4 ms·

Third-party apt repositories are a security nightmare: you are giving a third party unrestricted semi-silent root access to your computer. I can trust my distro

Third-party apt repositories are a security nightmare: you are giving a third party unrestricted semi-silent root access to your computer. I can trust my distro provider with this, but it should be strongly discouraged for third-parties. Instead, installing PPAs to get updated builds of standard packages seems considered “normal”. At least, this doesn’t hold true for snaps.

pdonis 6y ago
> I can trust my distro provider with this, but it should be strongly discouraged for third-parties. Again, it all depends on how much you trust the third party compared to how much you trust your distro provider. I don't have many third party PPAs installed on my computer because there aren't many third parties I trust that much. But there aren't zero either. Also, a big part of my trust of my distro provider is based on having source code forced to be open, and another big part is based on them not doing things behind my back. Snaps significantly erode both of these aspects of trust.
jen20 6y ago
> Instead, installing PPAs to get updated builds of standard packages seems considered “normal”. Perhaps we should consider why this is: because people want up-to-date software on their computers (desktop or server), instead of being beholden to whatever version distribution maintainers have decided you can have.
- erik_seaberg 6y ago
  If you don't want software that has been configured and tested to work together by a distro maintainer, you're volunteering to do that work yourself and become the sole maintainer of a bleeding-edge distro with a very small audience.
  - jen20 6y ago
    That's fine - and why I use macOS as a desktop: because Homebrew consistently gives me up-to-date versions of the software I want. If I were to use Linux on the desktop, it would be a distribution which also allows this with minimal fuss - almost certainly not a Debian derivative. I understand the _reasoning_ behind the distribution model - I just don't think it works very well, and apparently nor do all the people who use PPAs in the course of everyday use to get up-to-date software. It's also worth noting that FreeBSD does not have this problem - ports are updated _much_ more often than most Linux distributions seem to be.
    - petre 6y ago
      FreeBSD is pretty much a checkpointed rolling release.

pdonis 6y ago

> I can trust my distro provider with this, but it should be strongly discouraged for third-parties. Again, it all depends on how much you trust the third party compared to how much you trust your distro provider. I don't have many third party PPAs installed on my computer because there aren't many third parties I trust that much. But there aren't zero either. Also, a big part of my trust of my distro provider is based on having source code forced to be open, and another big part is based on them not doing things behind my back. Snaps significantly erode both of these aspects of trust.

jen20 6y ago

> Instead, installing PPAs to get updated builds of standard packages seems considered “normal”. Perhaps we should consider why this is: because people want up-to-date software on their computers (desktop or server), instead of being beholden to whatever version distribution maintainers have decided you can have.

erik_seaberg 6y ago
If you don't want software that has been configured and tested to work together by a distro maintainer, you're volunteering to do that work yourself and become the sole maintainer of a bleeding-edge distro with a very small audience.
- jen20 6y ago
  That's fine - and why I use macOS as a desktop: because Homebrew consistently gives me up-to-date versions of the software I want. If I were to use Linux on the desktop, it would be a distribution which also allows this with minimal fuss - almost certainly not a Debian derivative. I understand the _reasoning_ behind the distribution model - I just don't think it works very well, and apparently nor do all the people who use PPAs in the course of everyday use to get up-to-date software. It's also worth noting that FreeBSD does not have this problem - ports are updated _much_ more often than most Linux distributions seem to be.
  - petre 6y ago
    FreeBSD is pretty much a checkpointed rolling release.