6 ms·

> Instead, providing a cross distribution consistent installation experience is the main goal. Who is asking this exactly? As an arch user and technically a f

by waheoo 6y ago

> Instead, providing a cross distribution consistent installation experience is the main goal. Who is asking this exactly? As an arch user and technically a fedora, Gentoo, slackware, Ubuntu, debian user, I'm not asking for this. I like how I install packages. Installing garbage from a webpage like some windows pleb or having to eject weird desktop download things after drag and dropping things on a Mac is not something I want. Please stop pushing this idea about flatpak being better, its not for a lot of users and for me, security doesn't even enter the equation. But the idea that random flatpak maintainer has better security processes I place than the sec team for many distros is laughable at best. You can wrangle the argument all you like about ideal world scenarios but the fact of the matter remains that suboptimal ideal still works out as more effective in the real world. Tragedy of the commons problems generally do require sub optimal solutions in the small to solve in the large.

TehCorwiz 6y ago
There’s a lot of good software that isn’t in package repos. This isn’t a failure in the developers part. It takes knowledge and time and effort to package for a repo, let alone all the different repos on each distro. Flat pack gives a single way to distribute something and on that merit alone it’s valuable.
- waheoo 6y ago
  Again, to whom? Arch has aur, arch can sideload rpm/Deb's, Mac has home brew, who needs this? The only people I see using flatpak is the 50 odd Linux users we have at work, they constantly have dramas trying to make things work around home directory sandboxing, permissions, updating and more > Single way Why is this valuable? Just saying it doesn't make it true. Why do we need a single way to install? I'm not saying it's a bad thing, but giving up home dirs and a bunch of other platform specific benefits is a cost I'm not willing to pay for some made up ideal that gives me a worse experience.
  - santoshalper 6y ago
    Did you know, and this may shock you, that there are other people with other interests. Also, and this one is really going to blow your mind, these other "people" (plebes if you will), may value different things and want products that are of no interest to you. Flatpak sounds like a shitshow, but the not because it doesn't meet your specific requirements.
  - knocte 6y ago
    > Again, to whom? Are you trolling? I think the answer is obvious: less duplication of efforts may make the linux ecosystem be more lean which may mean more manpower to... bring the year of the linux desktop.
    - asveikau 6y ago
      If you avoid duplication of effort by doing something worse than existing solutions, is that progress? Distro package managers have more than 20 years doing this. If you want to replace them I think there should be fewer drawbacks. Otherwise you are throwing out decades of design, thought, bug fixes for something more problematic.
    - michaelmrose 6y ago
      You are assuming that packaging is a substantial burden when compared to making a complex application and that that labor translates ultimately into tangible benefits. If the packaging is done by the dev you are assuming that 1% extra effort wont be spent playing chess instead of adding features. If the packaging is down by an interested party for that distro you are assuming that a person competent to write a package file is even competent to say write an app let alone interested in doing so.
  - jdright 6y ago
    To me at least, but I'm sure there is more people than me who wants this.
- kchr 6y ago
  Almost every package manager on Linux distros allow you to install packages outside of the main repositories and still manage dependencies using the repos. I agree there are a lot of distros to package for, but I'd say the bonus of not having to maintain and update all the dependencies outweighs that fact. For example, there are a lot of tools that can generate Debian packages for you if you don't want to spend any time learning the manifests. I assume these exist for most distros.
  - quicklyfrozen 6y ago
    Even if there are easy tools available, I'd still need to learn them for each distro I want to support. Heck, just figuring out the different names each distro uses for a particular package is a fair bit of work.
    - kevin_thibedeau 6y ago
      Just use Gnu Stow as a secondary package manager and install into the /usr/local tree.
      - eikenberry 6y ago
        The discussion is about packaging your software for users, not yourself. Stow is a solution for managing non-packages software on your personal system, not for distributing it.
        waheoo 6y ago
        Most people don't package their software for distros. Smart distros keep things close to upstream so the burden is small. This is a weird argument. Now you want each developer to manage dependency updates for their application? I don't trust them to develop their own app let alone apply security patches properly.
