4 ms·

"Flatpak fixes that issue by providing consistent builds for every distribution" - aka https://xkcd.com/927/ https://xkcd.com/927/ "Standards" I get the point

"Flatpak fixes that issue by providing consistent builds for every distribution" - aka https://xkcd.com/927/ https://xkcd.com/927/ "Standards" I get the point of flatpak and I see its value. Personally I just don't need yet another channel through which I need to get stuff. Ubuntu has already obnoxiously fragmented [1], this is just another fragmentation I don't want [1] chunky@mills:~$ erl Command 'erl' not found, but can be installed with: sudo snap install erlang # version 22.3.4.1, or sudo apt install erlang-base # version 1:22.2.7+dfsg-1

tannhaeuser 6y ago
Also there's this annoying gem: $ sudo apt install cpufreq No apt package "cpufreq", but there is a snap with that name. Try "snap install cpufreq" Can't say I'm getting the point of either snap or flatpak when the whole point of using a distro is that's a trusted/curated set of software. Moreover, snaps frequently just don't seem to work for me whereas the regular .deb does.
- airhead969 6y ago
  I don't use Ubuntu anymore because it's turned into a garbage heap. Debian, Arch, or Qubes. (Fedora-Cent-RHEL are boned. Cent-RHEL has/had an awesome stable kernel due to enterprise-scale bug fixes but that's likely to end. Debian is a good substitute.) If I need the latest-greatest on a stable release OS, I use habitat.
  - mroche 6y ago
    > Fedora-Cent-RHEL are boned. Care to elaborate on that? Curious where your position on this is coming from.
    - airhead969 6y ago
      You may not be aware of what's happened: IBM buys RHEL and immediately messes with its products and culture. https://www.cnbc.com/2019/07/09/ibm-closes-its-34-billion-acquisition-of-red-hat.html https://www.cnbc.com/2019/07/09/ibm-closes-its-34-billion-ac... https://itsfoss.com/centos-stream-fiasco/ https://itsfoss.com/centos-stream-fiasco/ CentOS is no longer basically functionally-equivalent to RHEL. https://www.theregister.com/2020/12/09/centos_red_hat/ https://www.theregister.com/2020/12/09/centos_red_hat/ IBM (through Red Hat) runs the Fedora project's board of directors, so there is no real independence from IBM.
  - dralley 6y ago
    Fedora is great, I've been using it daily for 5 years.
    - airhead969 6y ago
      How is Fedora going to sustain itself long-term? http://techrights.org/2020/12/26/fedora-2020-and-ibm-vision/ http://techrights.org/2020/12/26/fedora-2020-and-ibm-vision/
      - dralley 6y ago
        What is up with everyone posting techrights all of a sudden? It's a conspiracy blog, and most websites actually paying attention to FOSS news have ignored them for years. https://www.reddit.com/r/linux/comments/4541p6/can_we_not_post_links_to_techrights_please/ https://www.reddit.com/r/linux/comments/4541p6/can_we_not_po... Disclaimer: I work for Red Hat. TechRights claimed that there were massive layoffs last year, which is total BS. They literally just make stuff up. The other day they claimed that "Fedora is being outsourced to Microsoft and to AWS" on the basis that some Fedora repos are on Github, and some build infrastructure uses AWS. And mind you the claim was not "Fedora project infrastructure is being outsourced" but actually "Fedora is being outsourced". And that has been the general way they approach "reporting" for years, as you can see from the /r/linux thread. Then when I and others pointed out how ridiculous this line of reasoning was, and the post got flagged by admins, they made an entire new post claiming they were being censored by HN.
- Shared404 6y ago
  I've personally had better luck with flatpack than snap[0] I still prefer to install from the OS repos where possible, but I like having choices. I'd rather be able to install something untrusted through a package manager where I can then at least have it installed in a standardized manner than download a binary and trust myself to remember what I did with it, but that may just be because I'm stupid :) . [0] Also, it not creating a bunch of loop devices is nice.
airhead969 6y ago
Emperor's new clothes. Something for someone to say is "better" while ensuring their job security. In reality it creates too many choices, duplication of effort, too much fragmentation, abandoning standards, and complexifying security, auditing, and configuration management. If you want isolated software, use something like Qubes (Xen with virtualized containers), not Docker and not flatpak, snap, or anything similar. Inventing "new" things rather than fixing what already exists is rarely ever a good solution.
- cycloptic 6y ago
  I don't see what you mean. Qubes is great, but it is not the same thing as Docker, flatpak, or snap. Are you saying Qubes should somehow be changed so that it works similar to Docker? And if so, why wouldn't you just use Docker?
  - airhead969 6y ago
    Then you need to understand how they work differently and their contrasting limitations. Qubes (based on Xen) is great for desktop users to segregate applications. Xen standalone is similarly great for general server containerization. Docker doesn't work anything remotely like a hypervisor. It doesn't provide the much greater assurance of security, scalability, isolation, resource metering, accounting, or flexibility that a hypervisor does. Docker is a security disaster and it only runs Linux. Xen/Qubes runs Windows, BSDs, or any other OS. Docker seems "easy" but with many subtle costs that come later at scale. You can't live migrate a Docker container from one host to another, where you usually can with Xen using shared storage. There are many other gotchas in the lifecycle of Docker containers that are eliminated or mitigated by using hypervisor guests instead. flatpak and snap are basically filesystem overlays. They're gross, poorly-managed, incompatible duplications of package management.
    - cycloptic 6y ago
      I am not sure I see what the significant difference is, I've heard of security escapes happening in both Docker and in various hypervisors. Either way there is a risk of some privilege escalation bug that allows access to the full RAM. I think if you want isolation, both of them lose out to having a separate firewalled off machine. Also I think the companies running heavy Linux workloads on Docker are probably not interested in the ability of Qubes to run Windows or Mac, just my read on the situation from talking to some of them. I don't know about snap but from what I have seen of flatpak, it allows for different versions of the same package to be installed, not many package managers are supporting that currently. (Nix and Guix being some notable exceptions, and those should be able to re-use some of the sandboxing bits from flatpak if they need to) Of course, that is one of the main benefits to building this on top of filesystem overlays, and why it requires a different approach from a traditional package manager, i.e. it's not just a duplication. Edit: Live migration actually does work for containers, take a look at CRIU. (I don't know the current status of this being integrated in Docker) I never even saw this as being opposing technology anyway, for example if you need to you could migrate a container in or out of a VM.
danieldk 6y ago
I get the point of flatpak and I see its value. Personally I just don't need yet another channel through which I need to get stuff. IMO Flatpak solves several real problems: 1.) allowing third parties distribute applications in a distro-agnostic manner; 2.) allowing easy installation of packages as a user (rather than requiring root); 3.) a way to install applications on top of an immutable base OS; 4.) sandboxing of applications, or at least packaging applications such that they can move to proper sandboxing over time. Unfortunately, the development of application bundles follow the prototypical path that we are oh so familiar with as Linux users. Rather than sitting together and making one standard, Canonical (Snap) and Red Hat (Flatpak) made their own application bundle formats, in addition to an already existing format (AppImage). And now vendors have to build bundles in three different formats, like they had to build for at least two package managers before. So, the problem actually got worse. To Red Hat's credit, Flatpak was initially developed as part of freedesktop.org (initially as xdg-app). We can always hope that Canonical will give up on Snaps for desktop applications I guess (like they dropped Unity and Upstart).

