7 ms·

This is xscreensaver debacle all over again. https://news.ycombinator.com/item?id=11412081 https://news.ycombinator.com/item?id=11412081 Of course many distro

This is xscreensaver debacle all over again. https://news.ycombinator.com/item?id=11412081 https://news.ycombinator.com/item?id=11412081 Of course many distros will just tell the upstream to pound sand, and more power to them. When I'm perfectly happy running the version that shipped with my OS, I DON'T want your updates. Just leave me alone.

AnIdiotOnTheNet 4y ago
Uh, wouldn't you, as the user, rather have the power to determine for yourself which version you'd like to stop upgrading at? That certainly sounds a lot better than letting a bunch of unpaid third party volunteers determine that for you, which is how the distro/repo model works.
- pooper 4y ago
  > unpaid third party volunteers I struggle with this question as well but a small nit here is the folks at Fedora or Debian are not third party. They are a trusted source for me. I don't know what would be a good solution. Being available on flathub is a good start but I'd argue it is not enough. I'm going to say the proper solution is the same that I advocate Google Play and Apple App Store to follow: 1. require developers to submit source code and machine readable build instructions 2. the store should build the application (fat binaries, differential small updates, whatever, the app store is in charge) 3. ... 4. Profit?
  - deleted 4y ago
    [deleted]
  - wmf 4y ago
    3. The store does little or no testing so users would have been better off with official binaries
- yjftsjthsd-h 4y ago
  In general, I trust the folks running the distro more than the folks writing the software in the first place. If nothing else, they provide/enforce a second pair of eyes to sanity check things before they get shipped.
  - erik_seaberg 4y ago
    The distro also gets to choose a graph of known-good non-conflicting dependencies each time they cut a stable release. If the original author is catering to users who don’t use package databases, he won’t know what they may have available.
- orev 4y ago
  You do have the power. You can compile from source to any version you want. The caveat is that it breaks the primary reason most people use distributions—to get a set of packages that are consistent with each other.
  - AnIdiotOnTheNet 4y ago
    > You do have the power. You can compile from source to any version you want. Yeah, that's all that really needs to be said about that. And people wonder why the Year of the Linux Desktop never arrived.
    - yjftsjthsd-h 4y ago
      > And people wonder why the Year of the Linux Desktop never arrived. Because every time it did, people moved the goalposts.
      - AnIdiotOnTheNet 4y ago
    - jerf 4y ago
      No, that is not a relevant reason. There are people who have pinned their Windows versions, there are people who bypass Steam's autoupdates to run old versions of games, this is a general computing problem not a Linux problem. If you want to be particular about the version of something you're running you're not going to be able to rely on systems which were designed to remove that consideration from you, period. Nobody has ever promised that Linux or any other OS would just make all versions of everything work together all the time and you have the total freedom to pick anything with no consequences.
    - deleted 4y ago
      [deleted]
    - striking 4y ago
      This is the opposite of a YotLD problem, it's because Linux users do not usually participate in automatic updates that they consider this a problem. Windows and macOS and Android and iOS are all automatically updated and nudge users into updating more frequently than automatically.
- mook 4y ago
  > Uh, wouldn't you, as the user, rather have the power to determine for yourself which version you'd like to stop upgrading at? Given that I'm not using Linux From Scratch, I'd say no: part of the reason I'm choosing a distribution is because I want to make somebody else deal with tracking updates (including security). I recognize that this comes with downsides (e.g. sometimes new versions have new bugs). I kind of miss the pre-internet times when shipped software is, well, shipped and static, and typically bundled all of its dependencies outside the OS (which was just listed on the box). On the other hand, I'm typing this on a smartphone that couldn't exist in that model…
marcosdumay 4y ago
I guess it's a reminder that most distros still don't have some way to report a bug for their package maintainers that is easier than reporting it upstream. Debian is almost there, but it's stopped almost there for a long time already.
- bee_rider 4y ago
  I wonder if the issue could be solved by upstream. Spin up a new email address for each release -- xscreensaver-1.0@some_domain.org, then once they've moved on to version 1.1, set up an auto response and stop checking the email address.
- smoldesu 4y ago
  I mean... for the most part, these are issues that the upstream maintainers should be fixing. For example, the font rendering in Bottles broke when they updated to GTK4. Instead of fixing this in the actual GTK4 codebase, the GNOME foundation recommended that everyone start using Flatpak, where they could apply a very specific system patch that works around this issue. This is the problem with encouraging this "use our kitchen sink" behavior. It encourages poor development practices, and it ends with developers grovelling and asking users to switch their packaging systems. Imagine if you tried installing an app on Windows or MacOS, and they demanded that you install a separate package manager along with it. It's an unacceptable demand to make of anyone, and certainly shouldn't be the behavior we encourage if we want to live in a world of high-quality Free Software.
  - marcosdumay 4y ago
    If the upstream maintainers should fix, the distro maintainer is quite capable of forwarding the bug there. The upstream developers here are complaining because they get the bug reports, but can't fix the issue (at least the way they want to). That's independent on those few large groups that poped-up on the FOSS community that push a lot of badly maintained software. Yes, those are a problem too, just a different one.
    - Arnavion 4y ago
mftb 4y ago
It is the same old problem and what's interesting to me is that I never see it articulated very well. I suppose it's because people disagree about what the problem is. To me it's this, Linux and it's distribution mechanism is skewed towards servers, and IT since that's where most of it's installed base is. That's great. The distro/repo system is great, and works well. In addition to it, we need another system that serves workstations better. They don't have the same requirements in general. In particular there's a big divergence in availability, and security requirements. I really doubt there's enough economic inventive to serve this second use-case, but it's too bad, because I think we could have the best of both worlds.
- corrral 4y ago
  > To me it's this, Linux and it's distribution mechanism is skewed towards servers, and IT since that's where most of it's installed base is. It's not just servers—not having a very capable, standard, base set of packages to rely on for a workstation-targeting release (say, of GUI programs) is a huge problem. Instead, distros differ wildly on what they provide, users may have different versions of packages or even entirely different programs or libraries (the entire window server may differ!) serving similar purposes, some libs may simply be absent, et c. This is kinda OK if you stick to running software your distro bundles and only at the official version for your release of the distro, but quickly becomes hell (for the people packaging your programs, if not for you) as soon as you step outside that. This is why you see a lot of companies that support Linux for their commercial software being very specific about supporting e.g. only one or two distros, at some very limited set of versions. It's very hard to support "Linux" in general, especially for desktop-targeting software, because the Linux GUI and multimedia stacks are... well, they're a shitshow, frankly.
  - mftb 4y ago
    Agree. I have definitely dealt with that stuff at my work. My goal is to try and frame it in a way, that gets people discussing it productively.
  - skyde 4y ago
    could someone explain why you say linux gui and multimedia are a shitshow! GUI heavy application like chrome, firefox or openoffice run on all districts without any hiccup! what am i missing ?
melony 4y ago
And it is perfectly within upstream's rights to deny trademark and send a C&D to downstream.
- wmf 4y ago
  [Was the parent edited? I could swear it said "deny copyright".]
  - melony 4y ago
    License is not the same as trademark, and most licenses do not grant trademark. You can distribute but you have to do it under a different name or brand (should upstream choose to enforce). All the people downvoting need to take a class on how IP laws work. C.f. Iceweasel
jancsika 4y ago
> Just leave me alone. But that's exactly what jwz asked! He wanted to be left alone by the army-of-people-who-are-not-you that kept reporting long-fixed bugs because they didn't know they were living in an ancient version of Debian. For a distro that blithely patched the entropy out of OpenSSL (in order to quiet a valgrind warning), you'd think they could figure out how to write a script that substitutes an Debian maintainer's email addy for the author's.

