3 ms·

The point isn't that the devs are the ones doing the auditing, even though pretty much everything that lives in DEB and RPM repos has maintainers which do. The

The point isn't that the devs are the ones doing the auditing, even though pretty much everything that lives in DEB and RPM repos has maintainers which do. The point is that you can audit without having to depend on a third party. Nobody's claiming audits are free or that they're assumed. The point is that you have the option to choose to trust as much or as little of the build chain, from the compiler to the target code to the artifacts.

simion314 6y ago
let me clear some things up and tell me if I am wrong, link me to the correction and I will apologize. - Mint uses Ubuntu repositories - Canonical pushes the changes they want into this repos, this changes are probably done by scripts that build source code on Canonical servers. - the Ubuntu repos also contain binary blobs - when a Mint user does an update he gets the binary directly from Canonical servers, there is no Mint dev or Mint script that does any check to see if for example the evil Canonical modified the NVIDIA driver and added even more evil in it then already is Now explain to me if all the above is true why would someone that does not trust Canonical would use Mint? There is no safety checks to prevent evil Canonical people do evil things. My conclusion is if you don't trust Canonical don't use Mint. Maybe Mint is working on addressing this and soon we will see an PR campaign that announces they are finally able to self host but until then I would stop the hypocrisy about not trusting Canonical. (Btw there are many smaller distros that can host their own repos, not sure why Mint is not doing it)
- Daishiman 6y ago
  The differences are the following: * Nonfree software is generally demarcated as such. There is nonfree software that has available source (in the case of some codecs), other that comes as blobs. * The Chromium package is open source, and in most distros comes as binary built from the toolchain set up by the package maintainers. In all free software distros if you don't want to download the binary, you can download the source and build locally with the provided build scripts (in the case of most APT packages in Debian/ubuntu). * Serving Chromium binaries with Snap removes the option of downloading, inspecting, and running the build chain locally * Serving a different version of Chromium, or replacing the stock version with a different variety, cannot be done without creating a new Snap repository. Downstream distros like Mint need to replace some of the stock Ubuntu stuff, just like Ubuntu changes stock Debian packages * Because there is no open source Snap repository software, Mint is unable to set up an alternative repo that could work around some of the objections they have with Ubuntu.
  - simion314 6y ago
    You are making my point, the "trust" is not the issue , the issue is "control". Canonical has the control on the snap store and Mint can insert their customization on top. Again, if Canonical is evil and can't be trusted why I would run Mint? Do the developers run any scripts to alert me if Canonical slips some bad thing in a binary? I think is fine if they remove snaps but IMO is stupid to accuse Canonical to be evil and not trustworthy while you blindly trust their repos.
    - tdsamardzhiev 6y ago
      > Again, if Canonical is evil and can't be trusted why I would run Mint? Rational self-interest. I don't think the tech giants are good for society, but not working with them would mean slipping into irrelevance. Say, I'm a game developer. Do I trust Microsoft? No. Do I sacrifice 90% of my profit to boycott Windows? No. There are different degrees of "evilness", and the scale does matter, too.
      - simion314 6y ago
        But you can keep compatibility with Ubuntu if you want by using the same code but keeping control, Honestly tell me if this does not sound idiotic "Microsoft is evil and we don't trust them, please run our own Windows copy that is the exact same thing but with different colors, MS can push an update and delete all your files because this is not a supported configuration and we have no scripts to check for it but we are not competent enough to setup our own repos and scripts like other distress" I understand why Mint does what it does, the only idiotic part is complaining about trust in Canonical.
