be changed, which people theoretically could use to inject malware. That's what I meant.
        deleted 6y ago

karatestomp 6y ago

Launch times and (silly, but it really bugged me) pollution of my `df` output drove me away.

ahartmetz 6y ago
Cluttering up df and mount output is a real problem. They are useful tools - cluttering their output makes them much less convenient / more time-consuming to use. I have about 8 mounts for snap and like 15 for cgroups here. And actually about 10 others that I don't remember seeing before at all. pstore? securityfs? tracefs? debugfs?
bxparks 6y ago
Yup, the output of df became so cluttered that it became useless. So I created this alias: > alias df='df -x tmpfs -x squashfs -x devtmpfs'
- edoceo 6y ago
  Adding to my dotfiles, thx!
- apple4ever 6y ago
  Oh my this is awesome! Thank you. So much better.
- omertuchfeld 6y ago
  Here's one that doesn't hide the snaps but but still keeps it not cluttered (relies on ripgrep) : function df { OUTPUT=$(/usr/bin/df $@) snaps=$(echo ${OUTPUT} | rg "^.+/snap/(.+)/.+$" -r '$1' | tr '\n' ' ') printf "\x1b[33m\x1b[1mFILTERING SNAP MOUNTPOINTS:\x1b[0m\x1b[33m\n$snaps\x1b[0m\n\n" >&2 echo $OUTPUT | grep -v "/snap/" }

hamaluik 6y ago

I've been using Manjaro for about a year now, after also getting fed up with Ubuntu. It is based on Arch, but just as easy to set up and get running as Ubuntu. I find its package management sane enough for my day-to-day use, and though I install packages from all over I have yet to have anything break on me. I can definitely recommend it.

ccmcarey 6y ago

I dumped snapd because of the maintainers absolutely refusing to allow the users to customize the update schedule, or even disable automatic updates at all. Reading the thread with the discussion on it, seems there was real contempt towards letting the user decide not to update their packages.

simosx 6y ago
https://snapcraft.io/docs/keeping-snaps-up-to-date https://snapcraft.io/docs/keeping-snaps-up-to-date
- SirYandi 6y ago
  I didn't see anything about completely disabling automatic updates there. Closest I could find was: "After a refresh, the next refresh can be delayed by up to 60 days, after which a refresh will be performed regardless of the refresh.hold value."
  - phatfish 6y ago
    With windows update the trick since MS enforced a similar update policy is to change the user the Windows Update service runs under to an account that doest have the required permissions. Not sure if that would work with Ubuntu though ;)
    - em-bee 6y ago
      i am surprised that this is possible under windows. for ubuntu, it should be possible to disable the daemon that runs the update checks. at worst by hacking a script where the process is started.
  - scoot_718 6y ago
    There's a solution you're not seeing https://ubuntu-mate.community/t/how-to-completely-remove-snap/19395 https://ubuntu-mate.community/t/how-to-completely-remove-sna...

somewhereoutth 6y ago

Mint!

simosx 6y ago

> Maybe I’m just ignorant but it seems like allowing developers to push software updates without any review When you create a snap package and post it to the Snap Store, you only get the default limited rights for your snap. For example, your application is not able to access external disks. But if your application has a real case to do so, then you need to request to have that access added to your snap.

beefbroccoli 6y ago

haven't had that issue for years with npm/yarn, thanks to lockfiles.

sergeykish 6y ago

It could be worse. Software push is how browser distribute extensions. And they are ridden with spyware [0]. Pull by maintainers, deferred rollout, veto and rollback might what saves us yet. [1] https://blocked.cdn.mozilla.net/ https://blocked.cdn.mozilla.net/