5 ms·

My issues with the post start with the tone. It's not a respectful tone, rather aggressive and always flashes me back to people who write similar blogposts abou

by zaarn 6y ago

My issues with the post start with the tone. It's not a respectful tone, rather aggressive and always flashes me back to people who write similar blogposts about systemd or something else that is new but not accepted by greybeards yet. Fonts and theming are an issue, I agree, however, this isn't entirely the fault of the flatpak maintainers but in part the fault of a fragmented and hard-to-compose linux ecosystem when it comes to their configuration. The IME issue is a problem but I don't think a dynamically linked system would benefit much here. The solution is to make portals between flatpak and the system more extensible and versioned, so that an outside daemon an talk to flatpak apps and potentially flatpak could even try to determine which runtime to use based on what outside portal versions are available.

simias 6y ago
I skimmed the article and I don't find the tone super disrespectful. No ad-hominem, no insults to the developers etc... The backlash against systemd was unacceptable because it ended up targeting people and not the technology. Writing an init system shouldn't net you death threats. Beyond this, and not unlike systemd, flatpak has been pushed hard down people's throat by powerful entities within the ecosystem, so it's not surprising that in both cases there has been some intense backlash. I also personally think that in both cases it's warranted.
- shrewduser 6y ago
  I agree, how thin skinned are people? this seems like valid criticism that wasn't acted on in two years. What is an appropriate 'tone' in this case
  - chekovcodes 6y ago
    Tone is narcissistic and self-important - it does not even tip a hat to address prioritisation or resource constraints - it's just "this is important to me THEREFORE IT IS IMPORTANT, GNASH, WAIL". I also think the author does not understand end-user software - if you package everything up so it is very secure by default, almost nobody will ever use it and nobody will care except the people who are capable of securing it themselves.
  - cycloptic 6y ago
    An appropriate tone would be to press the angle that help is needed and either offer to help patch the applications or mention where contributors can get started. I get the author's concern but there is nothing useful in this article. It's misleading suggesting that the problem is with flatpak when the problem is that certain applications aren't using its full capabilities, aren't configured correctly and are in need patching. Or in the worst case, might need a redesign to fit the sandboxing model. This needs to happen with any sandbox that uses this model, not just flatpak. There is nothing else that can be done about this short of suggesting users switch to a different sandboxing model like Qubes. (Maybe the blog author can try that too and see how it goes, or could develop their own sandboxing model just to see how hard it is on a complex system like Linux)
    - dylan-m 6y ago
      As well as misleading, the article seems outdated? Which is weird, because archive.org's first snapshot of it is today. So, GNOME Software has included a "Permissions" field (which lists an application's specific sandbox holes) since - if I recall correctly - GNOME 3.34: https://i.imgur.com/lCGgA1B.png https://i.imgur.com/lCGgA1B.png. Not perfect, but definitely better than pictured. It's a bit of a shame that people have to use older versions of GNOME in 2020, but then, it's nice that Flatpak makes it easy to run new applications regardless :) Also, I was trying to verify the author's claim about a vulnerable libssh in the gitg package, partly because I was curious whether they'd bothered to report any of these issues upstream. Looks like that was fixed in May: https://github.com/flathub/org.gnome.gitg/pull/12 https://github.com/flathub/org.gnome.gitg/pull/12. Similar story with ffmpeg: https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/commit/d7d8582f750e1165fd3fd637f8fcb62104ede2c8 https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/commit/.... So, woefully behind schedule, but, how long was the author sitting on these? It would be more accurate, less irritating, and more persuasive if they simply talked about it after the fact: this happened, various things are wrong with it, it should be avoidable, etc.
      - frabbit 6y ago
        The first two CVEs linked in the article do not even exist: whether due to rejection or something else is uncertain.
- matthiasv 6y ago
  > Beyond this, and not unlike systemd, flatpak has been pushed hard down people's throat by powerful entities within the ecosystem, [...] Sounds like a tinfoil hat theory to me. Powerful entities? Pushed down people's throat? You are free to ignore Flatpak, no one is forcing it on anyone.
turbinerneiter 6y ago
It's hard to keep a civil tone if you feel like the world around you is descending into madness, and this is exactly what the authors of this posts feel. Its hard to have a civil discussion if everyone pulls into a direction you deem wrong and your words are never convincing anyone. I have similar resentments when people in my company push for docker on embedded systems, because they are used to docker on the server, and whenever I ask them which problem they are solving on the embedded system with docker, they describe things that are wrong. I don't share the authors strength of opinion on flatpak, although I see the same issues, and I don't want to advertise or excuse strong "tone" - but I understand the frustration.
- pjc50 6y ago
  > push for docker on embedded systems Aaargh! A particularly odd one as most embedded systems are handled as "images" of some sort - firmware blobs, ramdiscs, imaged HDDs for embedded PCs and so on.
- kanox 6y ago
  What exactly is wrong with docker on embedded systems? Many have the memory and storage to afford containers and existing established distros like yocto are not very good. I'd much rather deal with Dockerfiles than buildbake.
  - turbinerneiter 6y ago
    What is the problem docker solves?
  - Obsnold 6y ago
    Just to clarify yocto is not a distro but a project that allows you to create your own custom distro. Two yocto builds could be completely different from one another even using different package managers.
    - kanox 6y ago
      Yocto and various derivatives can be used to "build software" in the same way that Dockerfiles can be used to "build software" but using yocto is a much worse experience.
ylyn 6y ago
I don't see an issue with the tone. Actually, why are people so concerned about tone nowadays? It matters, but this is perfectly fine. I feel like you can't find anything to nitpick about the post, so you pick on the tone instead.
- zaarn 6y ago
  I've brought up issues beside tone because of this. In case those aren't enough; I think the issues brought up aren't issues with flatpak. The first issue is with a GUI application on top of flatpak and the second is a packaging issue of the runtimes. These aren't inherently problems with flatpak so I mentally don't count them.
  - steerablesafe 6y ago
    Don't forget lying about sandboxing.
    - dylan-m 6y ago
      Yeah, that's a dubious claim as well. Here is how GNOME Software presents a sandboxed application: https://i.imgur.com/VMsj6mk.png https://i.imgur.com/VMsj6mk.png Is it a bad interface? Sure. Is the list of permissions hard to find? Hell yes. Is the Sandboxed emblem kind of misleading? Yeah. But here (in at least GNOME Software 3.36) you see a list of the relevant permissions available to the application. Nobody is lying here. For contrast, here is an application with a stricter sandbox: https://i.imgur.com/lCGgA1B.png https://i.imgur.com/lCGgA1B.png The point here is both of these are sandboxed. Each sandbox just has particular holes in it. For GNU Octave, more than seems appropriate. Users misunderstand that in the same way people misunderstand "autopilot" and that's a good issue to bring up, but then I don't think non-technical users understand what "sandboxed" means anyway and technical users should be able to take one more gorramn step and learn that "sandboxed" obviously comes with particular limitations [at least in the present day] or it isn't going to do anything.
sergeykish 6y ago
You've skipped CVE. Flatpak has a lot of claims [1], author feels them as a lie. And he provides facts in support. Linux "next generation technology" would certainly alert users of insecure application. This does not. The story of themes and dbus shows how hard it is to contain all dependencies. Also there were a lot of claims here that Linux distributions makes no good, static linking is better and libraries would be patched. Now lets switch perspective. Windows users are perfectly fine running closed source software which may contain outdated dependencies. Most of them are not updated anyway. And it has gallery, something Winget still lacks. Looks like next gen. What is cry for open source developer may be fine for consumer. Personally I'm fine with Flatpak, Appimage. There should be some way to install proprietary software. And some starting point to make it safe. [1] https://flatpak.org/ https://flatpak.org/