tannhaeuser 6y ago

Also there's this annoying gem: $ sudo apt install cpufreq No apt package "cpufreq", but there is a snap with that name. Try "snap install cpufreq" Can't say I'm getting the point of either snap or flatpak when the whole point of using a distro is that's a trusted/curated set of software. Moreover, snaps frequently just don't seem to work for me whereas the regular .deb does.

airhead969 6y ago
I don't use Ubuntu anymore because it's turned into a garbage heap. Debian, Arch, or Qubes. (Fedora-Cent-RHEL are boned. Cent-RHEL has/had an awesome stable kernel due to enterprise-scale bug fixes but that's likely to end. Debian is a good substitute.) If I need the latest-greatest on a stable release OS, I use habitat.
- mroche 6y ago
  > Fedora-Cent-RHEL are boned. Care to elaborate on that? Curious where your position on this is coming from.
  - airhead969 6y ago
    You may not be aware of what's happened: IBM buys RHEL and immediately messes with its products and culture. https://www.cnbc.com/2019/07/09/ibm-closes-its-34-billion-acquisition-of-red-hat.html https://www.cnbc.com/2019/07/09/ibm-closes-its-34-billion-ac... https://itsfoss.com/centos-stream-fiasco/ https://itsfoss.com/centos-stream-fiasco/ CentOS is no longer basically functionally-equivalent to RHEL. https://www.theregister.com/2020/12/09/centos_red_hat/ https://www.theregister.com/2020/12/09/centos_red_hat/ IBM (through Red Hat) runs the Fedora project's board of directors, so there is no real independence from IBM.
- dralley 6y ago
  Fedora is great, I've been using it daily for 5 years.
  - airhead969 6y ago
    How is Fedora going to sustain itself long-term? http://techrights.org/2020/12/26/fedora-2020-and-ibm-vision/ http://techrights.org/2020/12/26/fedora-2020-and-ibm-vision/
    - dralley 6y ago
      What is up with everyone posting techrights all of a sudden? It's a conspiracy blog, and most websites actually paying attention to FOSS news have ignored them for years. https://www.reddit.com/r/linux/comments/4541p6/can_we_not_post_links_to_techrights_please/ https://www.reddit.com/r/linux/comments/4541p6/can_we_not_po... Disclaimer: I work for Red Hat. TechRights claimed that there were massive layoffs last year, which is total BS. They literally just make stuff up. The other day they claimed that "Fedora is being outsourced to Microsoft and to AWS" on the basis that some Fedora repos are on Github, and some build infrastructure uses AWS. And mind you the claim was not "Fedora project infrastructure is being outsourced" but actually "Fedora is being outsourced". And that has been the general way they approach "reporting" for years, as you can see from the /r/linux thread. Then when I and others pointed out how ridiculous this line of reasoning was, and the post got flagged by admins, they made an entire new post claiming they were being censored by HN.
Shared404 6y ago
I've personally had better luck with flatpack than snap[0] I still prefer to install from the OS repos where possible, but I like having choices. I'd rather be able to install something untrusted through a package manager where I can then at least have it installed in a standardized manner than download a binary and trust myself to remember what I did with it, but that may just be because I'm stupid :) . [0] Also, it not creating a bunch of loop devices is nice.