xtracto 6y ago
As a free software developer of Windows, Linux and Mac software I would not want to have to need to be "approved by the gods" in order to release an application to the AppStore / SnapStore / Windows Store and whatever is called in the different flavors of linux. I put my software in my webpage and whoever wants to download it and use it does it. If they don't trust it well then I'm sorry.
- commoner 6y ago
  You can self-host Flatpak repositories with flat-manager, which differentiates Flatpak from the App/Snap/Windows Stores. https://docs.flatpak.org/en/latest/hosting-a-repository.html https://docs.flatpak.org/en/latest/hosting-a-repository.html https://github.com/flatpak/flat-manager https://github.com/flatpak/flat-manager
filmor 6y ago
As a Gentoo user, I very much welcome being able to pull in some applications that are closed source and/or not part of the portage tree without the hassle of finding out how exactly the base platform that it was compiled against looks like. For a while I had to keep a lot of 32bit versions of libraries around just to make Steam happy, and build the stupidly large qtwebengine just for the Nextcloud client. Nowadays I get both of them via Flatpak without hassle and can keep a leaner base system.
- AshamedCaptain 6y ago
  Why do you exactly run Gentoo in the first place if you don't actually value building the dependencies from source?
  - filmor 6y ago
    That's an odd question. I absolutely value having almost everything built from source and the control I get from that through use-flags. That doesn't mean I enjoy compiling some incarnation of webkit every few weeks for multiple hours on a laptop, in particular if it's just for a single application (in this case: Nextcloud client). Same for 32bit stuff, I have absolutely zero use for these libraries outside of closed-source games, so I'd rather have them just work than full control over them.
- herewulf 6y ago
  As a Gentoo/Funtoo user, I feel like we can solve this problem with better security by running applications in Docker. See Funtoo's approach to Steam for example. https://www.funtoo.org/Steam https://www.funtoo.org/Steam
bertman 6y ago
> As an arch user > like some windows pleb I'm not sure if you're serious or making fun of stereotypes and thus don't know how to respond.
- deleted 6y ago
  [deleted]
- waheoo 6y ago
  Seriously making fun of windows plebs? Yes. How anyone trusts Mac/windows these days still amazes me.
tsss 6y ago
It's for the people who spent their free time to write the software that you use for free and call plebs.
Wowfunhappy 6y ago
Then don't use Flatpak! The other side is that Software Developer Foo isn't necessarily going to have the resources/inclination to work with your distro maintainer. You may decide to avoid Foo's software as a result, and that's totally fine—but if I like Foo's software and want to use it, Flatpak gives me that opportunity.
- waheoo 6y ago
  I don't and I won't but I'm still looking to point out its shortcomings whenever it comes up. Staying silent is as good as encouraging the echo chamber outright. People are pushing this shit because it's trendy not because it's good.
jillesvangurp 6y ago
Well, getting the wrong version (years old, not what the developer designated as stable & supported as of yesterday) of absolutely everything I care about is actually kind of really annoying with most contemporary linux distributions. But basically, as with anything open source, if you don't like it, don't use it, make some other choices, or build your own. I see a lot of people whining and stamping their feet here but not a lot people building alternatives. Quit whining & start coding if it matters that much to you. As far as I can see there's Flatpack, Snap, and not much else here because nobody can be bothered apparently.
- waheoo 6y ago
  Microsoft calls typescript stable. I find bugs in it all the time. I don't trust developers to designate things as stable.
188201 6y ago
Flatpak is supposed to be the solution for installing proprietary app while staying safe. For open source software, less value for using flatpak apart from no need for package in multiple format for different distro. Appimage also solve the same problem. Now is flatpak secure for installing closed source app? At least not when they have full x11 access when using x11 desktop.
karmakaze 6y ago
I can see two opensource groups that benefit from this. Maintainers can produce quality packages that don't vary unintentionally between target systems with less effort to produce. Package consumers can rely on having the same quality packages on varying systems. I use Ubuntu Server mostly because its packages are highly consumed. If I could get the same packaging on a different system I wouldn't have to worry about arbitrary variations not related to the distro but different just because it's produced through a separate workflow.
PopsiclePete 6y ago
Not that I expected different from a "l337" Arch user, but "Windows plebs" have had "chocolatey" and the Windows Store for a while now...

