5 ms·

Am I the only person who actually doesn't really mind that flatpaks and snaps have less user-control over behavior and/or security implications? I really enjoy

Am I the only person who actually doesn't really mind that flatpaks and snaps have less user-control over behavior and/or security implications? I really enjoy them. Install it, forget about it, let it update automatically. Theoretically could something unwanted happen, yeah probably, but I enjoy the convenience they provide and typically you're installing fairly well-known software (Microk8s, VS Code, and Chromium come to mind). My one gripe with snaps is that AppArmor can occasionally cause headaches with Microk8s permissions.

monadic2 6y ago
I just wish they separated out the functionality of app portability, app sandboxing, and app installation. It’s much less debuggable and comprehensible packaged together. Kind of reminds me of systemd, actually.
- viraptor 6y ago
  I don't think you can separate sandboxing and installation. Any nontrivial and useful sandboxing relies heavily on how / where the app lives and how it communicates with the world. This includes things like dbus paths too, not just file paths.
  - monadic2 6y ago
    Well, it’s a problem the floss community will have to deal with sooner or later—it feels pretty awkwardly papered over with snap.
    - viraptor 6y ago
      The other way is to rely on labels rather than names. But I don't see every distro switching to selinux with per-flatpak/snap policies, so it's going to be have to be joined installation and sandboxing.
      - monadic2 6y ago
        Err, I'm still having issues grasping the problem—why not just enforce portable installation and locally writable files? There's no reason user-facing apps need to be installed to anything other than a subdirectory of home, there's no reason to locate the app resources anywhere but as a subdirectory of the app installation, and the XDG filesystem standards for writing seem pretty solid at this point. You could then restrict all access by default and just prompt when it attempts to use a resource.
shard972 6y ago
I too enjoy windows update.
the_pwner224 6y ago
> I really enjoy them. Install it, forget about it, let it update automatically. This is the same thing that happens when installing from the distribution's package manager? I install it, forget about it, and run the update command whenever I remember, once every few weeks. The amount of available software depends on your distribution, but on Arch practically everything is available in the official repositories or the user repositories. And when security issues are fixed, updating my system fixes them for all applications instead of just the ones which update their flatpaks (and from the article, it seems like many don't).
- sanxiyn 6y ago
  > And when security issues are fixed, updating my system fixes them for all applications instead of just the ones which update their flatpaks (and from the article, it seems like many don't). That is an ideal, the reality is somewhat different. It takes constant effort to ensure this. See https://wiki.debian.org/EmbeddedCopies https://wiki.debian.org/EmbeddedCopies for details.
  - waheoo 6y ago
    Flatpak has that same problem?
    - eitland 6y ago
      I guess with Flatpack it is the responsibility of producer of the package. With apt/yum/etc it is the responsibility of the distro maintainers to package it.
      - wahern 6y ago
        And which one of them has a better track record pushing out security fixes, especially for older software? Containers are a security nightmare because developers tend to have a release-and-forget mindset. Packagers are the ones doing the thankless work of constantly tracking issues, backporting fixes, dealing with dependency issues, etc. Take the packagers out of the equation and the result will be entirely predictable--much more stale software sitting on the hard drives of oblivious users, just as we see with containers.
vorpalhex 6y ago
I was originally very hopeful for snaps, but my experiences with them have been consistently painful. Whether that's due to a fundamental issue, or just a new ecosystem that hasn't matured yet is beyond me.
lmm 6y ago
If you don't care about user control, why would you be using Linux at all? When you hit a bug in a flatpak or snap, what are you going to do? E.g. on Linux you now just can't input Japanese text in Slack and there's no way to fix this.
- Legogris 6y ago
  > E.g. on Linux you now just can't input Japanese text in Slack and there's no way to fix this. Say what
- anthk 6y ago
  fcitx, ibus...
- lboc 6y ago
  Could you elaborate on the Slack-Linux-Japanese thing please? I have no problems with it, and was wondering if maybe an update broke it?
  - lmm 6y ago
    See e.g. https://forum.snapcraft.io/t/cant-use-input-method-in-snap-apps/4712/50 https://forum.snapcraft.io/t/cant-use-input-method-in-snap-a... . Certainly it was broken for years, and if it's been fixed then that's only very recently.
- gavinray 6y ago
  > If you don't care about user control, why would you be using Linux at all? I mean, that isn't what I said necessarily. I use Linux because Windows is bloated, slow garbage and OSx is crippled, locked-down Linux with a UI I'm none too fond of. I'm not a power-user. I run Ubuntu with i3, that's about the depths of my linux-wizardry. > When you hit a bug in a flatpak or snap, what are you going to do? Install the apt repo or build from source I suppose?