airhead969 6y ago

Emperor's new clothes. Something for someone to say is "better" while ensuring their job security. In reality it creates too many choices, duplication of effort, too much fragmentation, abandoning standards, and complexifying security, auditing, and configuration management. If you want isolated software, use something like Qubes (Xen with virtualized containers), not Docker and not flatpak, snap, or anything similar. Inventing "new" things rather than fixing what already exists is rarely ever a good solution.

cycloptic 6y ago
I don't see what you mean. Qubes is great, but it is not the same thing as Docker, flatpak, or snap. Are you saying Qubes should somehow be changed so that it works similar to Docker? And if so, why wouldn't you just use Docker?
- airhead969 6y ago
  Then you need to understand how they work differently and their contrasting limitations. Qubes (based on Xen) is great for desktop users to segregate applications. Xen standalone is similarly great for general server containerization. Docker doesn't work anything remotely like a hypervisor. It doesn't provide the much greater assurance of security, scalability, isolation, resource metering, accounting, or flexibility that a hypervisor does. Docker is a security disaster and it only runs Linux. Xen/Qubes runs Windows, BSDs, or any other OS. Docker seems "easy" but with many subtle costs that come later at scale. You can't live migrate a Docker container from one host to another, where you usually can with Xen using shared storage. There are many other gotchas in the lifecycle of Docker containers that are eliminated or mitigated by using hypervisor guests instead. flatpak and snap are basically filesystem overlays. They're gross, poorly-managed, incompatible duplications of package management.
  - cycloptic 6y ago
    I am not sure I see what the significant difference is, I've heard of security escapes happening in both Docker and in various hypervisors. Either way there is a risk of some privilege escalation bug that allows access to the full RAM. I think if you want isolation, both of them lose out to having a separate firewalled off machine. Also I think the companies running heavy Linux workloads on Docker are probably not interested in the ability of Qubes to run Windows or Mac, just my read on the situation from talking to some of them. I don't know about snap but from what I have seen of flatpak, it allows for different versions of the same package to be installed, not many package managers are supporting that currently. (Nix and Guix being some notable exceptions, and those should be able to re-use some of the sandboxing bits from flatpak if they need to) Of course, that is one of the main benefits to building this on top of filesystem overlays, and why it requires a different approach from a traditional package manager, i.e. it's not just a duplication. Edit: Live migration actually does work for containers, take a look at CRIU. (I don't know the current status of this being integrated in Docker) I never even saw this as being opposing technology anyway, for example if you need to you could migrate a container in or out of a VM.

danieldk 6y ago

I get the point of flatpak and I see its value. Personally I just don't need yet another channel through which I need to get stuff. IMO Flatpak solves several real problems: 1.) allowing third parties distribute applications in a distro-agnostic manner; 2.) allowing easy installation of packages as a user (rather than requiring root); 3.) a way to install applications on top of an immutable base OS; 4.) sandboxing of applications, or at least packaging applications such that they can move to proper sandboxing over time. Unfortunately, the development of application bundles follow the prototypical path that we are oh so familiar with as Linux users. Rather than sitting together and making one standard, Canonical (Snap) and Red Hat (Flatpak) made their own application bundle formats, in addition to an already existing format (AppImage). And now vendors have to build bundles in three different formats, like they had to build for at least two package managers before. So, the problem actually got worse. To Red Hat's credit, Flatpak was initially developed as part of freedesktop.org (initially as xdg-app). We can always hope that Canonical will give up on Snaps for desktop applications I guess (like they dropped Unity and Upstart).