  - rlpb 6y ago
    > * Nonfree software is generally demarcated as such. There is nonfree software that has available source (in the case of some codecs), other that comes as blobs. This is the same in apt as it is in the Snap Store. Compare https://snapcraft.io/chromium https://snapcraft.io/chromium to https://snapcraft.io/spotify https://snapcraft.io/spotify for example: the license field is clearly presented there. > * The Chromium package is open source, and in most distros comes as binary built from the toolchain set up by the package maintainers. In all free software distros if you don't want to download the binary, you can download the source and build locally with the provided build scripts (in the case of most APT packages in Debian/ubuntu). Also true for the Chromium snap (see next item for details). > * Serving Chromium binaries with Snap removes the option of downloading, inspecting, and running the build chain locally This is outright false. The Snap Store page for Chromium is available here: https://snapcraft.io/chromium https://snapcraft.io/chromium. It links to the source, which is the git repository here: https://code.launchpad.net/~chromium-team/chromium-browser/+git/snap-from-source https://code.launchpad.net/~chromium-team/chromium-browser/+.... You can use these source together with snapcraft (which is Free Software, licensed under GPL-3.0) to download, inspect and run the build chain locally, including with any modifications that you want to make. You'll get a snap package as output, which you are free to distribute and other users can install it using the snap CLI. > * Serving a different version of Chromium, or replacing the stock version with a different variety, cannot be done without creating a new Snap repository. Partly false. You can ship a different version of Chromium in the Snap Store under a different name. This is an automated process, rather like creating a PPA. As long as you aren't misleading anyone and you follow the terms of the relevant licenses[1], nobody will stop you. > * Because there is no open source Snap repository software, Mint is unable to set up an alternative repo that could work around some of the objections they have with Ubuntu. Partly correct. One generally cited reason for this is that the same criticism was leveled at Launchpad which was opened in response - but nobody is running an alternative production of Launchpad anywhere so Canonical doesn't want to waste that sort of effort again. Another is that store fragmentation is bad. I'm just stating the other side's position here. Please don't shoot the messenger. [1] Chromium's licenses are listed as: Apache-2.0 AND BSD-3-Clause AND LGPL-2.0 AND LGPL-2.1 AND MIT AND MS-PL AND (GPL-2.0+ OR LGPL-2.1+ OR MPL-1.1)
- 8bitsrule 6y ago
  >when a Mint user does an update he gets the binary directly from Canonical servers When I update Mint binaries, I get them from one of about 30 mirrors which Mint enables me to choose. (Or it will decide for me based on speed.) Do the mirrors at Clarkson, Harvard, Purdue, UW, etc belong to Canonical? I think not. Nor does most of the code the binaries are built from. Canonical has made its choice, Clem's made his.
  - simion314 6y ago
    Mirrors are just mirrors, they are not build farms that build from source. I would convert the next sentence in math logic and prove you that it makes no sense but not sure you can understand the symbols so let me try again in English. 1 Mint does not trust Canonical 2 Mint plugs their users systems directly to Canonical untrustworthy repos to run possible "evil" binaries and scripts as root. if 1 and 2 are true then as a user you should not use Mint, as a Mint developer you should start working and finally create an independent distribution. IMO 1 is false, probably they mentioning "trust" was a mistake.