by zaarn 6y ago

simias 6y ago

I skimmed the article and I don't find the tone super disrespectful. No ad-hominem, no insults to the developers etc... The backlash against systemd was unacceptable because it ended up targeting people and not the technology. Writing an init system shouldn't net you death threats. Beyond this, and not unlike systemd, flatpak has been pushed hard down people's throat by powerful entities within the ecosystem, so it's not surprising that in both cases there has been some intense backlash. I also personally think that in both cases it's warranted.

shrewduser 6y ago
I agree, how thin skinned are people? this seems like valid criticism that wasn't acted on in two years. What is an appropriate 'tone' in this case
- chekovcodes 6y ago
  Tone is narcissistic and self-important - it does not even tip a hat to address prioritisation or resource constraints - it's just "this is important to me THEREFORE IT IS IMPORTANT, GNASH, WAIL". I also think the author does not understand end-user software - if you package everything up so it is very secure by default, almost nobody will ever use it and nobody will care except the people who are capable of securing it themselves.
- cycloptic 6y ago
  An appropriate tone would be to press the angle that help is needed and either offer to help patch the applications or mention where contributors can get started. I get the author's concern but there is nothing useful in this article. It's misleading suggesting that the problem is with flatpak when the problem is that certain applications aren't using its full capabilities, aren't configured correctly and are in need patching. Or in the worst case, might need a redesign to fit the sandboxing model. This needs to happen with any sandbox that uses this model, not just flatpak. There is nothing else that can be done about this short of suggesting users switch to a different sandboxing model like Qubes. (Maybe the blog author can try that too and see how it goes, or could develop their own sandboxing model just to see how hard it is on a complex system like Linux)
  - dylan-m 6y ago
    As well as misleading, the article seems outdated? Which is weird, because archive.org's first snapshot of it is today. So, GNOME Software has included a "Permissions" field (which lists an application's specific sandbox holes) since - if I recall correctly - GNOME 3.34: https://i.imgur.com/lCGgA1B.png https://i.imgur.com/lCGgA1B.png. Not perfect, but definitely better than pictured. It's a bit of a shame that people have to use older versions of GNOME in 2020, but then, it's nice that Flatpak makes it easy to run new applications regardless :) Also, I was trying to verify the author's claim about a vulnerable libssh in the gitg package, partly because I was curious whether they'd bothered to report any of these issues upstream. Looks like that was fixed in May: https://github.com/flathub/org.gnome.gitg/pull/12 https://github.com/flathub/org.gnome.gitg/pull/12. Similar story with ffmpeg: https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/commit/d7d8582f750e1165fd3fd637f8fcb62104ede2c8 https://gitlab.com/freedesktop-sdk/freedesktop-sdk/-/commit/.... So, woefully behind schedule, but, how long was the author sitting on these? It would be more accurate, less irritating, and more persuasive if they simply talked about it after the fact: this happened, various things are wrong with it, it should be avoidable, etc.
    - frabbit 6y ago
      The first two CVEs linked in the article do not even exist: whether due to rejection or something else is uncertain.
matthiasv 6y ago
> Beyond this, and not unlike systemd, flatpak has been pushed hard down people's throat by powerful entities within the ecosystem, [...] Sounds like a tinfoil hat theory to me. Powerful entities? Pushed down people's throat? You are free to ignore Flatpak, no one is forcing it on anyone.