monadic2 6y ago

I just wish they separated out the functionality of app portability, app sandboxing, and app installation. It’s much less debuggable and comprehensible packaged together. Kind of reminds me of systemd, actually.

viraptor 6y ago
I don't think you can separate sandboxing and installation. Any nontrivial and useful sandboxing relies heavily on how / where the app lives and how it communicates with the world. This includes things like dbus paths too, not just file paths.
- monadic2 6y ago
  Well, it’s a problem the floss community will have to deal with sooner or later—it feels pretty awkwardly papered over with snap.
  - viraptor 6y ago
    The other way is to rely on labels rather than names. But I don't see every distro switching to selinux with per-flatpak/snap policies, so it's going to be have to be joined installation and sandboxing.
    - monadic2 6y ago
      Err, I'm still having issues grasping the problem—why not just enforce portable installation and locally writable files? There's no reason user-facing apps need to be installed to anything other than a subdirectory of home, there's no reason to locate the app resources anywhere but as a subdirectory of the app installation, and the XDG filesystem standards for writing seem pretty solid at this point. You could then restrict all access by default and just prompt when it attempts to use a resource.

shard972 6y ago

I too enjoy windows update.

the_pwner224 6y ago

> I really enjoy them. Install it, forget about it, let it update automatically. This is the same thing that happens when installing from the distribution's package manager? I install it, forget about it, and run the update command whenever I remember, once every few weeks. The amount of available software depends on your distribution, but on Arch practically everything is available in the official repositories or the user repositories. And when security issues are fixed, updating my system fixes them for all applications instead of just the ones which update their flatpaks (and from the article, it seems like many don't).

sanxiyn 6y ago
> And when security issues are fixed, updating my system fixes them for all applications instead of just the ones which update their flatpaks (and from the article, it seems like many don't). That is an ideal, the reality is somewhat different. It takes constant effort to ensure this. See https://wiki.debian.org/EmbeddedCopies https://wiki.debian.org/EmbeddedCopies for details.
- waheoo 6y ago
  Flatpak has that same problem?
  - eitland 6y ago
    I guess with Flatpack it is the responsibility of producer of the package. With apt/yum/etc it is the responsibility of the distro maintainers to package it.
    - wahern 6y ago
      And which one of them has a better track record pushing out security fixes, especially for older software? Containers are a security nightmare because developers tend to have a release-and-forget mindset. Packagers are the ones doing the thankless work of constantly tracking issues, backporting fixes, dealing with dependency issues, etc. Take the packagers out of the equation and the result will be entirely predictable--much more stale software sitting on the hard drives of oblivious users, just as we see with containers.

vorpalhex 6y ago

I was originally very hopeful for snaps, but my experiences with them have been consistently painful. Whether that's due to a fundamental issue, or just a new ecosystem that hasn't matured yet is beyond me.

lmm 6y ago

If you don't care about user control, why would you be using Linux at all? When you hit a bug in a flatpak or snap, what are you going to do? E.g. on Linux you now just can't input Japanese text in Slack and there's no way to fix this.

Legogris 6y ago
> E.g. on Linux you now just can't input Japanese text in Slack and there's no way to fix this. Say what
anthk 6y ago
fcitx, ibus...
lboc 6y ago
Could you elaborate on the Slack-Linux-Japanese thing please? I have no problems with it, and was wondering if maybe an update broke it?
- lmm 6y ago
  See e.g. https://forum.snapcraft.io/t/cant-use-input-method-in-snap-apps/4712/50 https://forum.snapcraft.io/t/cant-use-input-method-in-snap-a... . Certainly it was broken for years, and if it's been fixed then that's only very recently.
gavinray 6y ago
> If you don't care about user control, why would you be using Linux at all? I mean, that isn't what I said necessarily. I use Linux because Windows is bloated, slow garbage and OSx is crippled, locked-down Linux with a UI I'm none too fond of. I'm not a power-user. I run Ubuntu with i3, that's about the depths of my linux-wizardry. > When you hit a bug in a flatpak or snap, what are you going to do? Install the apt repo or build from source I suppose?