simion314 6y ago

let me clear some things up and tell me if I am wrong, link me to the correction and I will apologize. - Mint uses Ubuntu repositories - Canonical pushes the changes they want into this repos, this changes are probably done by scripts that build source code on Canonical servers. - the Ubuntu repos also contain binary blobs - when a Mint user does an update he gets the binary directly from Canonical servers, there is no Mint dev or Mint script that does any check to see if for example the evil Canonical modified the NVIDIA driver and added even more evil in it then already is Now explain to me if all the above is true why would someone that does not trust Canonical would use Mint? There is no safety checks to prevent evil Canonical people do evil things. My conclusion is if you don't trust Canonical don't use Mint. Maybe Mint is working on addressing this and soon we will see an PR campaign that announces they are finally able to self host but until then I would stop the hypocrisy about not trusting Canonical. (Btw there are many smaller distros that can host their own repos, not sure why Mint is not doing it)

Daishiman 6y ago
The differences are the following: * Nonfree software is generally demarcated as such. There is nonfree software that has available source (in the case of some codecs), other that comes as blobs. * The Chromium package is open source, and in most distros comes as binary built from the toolchain set up by the package maintainers. In all free software distros if you don't want to download the binary, you can download the source and build locally with the provided build scripts (in the case of most APT packages in Debian/ubuntu). * Serving Chromium binaries with Snap removes the option of downloading, inspecting, and running the build chain locally * Serving a different version of Chromium, or replacing the stock version with a different variety, cannot be done without creating a new Snap repository. Downstream distros like Mint need to replace some of the stock Ubuntu stuff, just like Ubuntu changes stock Debian packages * Because there is no open source Snap repository software, Mint is unable to set up an alternative repo that could work around some of the objections they have with Ubuntu.
- simion314 6y ago
  You are making my point, the "trust" is not the issue , the issue is "control". Canonical has the control on the snap store and Mint can insert their customization on top. Again, if Canonical is evil and can't be trusted why I would run Mint? Do the developers run any scripts to alert me if Canonical slips some bad thing in a binary? I think is fine if they remove snaps but IMO is stupid to accuse Canonical to be evil and not trustworthy while you blindly trust their repos.
  - tdsamardzhiev 6y ago
    > Again, if Canonical is evil and can't be trusted why I would run Mint? Rational self-interest. I don't think the tech giants are good for society, but not working with them would mean slipping into irrelevance. Say, I'm a game developer. Do I trust Microsoft? No. Do I sacrifice 90% of my profit to boycott Windows? No. There are different degrees of "evilness", and the scale does matter, too.
    - simion314 6y ago
      But you can keep compatibility with Ubuntu if you want by using the same code but keeping control, Honestly tell me if this does not sound idiotic "Microsoft is evil and we don't trust them, please run our own Windows copy that is the exact same thing but with different colors, MS can push an update and delete all your files because this is not a supported configuration and we have no scripts to check for it but we are not competent enough to setup our own repos and scripts like other distress" I understand why Mint does what it does, the only idiotic part is complaining about trust in Canonical.
- rlpb 6y ago
  > * Nonfree software is generally demarcated as such. There is nonfree software that has available source (in the case of some codecs), other that comes as blobs. This is the same in apt as it is in the Snap Store. Compare https://snapcraft.io/chromium https://snapcraft.io/chromium to https://snapcraft.io/spotify https://snapcraft.io/spotify for example: the license field is clearly presented there. > * The Chromium package is open source, and in most distros comes as binary built from the toolchain set up by the package maintainers. In all free software distros if you don't want to download the binary, you can download the source and build locally with the provided build scripts (in the case of most APT packages in Debian/ubuntu). Also true for the Chromium snap (see next item for details). > * Serving Chromium binaries with Snap removes the option of downloading, inspecting, and running the build chain locally This is outright false. The Snap Store page for Chromium is available here: https://snapcraft.io/chromium https://snapcraft.io/chromium. It links to the source, which is the git repository here: https://code.launchpad.net/~chromium-team/chromium-browser/+git/snap-from-source https://code.launchpad.net/~chromium-team/chromium-browser/+.... You can use these source together with snapcraft (which is Free Software, licensed under GPL-3.0) to download, inspect and run the build chain locally, including with any modifications that you want to make. You'll get a snap package as output, which you are free to distribute and other users can install it using the snap CLI. > * Serving a different version of Chromium, or replacing the stock version with a different variety, cannot be done without creating a new Snap repository. Partly false. You can ship a different version of Chromium in the Snap Store under a different name. This is an automated process, rather like creating a PPA. As long as you aren't misleading anyone and you follow the terms of the relevant licenses[1], nobody will stop you. > * Because there is no open source Snap repository software, Mint is unable to set up an alternative repo that could work around some of the objections they have with Ubuntu. Partly correct. One generally cited reason for this is that the same criticism was leveled at Launchpad which was opened in response - but nobody is running an alternative production of Launchpad anywhere so Canonical doesn't want to waste that sort of effort again. Another is that store fragmentation is bad. I'm just stating the other side's position here. Please don't shoot the messenger. [1] Chromium's licenses are listed as: Apache-2.0 AND BSD-3-Clause AND LGPL-2.0 AND LGPL-2.1 AND MIT AND MS-PL AND (GPL-2.0+ OR LGPL-2.1+ OR MPL-1.1)
8bitsrule 6y ago
>when a Mint user does an update he gets the binary directly from Canonical servers When I update Mint binaries, I get them from one of about 30 mirrors which Mint enables me to choose. (Or it will decide for me based on speed.) Do the mirrors at Clarkson, Harvard, Purdue, UW, etc belong to Canonical? I think not. Nor does most of the code the binaries are built from. Canonical has made its choice, Clem's made his.
- simion314 6y ago
  Mirrors are just mirrors, they are not build farms that build from source. I would convert the next sentence in math logic and prove you that it makes no sense but not sure you can understand the symbols so let me try again in English. 1 Mint does not trust Canonical 2 Mint plugs their users systems directly to Canonical untrustworthy repos to run possible "evil" binaries and scripts as root. if 1 and 2 are true then as a user you should not use Mint, as a Mint developer you should start working and finally create an independent distribution. IMO 1 is false, probably they mentioning "trust" was a mistake.