turbinerneiter 6y ago

It's hard to keep a civil tone if you feel like the world around you is descending into madness, and this is exactly what the authors of this posts feel. Its hard to have a civil discussion if everyone pulls into a direction you deem wrong and your words are never convincing anyone. I have similar resentments when people in my company push for docker on embedded systems, because they are used to docker on the server, and whenever I ask them which problem they are solving on the embedded system with docker, they describe things that are wrong. I don't share the authors strength of opinion on flatpak, although I see the same issues, and I don't want to advertise or excuse strong "tone" - but I understand the frustration.

pjc50 6y ago
> push for docker on embedded systems Aaargh! A particularly odd one as most embedded systems are handled as "images" of some sort - firmware blobs, ramdiscs, imaged HDDs for embedded PCs and so on.
kanox 6y ago
What exactly is wrong with docker on embedded systems? Many have the memory and storage to afford containers and existing established distros like yocto are not very good. I'd much rather deal with Dockerfiles than buildbake.
- turbinerneiter 6y ago
  What is the problem docker solves?
- Obsnold 6y ago
  Just to clarify yocto is not a distro but a project that allows you to create your own custom distro. Two yocto builds could be completely different from one another even using different package managers.
  - kanox 6y ago
    Yocto and various derivatives can be used to "build software" in the same way that Dockerfiles can be used to "build software" but using yocto is a much worse experience.

ylyn 6y ago

I don't see an issue with the tone. Actually, why are people so concerned about tone nowadays? It matters, but this is perfectly fine. I feel like you can't find anything to nitpick about the post, so you pick on the tone instead.

zaarn 6y ago
I've brought up issues beside tone because of this. In case those aren't enough; I think the issues brought up aren't issues with flatpak. The first issue is with a GUI application on top of flatpak and the second is a packaging issue of the runtimes. These aren't inherently problems with flatpak so I mentally don't count them.
- steerablesafe 6y ago
  Don't forget lying about sandboxing.
  - dylan-m 6y ago
    Yeah, that's a dubious claim as well. Here is how GNOME Software presents a sandboxed application: https://i.imgur.com/VMsj6mk.png https://i.imgur.com/VMsj6mk.png Is it a bad interface? Sure. Is the list of permissions hard to find? Hell yes. Is the Sandboxed emblem kind of misleading? Yeah. But here (in at least GNOME Software 3.36) you see a list of the relevant permissions available to the application. Nobody is lying here. For contrast, here is an application with a stricter sandbox: https://i.imgur.com/lCGgA1B.png https://i.imgur.com/lCGgA1B.png The point here is both of these are sandboxed. Each sandbox just has particular holes in it. For GNU Octave, more than seems appropriate. Users misunderstand that in the same way people misunderstand "autopilot" and that's a good issue to bring up, but then I don't think non-technical users understand what "sandboxed" means anyway and technical users should be able to take one more gorramn step and learn that "sandboxed" obviously comes with particular limitations [at least in the present day] or it isn't going to do anything.

sergeykish 6y ago

You've skipped CVE. Flatpak has a lot of claims [1], author feels them as a lie. And he provides facts in support. Linux "next generation technology" would certainly alert users of insecure application. This does not. The story of themes and dbus shows how hard it is to contain all dependencies. Also there were a lot of claims here that Linux distributions makes no good, static linking is better and libraries would be patched. Now lets switch perspective. Windows users are perfectly fine running closed source software which may contain outdated dependencies. Most of them are not updated anyway. And it has gallery, something Winget still lacks. Looks like next gen. What is cry for open source developer may be fine for consumer. Personally I'm fine with Flatpak, Appimage. There should be some way to install proprietary software. And some starting point to make it safe. [1] https://flatpak.org/ https://flatpak.org/