4 ms·
While I understand the concerns over Snap, you can't blame Canonical for trying, because lets be honest, rpm/deb packages are a mess. I see in the comments a c
by bad_user 6y ago
While I understand the concerns over Snap, you can't blame Canonical for trying, because lets be honest, rpm/deb packages are a mess.
I see in the comments a complaint that you don't want the developers upgrading their apps whenever they want ... really? Because that's my number one complaint for debs/rpms too. You can't install specific versions, you can't install multiple versions side by side and installing a newer version of one package can break your system due to its dependencies. Snaps can't possibly be worse than this and they aren't.
And on the server-side I understand wanting to review each updated package, but on your laptop, how often does one do that anyway?
For the general population automatic upgrades are a net win. The same moaning happened when Firefox switched, following Chrome, to automatic updates and fast releases and people now love that, including me. You trusted the app developers as soon as you installed that app on your computer with full privileges. And most apps don't have reproducible builds, even if the app is open source, trusting the binary you're installing is also a leap of faith. Unless the OS can sandbox that app, installing any app is about trust in a brand and faith. And debs aren't sandboxed.
When I switched to MacOS, 6 years ago, I missed Ubuntu's repository, I hated Homebrew, I hated installing apps by copying them from volumes mounted from .dmg files. But not anymore. I rarely have issues now. Experience could be improved of course, I sometimes want versioning, I want reproducible environments, which is why I'm experimenting with Nix (see https://nixos.org/ https://nixos.org/). The first thing I did on a fresh Ubuntu 18.04 LTS box, couple of months back? I searched for "Firefox Developer Edition" and failed to find a PPA for it or a beta channel that seems to be up to date.
Speaking of which, people complain about Snap being insecure, however I've never seen an Ubuntu/Debian workstation that doesn't make use of insecure PPAs.
Also packaging apps via DEB files is hard. I tried building DEBs for my server-side apps, but unless the process is automated via tools that are not language/platform agnostic, I found it hard, with documentation severely lacking.
---
This is one big reason for why Docker is now the preferred distribution mechanism for self-hosted apps on Linux servers. It's very easy to create a Dockerfile and the result won't infect your system with crap.
I have yet to try out Snaps, maybe some of the critiques are warranted, but it can't possibly be worse than the status quo. The only problem, a major one, is that yet again we've got no agreement between vendors. But that's sadly the Linux ecosystem, a genuine Tower of Babel.
- progval 6y ago> You trusted the app developers as soon as you installed that app on your computer with full privileges. No, I don't. First, most apps' code won't run as root. Only install scripts, written my distribution's maintainers, run as root (except for core applications, of course). And secondly, I trust app developers to write their app properly (to a certain extent), but not to write install scripts that won't mess with my system, because it's outside their domain of expertise.
- takluyver 6y agoOn a personal computer, you are giving a whole lot of trust to anything you run un-sandboxed as your normal user - it will likely have access to your most interesting files, browser cookies, maybe saved passwords. XKCD covered it years back: https://xkcd.com/1200/ https://xkcd.com/1200/ This brings up another drawback of deb/rpm packaging, though: you need root access to install anything. I'm not sure about Snap, but Flatpaks can be installed and used by an individual user.
- simosx 6y agoIf you first run snap login then you can install snaps without "sudo". I suppose it is the same process with flatpaks.
- takluyver 6y agoGood to know. Flatpak doesn't have a separate step, but there's a --user option for the install command.
- dTal 6y agoNot to mention that 99% of desktop Linux installs are trivially pwnable with: echo 'alias sudo="sudo touch /evil && sudo' >> ~/.bashrc
- rlpb 6y ago> Only install scripts, written my distribution's maintainers, run as root (except for core applications, of course). Install Chromium on Linux Mint and you'll have code run as root that is not written by your distribution's maintainers. Because Mint won't ship the snap, and nor are they shipping a deb that they maintain. You'll have to install a third party deb or equivalent.