5 ms·

> I really enjoy them. Install it, forget about it, let it update automatically. This is the same thing that happens when installing from the distribution's pa

> I really enjoy them. Install it, forget about it, let it update automatically. This is the same thing that happens when installing from the distribution's package manager? I install it, forget about it, and run the update command whenever I remember, once every few weeks. The amount of available software depends on your distribution, but on Arch practically everything is available in the official repositories or the user repositories. And when security issues are fixed, updating my system fixes them for all applications instead of just the ones which update their flatpaks (and from the article, it seems like many don't).

sanxiyn 6y ago
> And when security issues are fixed, updating my system fixes them for all applications instead of just the ones which update their flatpaks (and from the article, it seems like many don't). That is an ideal, the reality is somewhat different. It takes constant effort to ensure this. See https://wiki.debian.org/EmbeddedCopies https://wiki.debian.org/EmbeddedCopies for details.
- waheoo 6y ago
  Flatpak has that same problem?
  - eitland 6y ago
    I guess with Flatpack it is the responsibility of producer of the package. With apt/yum/etc it is the responsibility of the distro maintainers to package it.
    - wahern 6y ago
      And which one of them has a better track record pushing out security fixes, especially for older software? Containers are a security nightmare because developers tend to have a release-and-forget mindset. Packagers are the ones doing the thankless work of constantly tracking issues, backporting fixes, dealing with dependency issues, etc. Take the packagers out of the equation and the result will be entirely predictable--much more stale software sitting on the hard drives of oblivious users, just as we see with containers.
      - eitland 6y ago
        > And which one of them has a better track record pushing out security fixes, especially for older software? Why the question? I was only trying to state what I think is fact, not sell one approach or another.
      - wander_homer 6y ago
        Which distribution provides security updates for all their packages for let's say three or five years? Debian Stable has exceptions, so does Ubuntu and it also makes a huge distinction for thousands of packages in the Universe repository, which for the most part don't get any support at all. Fedora releases are AFAIK only supported for a year or two. And then you also get the issue of bugs that are actually security issues, but weren't labeled/identified as such, and therefore never get fixed in those stable distributions.
        occamrazor 6y ago
        RHEL and CentOS have 5 years of updates for their core packages.
        wander_homer 6y ago
        According to their git repository[1] the last time they updated the WebKitGTK library was half a year ago. In the meantime there have been multiple upstream releases, fixing multiple security vulnerabilities[2-6]. Or does this git mirror not reflect the current state of the version they're shipping? [1] https://git.centos.org/rpms/webkit2gtk3/commits/c8 https://git.centos.org/rpms/webkit2gtk3/commits/c8 [2] https://webkitgtk.org/security/WSA-2020-0001.html https://webkitgtk.org/security/WSA-2020-0001.html [3] https://webkitgtk.org/security/WSA-2020-0002.html https://webkitgtk.org/security/WSA-2020-0002.html [4] https://webkitgtk.org/security/WSA-2020-0003.html https://webkitgtk.org/security/WSA-2020-0003.html [5] https://webkitgtk.org/security/WSA-2020-0004.html https://webkitgtk.org/security/WSA-2020-0004.html [6] https://webkitgtk.org/security/WSA-2020-0005.html https://webkitgtk.org/security/WSA-2020-0005.html
        6y ago
    - sirn 6y ago
      Flatpak has a package split into three parts: a program itself, a runtime, and a SDK. Runtime includes common libraries a program is usually required, and SDK includes a development counterpart of them. Flatpak program is pinned to a runtime version, e.g. org.freedesktop.Platform//18.08 (with 18.08 being a major version) of which receives security updates periodically. When user installed a package, Flatpak will install a program and its runtime to Flatpak directory. If a program only depends on libraries in a runtime (and not requiring any bundled dependencies) then packager won't need to worry about upgrading those libraries at all, as updating a runtime will update those dependencies.
- kelnos 6y ago
  Not sure why you'd cite that wiki page, as it describes how Debian maintainers should be removing embedded copies of dependencies and (if necessary) patching the software to use the system versions. Sure, it's not perfect, and some packages end up having embedded dependency copies, but that's a far cry from flatpak, where everything is an embedded copy, by design.
gavinray 6y ago
> and run the update command whenever I remember, once every few weeks. Yeah definitely, I just like not having to think about running the apt update commands. It's not a huge difference.
- smichel17 6y ago
  You can definitely set up automatic updates. I don't know the method off-hand but I've done it (on fedora) in the past.
- amaccuish 6y ago
  unattended-upgrades :)

sanxiyn 6y ago

> And when security issues are fixed, updating my system fixes them for all applications instead of just the ones which update their flatpaks (and from the article, it seems like many don't). That is an ideal, the reality is somewhat different. It takes constant effort to ensure this. See https://wiki.debian.org/EmbeddedCopies https://wiki.debian.org/EmbeddedCopies for details.

