2 ms·

Distribution packagers often remove statically linked libraries from upstream and make the software dynamically link anyway. I'm not saying that the UX of nati

by haolez 6y ago

Distribution packagers often remove statically linked libraries from upstream and make the software dynamically link anyway. I'm not saying that the UX of native packages is great for end users. I'm just saying that the security model is saner.

danShumway 6y ago
That cat is already out of the bag. How many Ubuntu users have custom software sources enabled; how many of them are installing games from Humble Bundle that come as their own `deb` packages with statically linked assets? GoG installed Linux games don't even use the package manager at all. Heck, there's a decent amount of Linux software being distributed right now as `tar.gz` files with an install script that just extracts the folder someplace and then modifies the user's path. Flatpak improves on all of that. It's one thing to look at the Linux security model and say that OSS authors should coordinate with distros, but OSS authors and general Linux developers already don't do that today. So how is Flatpak making that situation any worse? Developers were already abandoning the sane security model. Flatpak is a response to that trend, not the cause of it.
- cycloptic 6y ago
  >How many Ubuntu users have custom software sources enabled; how many of them are installing games from Humble Bundle that come as their own `deb` packages with statically linked assets? I don't have an answer to this question, but I would never do this. If the game was open source, I would rebuild it to be dynamically linked, and then publish the dynamically linked package.
  - danShumway 6y ago
    If this is genuinely your philosophy then Flatpak isn't a real problem for you because you can take any OS application that's bundled with Flatpak, rebuild it to be dynamically linked, and then publish the new package using whatever package manager you prefer.
    - cycloptic 6y ago
      Or, alternatively, create a new flatpak runtime and rebuild it for that.

by haolez 6y ago

danShumway 6y ago

That cat is already out of the bag. How many Ubuntu users have custom software sources enabled; how many of them are installing games from Humble Bundle that come as their own `deb` packages with statically linked assets? GoG installed Linux games don't even use the package manager at all. Heck, there's a decent amount of Linux software being distributed right now as `tar.gz` files with an install script that just extracts the folder someplace and then modifies the user's path. Flatpak improves on all of that. It's one thing to look at the Linux security model and say that OSS authors should coordinate with distros, but OSS authors and general Linux developers already don't do that today. So how is Flatpak making that situation any worse? Developers were already abandoning the sane security model. Flatpak is a response to that trend, not the cause of it.

cycloptic 6y ago
>How many Ubuntu users have custom software sources enabled; how many of them are installing games from Humble Bundle that come as their own `deb` packages with statically linked assets? I don't have an answer to this question, but I would never do this. If the game was open source, I would rebuild it to be dynamically linked, and then publish the dynamically linked package.
- danShumway 6y ago
  If this is genuinely your philosophy then Flatpak isn't a real problem for you because you can take any OS application that's bundled with Flatpak, rebuild it to be dynamically linked, and then publish the new package using whatever package manager you prefer.
  - cycloptic 6y ago
    Or, alternatively, create a new flatpak runtime and rebuild it for that.