by waheoo 6y ago

TehCorwiz 6y ago

There’s a lot of good software that isn’t in package repos. This isn’t a failure in the developers part. It takes knowledge and time and effort to package for a repo, let alone all the different repos on each distro. Flat pack gives a single way to distribute something and on that merit alone it’s valuable.

waheoo 6y ago
Again, to whom? Arch has aur, arch can sideload rpm/Deb's, Mac has home brew, who needs this? The only people I see using flatpak is the 50 odd Linux users we have at work, they constantly have dramas trying to make things work around home directory sandboxing, permissions, updating and more > Single way Why is this valuable? Just saying it doesn't make it true. Why do we need a single way to install? I'm not saying it's a bad thing, but giving up home dirs and a bunch of other platform specific benefits is a cost I'm not willing to pay for some made up ideal that gives me a worse experience.
- santoshalper 6y ago
  Did you know, and this may shock you, that there are other people with other interests. Also, and this one is really going to blow your mind, these other "people" (plebes if you will), may value different things and want products that are of no interest to you. Flatpak sounds like a shitshow, but the not because it doesn't meet your specific requirements.
- knocte 6y ago
  > Again, to whom? Are you trolling? I think the answer is obvious: less duplication of efforts may make the linux ecosystem be more lean which may mean more manpower to... bring the year of the linux desktop.
  - asveikau 6y ago
    If you avoid duplication of effort by doing something worse than existing solutions, is that progress? Distro package managers have more than 20 years doing this. If you want to replace them I think there should be fewer drawbacks. Otherwise you are throwing out decades of design, thought, bug fixes for something more problematic.
  - michaelmrose 6y ago
    You are assuming that packaging is a substantial burden when compared to making a complex application and that that labor translates ultimately into tangible benefits. If the packaging is done by the dev you are assuming that 1% extra effort wont be spent playing chess instead of adding features. If the packaging is down by an interested party for that distro you are assuming that a person competent to write a package file is even competent to say write an app let alone interested in doing so.
- jdright 6y ago
  To me at least, but I'm sure there is more people than me who wants this.
kchr 6y ago
Almost every package manager on Linux distros allow you to install packages outside of the main repositories and still manage dependencies using the repos. I agree there are a lot of distros to package for, but I'd say the bonus of not having to maintain and update all the dependencies outweighs that fact. For example, there are a lot of tools that can generate Debian packages for you if you don't want to spend any time learning the manifests. I assume these exist for most distros.
- quicklyfrozen 6y ago
  Even if there are easy tools available, I'd still need to learn them for each distro I want to support. Heck, just figuring out the different names each distro uses for a particular package is a fair bit of work.
  - kevin_thibedeau 6y ago
    Just use Gnu Stow as a secondary package manager and install into the /usr/local tree.
    - eikenberry 6y ago
      The discussion is about packaging your software for users, not yourself. Stow is a solution for managing non-packages software on your personal system, not for distributing it.
      - waheoo 6y ago
        Most people don't package their software for distros. Smart distros keep things close to upstream so the burden is small. This is a weird argument. Now you want each developer to manage dependency updates for their application? I don't trust them to develop their own app let alone apply security patches properly.

xtracto 6y ago

As a free software developer of Windows, Linux and Mac software I would not want to have to need to be "approved by the gods" in order to release an application to the AppStore / SnapStore / Windows Store and whatever is called in the different flavors of linux. I put my software in my webpage and whoever wants to download it and use it does it. If they don't trust it well then I'm sorry.