waheoo 6y ago
Flatpak has that same problem?
- eitland 6y ago
  I guess with Flatpack it is the responsibility of producer of the package. With apt/yum/etc it is the responsibility of the distro maintainers to package it.
  - wahern 6y ago
    And which one of them has a better track record pushing out security fixes, especially for older software? Containers are a security nightmare because developers tend to have a release-and-forget mindset. Packagers are the ones doing the thankless work of constantly tracking issues, backporting fixes, dealing with dependency issues, etc. Take the packagers out of the equation and the result will be entirely predictable--much more stale software sitting on the hard drives of oblivious users, just as we see with containers.
    - eitland 6y ago
      > And which one of them has a better track record pushing out security fixes, especially for older software? Why the question? I was only trying to state what I think is fact, not sell one approach or another.
    - wander_homer 6y ago
      Which distribution provides security updates for all their packages for let's say three or five years? Debian Stable has exceptions, so does Ubuntu and it also makes a huge distinction for thousands of packages in the Universe repository, which for the most part don't get any support at all. Fedora releases are AFAIK only supported for a year or two. And then you also get the issue of bugs that are actually security issues, but weren't labeled/identified as such, and therefore never get fixed in those stable distributions.
      - occamrazor 6y ago
        RHEL and CentOS have 5 years of updates for their core packages.
        wander_homer 6y ago
        According to their git repository[1] the last time they updated the WebKitGTK library was half a year ago. In the meantime there have been multiple upstream releases, fixing multiple security vulnerabilities[2-6]. Or does this git mirror not reflect the current state of the version they're shipping? [1] https://git.centos.org/rpms/webkit2gtk3/commits/c8 https://git.centos.org/rpms/webkit2gtk3/commits/c8 [2] https://webkitgtk.org/security/WSA-2020-0001.html https://webkitgtk.org/security/WSA-2020-0001.html [3] https://webkitgtk.org/security/WSA-2020-0002.html https://webkitgtk.org/security/WSA-2020-0002.html [4] https://webkitgtk.org/security/WSA-2020-0003.html https://webkitgtk.org/security/WSA-2020-0003.html [5] https://webkitgtk.org/security/WSA-2020-0004.html https://webkitgtk.org/security/WSA-2020-0004.html [6] https://webkitgtk.org/security/WSA-2020-0005.html https://webkitgtk.org/security/WSA-2020-0005.html
        6y ago
  - sirn 6y ago
    Flatpak has a package split into three parts: a program itself, a runtime, and a SDK. Runtime includes common libraries a program is usually required, and SDK includes a development counterpart of them. Flatpak program is pinned to a runtime version, e.g. org.freedesktop.Platform//18.08 (with 18.08 being a major version) of which receives security updates periodically. When user installed a package, Flatpak will install a program and its runtime to Flatpak directory. If a program only depends on libraries in a runtime (and not requiring any bundled dependencies) then packager won't need to worry about upgrading those libraries at all, as updating a runtime will update those dependencies.
kelnos 6y ago
Not sure why you'd cite that wiki page, as it describes how Debian maintainers should be removing embedded copies of dependencies and (if necessary) patching the software to use the system versions. Sure, it's not perfect, and some packages end up having embedded dependency copies, but that's a far cry from flatpak, where everything is an embedded copy, by design.

gavinray 6y ago

> and run the update command whenever I remember, once every few weeks. Yeah definitely, I just like not having to think about running the apt update commands. It's not a huge difference.

smichel17 6y ago
You can definitely set up automatic updates. I don't know the method off-hand but I've done it (on fedora) in the past.
amaccuish 6y ago
unattended-upgrades :)