5 ms·

Unity made sense, snap doesn't.

by Darmody 4y ago

GekkePrutser 4y ago
Yes unity wasn't bad and it wasn't shoved down your throat.
- rstat1 4y ago
  I mean it was the default environment on Ubuntu distros for years...I would say it was more forced than Snaps are.
  - iiix 4y ago
    I don't know if I'd agree; with Unity you could just install a new DE & switch environments without fuss. My biggest problem with Snap is that trying to install something like Chromium via apt, will, most likely unbeknownst to the user, just install the Snap version instead.
    - 2143 4y ago
      This. I recently installed Chromium via apt, and it actually installed the snap! I mean, if I wanted the snap I'll use the snap command. If it's not available via apt just say so and quit. I don't want it to install the snap version when I asked for the apt (.deb) thing. In this particular case the means to the end matters.
    - rstat1 4y ago
      Well ok, maybe "forced" was the wrong word choice, but I would still say Unity was a more in-your-face change than Snaps are, since the vast majority of software on Ubuntu is still distribute via proper .deb packages
2ion 4y ago
Snap makes sense, because it deals with desktop application confinement. Any Firefox process launched as $user is able to use all the RAM, read and write all the files, access all the networks and basically do everything as that user. You don't want that, it's stupid and so Windows 95. There are alternative solutions: QubesOS uses VMs as the isolation layer, desktop application confinement using firejail with its good selection of profiles tweaked to my liking, systemd-run confinement configured through the vast resource control options made configurable through systemd. There is no reason ~ or even / shouldn't appear completely empty to Firefox the process except for the resources you pass to it (open file, grant download permissions...) or which it needs to run (of course, those would be immutable as far as possible). SELinux and AppArmor are child's play; you don't have a lot of problems of those tools if there are no objects a process could acceess in its namespace to begin with. macOS I believe is already there in terms of desktop app confinement. Windows is not but at least it has the controlled folder access layer available after they gave up on making store apps meaningfully secure as its own app category (too many escapes/config tweaks possible now). Desktop Linux though has not had squat in that field in the mass market for 2 decades. Basically, you guys run all applications unconfined. Snap is a way to work on changing that. Not saying though that the current implementation is exceptionally good. It's too slow, and they should have reused systemd or whatever for a thin, tweakable resource control and container layer, not invent a container format from scratch.

Unity made sense, snap doesn't.

GekkePrutser 4y ago

Yes unity wasn't bad and it wasn't shoved down your throat.

rstat1 4y ago
I mean it was the default environment on Ubuntu distros for years...I would say it was more forced than Snaps are.
- iiix 4y ago
  I don't know if I'd agree; with Unity you could just install a new DE & switch environments without fuss. My biggest problem with Snap is that trying to install something like Chromium via apt, will, most likely unbeknownst to the user, just install the Snap version instead.
  - 2143 4y ago
    This. I recently installed Chromium via apt, and it actually installed the snap! I mean, if I wanted the snap I'll use the snap command. If it's not available via apt just say so and quit. I don't want it to install the snap version when I asked for the apt (.deb) thing. In this particular case the means to the end matters.
  - rstat1 4y ago
    Well ok, maybe "forced" was the wrong word choice, but I would still say Unity was a more in-your-face change than Snaps are, since the vast majority of software on Ubuntu is still distribute via proper .deb packages

2ion 4y ago

Snap makes sense, because it deals with desktop application confinement. Any Firefox process launched as $user is able to use all the RAM, read and write all the files, access all the networks and basically do everything as that user. You don't want that, it's stupid and so Windows 95. There are alternative solutions: QubesOS uses VMs as the isolation layer, desktop application confinement using firejail with its good selection of profiles tweaked to my liking, systemd-run confinement configured through the vast resource control options made configurable through systemd. There is no reason ~ or even / shouldn't appear completely empty to Firefox the process except for the resources you pass to it (open file, grant download permissions...) or which it needs to run (of course, those would be immutable as far as possible). SELinux and AppArmor are child's play; you don't have a lot of problems of those tools if there are no objects a process could acceess in its namespace to begin with. macOS I believe is already there in terms of desktop app confinement. Windows is not but at least it has the controlled folder access layer available after they gave up on making store apps meaningfully secure as its own app category (too many escapes/config tweaks possible now). Desktop Linux though has not had squat in that field in the mass market for 2 decades. Basically, you guys run all applications unconfined. Snap is a way to work on changing that. Not saying though that the current implementation is exceptionally good. It's too slow, and they should have reused systemd or whatever for a thin, tweakable resource control and container layer, not invent a container format from scratch.