4 ms·

As long as you can audit the source and build chain what's the problem?

simion314 6y ago
>As long as you can audit the source and build chain what's the problem? As long as Linux Mint developers are not doing that how it helps you? you don't trust Canonical binaries but you trust the deb binaries, you could be honest and claim that you don't like snap but you still trust the deb binaries.
- Daishiman 6y ago
  The point isn't that the devs are the ones doing the auditing, even though pretty much everything that lives in DEB and RPM repos has maintainers which do. The point is that you can audit without having to depend on a third party. Nobody's claiming audits are free or that they're assumed. The point is that you have the option to choose to trust as much or as little of the build chain, from the compiler to the target code to the artifacts.
  - simion314 6y ago
    let me clear some things up and tell me if I am wrong, link me to the correction and I will apologize. - Mint uses Ubuntu repositories - Canonical pushes the changes they want into this repos, this changes are probably done by scripts that build source code on Canonical servers. - the Ubuntu repos also contain binary blobs - when a Mint user does an update he gets the binary directly from Canonical servers, there is no Mint dev or Mint script that does any check to see if for example the evil Canonical modified the NVIDIA driver and added even more evil in it then already is Now explain to me if all the above is true why would someone that does not trust Canonical would use Mint? There is no safety checks to prevent evil Canonical people do evil things. My conclusion is if you don't trust Canonical don't use Mint. Maybe Mint is working on addressing this and soon we will see an PR campaign that announces they are finally able to self host but until then I would stop the hypocrisy about not trusting Canonical. (Btw there are many smaller distros that can host their own repos, not sure why Mint is not doing it)
    - Daishiman 6y ago
      The differences are the following: * Nonfree software is generally demarcated as such. There is nonfree software that has available source (in the case of some codecs), other that comes as blobs. * The Chromium package is open source, and in most distros comes as binary built from the toolchain set up by the package maintainers. In all free software distros if you don't want to download the binary, you can download the source and build locally with the provided build scripts (in the case of most APT packages in Debian/ubuntu). * Serving Chromium binaries with Snap removes the option of downloading, inspecting, and running the build chain locally * Serving a different version of Chromium, or replacing the stock version with a different variety, cannot be done without creating a new Snap repository. Downstream distros like Mint need to replace some of the stock Ubuntu stuff, just like Ubuntu changes stock Debian packages * Because there is no open source Snap repository software, Mint is unable to set up an alternative repo that could work around some of the objections they have with Ubuntu.
      - simion314 6y ago
        You are making my point, the "trust" is not the issue , the issue is "control". Canonical has the control on the snap store and Mint can insert their customization on top. Again, if Canonical is evil and can't be trusted why I would run Mint? Do the developers run any scripts to alert me if Canonical slips some bad thing in a binary? I think is fine if they remove snaps but IMO is stupid to accuse Canonical to be evil and not trustworthy while you blindly trust their repos.
        tdsamardzhiev 6y ago
        > Again, if Canonical is evil and can't be trusted why I would run Mint? Rational self-interest. I don't think the tech giants are good for society, but not working with them would mean slipping into irrelevance. Say, I'm a game developer. Do I trust Microsoft? No. Do I sacrifice 90% of my profit to boycott Windows? No. There are different degrees of "evilness", and the scale does matter, too.
        6y ago

>As long as you can audit the source and build chain what's the problem? As long as Linux Mint developers are not doing that how it helps you? you don't trust Canonical binaries but you trust the deb binaries, you could be honest and claim that you don't like snap but you still trust the deb binaries.

Daishiman 6y ago
The point isn't that the devs are the ones doing the auditing, even though pretty much everything that lives in DEB and RPM repos has maintainers which do. The point is that you can audit without having to depend on a third party. Nobody's claiming audits are free or that they're assumed. The point is that you have the option to choose to trust as much or as little of the build chain, from the compiler to the target code to the artifacts.
- simion314 6y ago
  let me clear some things up and tell me if I am wrong, link me to the correction and I will apologize. - Mint uses Ubuntu repositories - Canonical pushes the changes they want into this repos, this changes are probably done by scripts that build source code on Canonical servers. - the Ubuntu repos also contain binary blobs - when a Mint user does an update he gets the binary directly from Canonical servers, there is no Mint dev or Mint script that does any check to see if for example the evil Canonical modified the NVIDIA driver and added even more evil in it then already is Now explain to me if all the above is true why would someone that does not trust Canonical would use Mint? There is no safety checks to prevent evil Canonical people do evil things. My conclusion is if you don't trust Canonical don't use Mint. Maybe Mint is working on addressing this and soon we will see an PR campaign that announces they are finally able to self host but until then I would stop the hypocrisy about not trusting Canonical. (Btw there are many smaller distros that can host their own repos, not sure why Mint is not doing it)
  - Daishiman 6y ago
    The differences are the following: * Nonfree software is generally demarcated as such. There is nonfree software that has available source (in the case of some codecs), other that comes as blobs. * The Chromium package is open source, and in most distros comes as binary built from the toolchain set up by the package maintainers. In all free software distros if you don't want to download the binary, you can download the source and build locally with the provided build scripts (in the case of most APT packages in Debian/ubuntu). * Serving Chromium binaries with Snap removes the option of downloading, inspecting, and running the build chain locally * Serving a different version of Chromium, or replacing the stock version with a different variety, cannot be done without creating a new Snap repository. Downstream distros like Mint need to replace some of the stock Ubuntu stuff, just like Ubuntu changes stock Debian packages * Because there is no open source Snap repository software, Mint is unable to set up an alternative repo that could work around some of the objections they have with Ubuntu.
    - simion314 6y ago
      You are making my point, the "trust" is not the issue , the issue is "control". Canonical has the control on the snap store and Mint can insert their customization on top. Again, if Canonical is evil and can't be trusted why I would run Mint? Do the developers run any scripts to alert me if Canonical slips some bad thing in a binary? I think is fine if they remove snaps but IMO is stupid to accuse Canonical to be evil and not trustworthy while you blindly trust their repos.
      - tdsamardzhiev 6y ago
        > Again, if Canonical is evil and can't be trusted why I would run Mint? Rational self-interest. I don't think the tech giants are good for society, but not working with them would mean slipping into irrelevance. Say, I'm a game developer. Do I trust Microsoft? No. Do I sacrifice 90% of my profit to boycott Windows? No. There are different degrees of "evilness", and the scale does matter, too.
        6y ago