commoner 6y ago
You can self-host Flatpak repositories with flat-manager, which differentiates Flatpak from the App/Snap/Windows Stores. https://docs.flatpak.org/en/latest/hosting-a-repository.html https://docs.flatpak.org/en/latest/hosting-a-repository.html https://github.com/flatpak/flat-manager https://github.com/flatpak/flat-manager

filmor 6y ago

As a Gentoo user, I very much welcome being able to pull in some applications that are closed source and/or not part of the portage tree without the hassle of finding out how exactly the base platform that it was compiled against looks like. For a while I had to keep a lot of 32bit versions of libraries around just to make Steam happy, and build the stupidly large qtwebengine just for the Nextcloud client. Nowadays I get both of them via Flatpak without hassle and can keep a leaner base system.

AshamedCaptain 6y ago
Why do you exactly run Gentoo in the first place if you don't actually value building the dependencies from source?
- filmor 6y ago
  That's an odd question. I absolutely value having almost everything built from source and the control I get from that through use-flags. That doesn't mean I enjoy compiling some incarnation of webkit every few weeks for multiple hours on a laptop, in particular if it's just for a single application (in this case: Nextcloud client). Same for 32bit stuff, I have absolutely zero use for these libraries outside of closed-source games, so I'd rather have them just work than full control over them.
herewulf 6y ago
As a Gentoo/Funtoo user, I feel like we can solve this problem with better security by running applications in Docker. See Funtoo's approach to Steam for example. https://www.funtoo.org/Steam https://www.funtoo.org/Steam

bertman 6y ago

> As an arch user > like some windows pleb I'm not sure if you're serious or making fun of stereotypes and thus don't know how to respond.

deleted 6y ago
[deleted]
waheoo 6y ago
Seriously making fun of windows plebs? Yes. How anyone trusts Mac/windows these days still amazes me.

tsss 6y ago

It's for the people who spent their free time to write the software that you use for free and call plebs.

Wowfunhappy 6y ago

Then don't use Flatpak! The other side is that Software Developer Foo isn't necessarily going to have the resources/inclination to work with your distro maintainer. You may decide to avoid Foo's software as a result, and that's totally fine—but if I like Foo's software and want to use it, Flatpak gives me that opportunity.

waheoo 6y ago
I don't and I won't but I'm still looking to point out its shortcomings whenever it comes up. Staying silent is as good as encouraging the echo chamber outright. People are pushing this shit because it's trendy not because it's good.

jillesvangurp 6y ago

Well, getting the wrong version (years old, not what the developer designated as stable & supported as of yesterday) of absolutely everything I care about is actually kind of really annoying with most contemporary linux distributions. But basically, as with anything open source, if you don't like it, don't use it, make some other choices, or build your own. I see a lot of people whining and stamping their feet here but not a lot people building alternatives. Quit whining & start coding if it matters that much to you. As far as I can see there's Flatpack, Snap, and not much else here because nobody can be bothered apparently.

waheoo 6y ago
Microsoft calls typescript stable. I find bugs in it all the time. I don't trust developers to designate things as stable.

188201 6y ago

Flatpak is supposed to be the solution for installing proprietary app while staying safe. For open source software, less value for using flatpak apart from no need for package in multiple format for different distro. Appimage also solve the same problem. Now is flatpak secure for installing closed source app? At least not when they have full x11 access when using x11 desktop.

karmakaze 6y ago

I can see two opensource groups that benefit from this. Maintainers can produce quality packages that don't vary unintentionally between target systems with less effort to produce. Package consumers can rely on having the same quality packages on varying systems. I use Ubuntu Server mostly because its packages are highly consumed. If I could get the same packaging on a different system I wouldn't have to worry about arbitrary variations not related to the distro but different just because it's produced through a separate workflow.

PopsiclePete 6y ago

Not that I expected different from a "l337" Arch user, but "Windows plebs" have had "chocolatey" and the Windows Store for a while now...