AnIdiotOnTheNet 4y ago

Uh, wouldn't you, as the user, rather have the power to determine for yourself which version you'd like to stop upgrading at? That certainly sounds a lot better than letting a bunch of unpaid third party volunteers determine that for you, which is how the distro/repo model works.

pooper 4y ago
> unpaid third party volunteers I struggle with this question as well but a small nit here is the folks at Fedora or Debian are not third party. They are a trusted source for me. I don't know what would be a good solution. Being available on flathub is a good start but I'd argue it is not enough. I'm going to say the proper solution is the same that I advocate Google Play and Apple App Store to follow: 1. require developers to submit source code and machine readable build instructions 2. the store should build the application (fat binaries, differential small updates, whatever, the app store is in charge) 3. ... 4. Profit?
- deleted 4y ago
  [deleted]
- wmf 4y ago
  3. The store does little or no testing so users would have been better off with official binaries
yjftsjthsd-h 4y ago
In general, I trust the folks running the distro more than the folks writing the software in the first place. If nothing else, they provide/enforce a second pair of eyes to sanity check things before they get shipped.
- erik_seaberg 4y ago
  The distro also gets to choose a graph of known-good non-conflicting dependencies each time they cut a stable release. If the original author is catering to users who don’t use package databases, he won’t know what they may have available.
orev 4y ago
You do have the power. You can compile from source to any version you want. The caveat is that it breaks the primary reason most people use distributions—to get a set of packages that are consistent with each other.
- AnIdiotOnTheNet 4y ago
  > You do have the power. You can compile from source to any version you want. Yeah, that's all that really needs to be said about that. And people wonder why the Year of the Linux Desktop never arrived.
  - yjftsjthsd-h 4y ago
    > And people wonder why the Year of the Linux Desktop never arrived. Because every time it did, people moved the goalposts.
    - AnIdiotOnTheNet 4y ago
  - jerf 4y ago
    No, that is not a relevant reason. There are people who have pinned their Windows versions, there are people who bypass Steam's autoupdates to run old versions of games, this is a general computing problem not a Linux problem. If you want to be particular about the version of something you're running you're not going to be able to rely on systems which were designed to remove that consideration from you, period. Nobody has ever promised that Linux or any other OS would just make all versions of everything work together all the time and you have the total freedom to pick anything with no consequences.
  - deleted 4y ago
    [deleted]
  - striking 4y ago
    This is the opposite of a YotLD problem, it's because Linux users do not usually participate in automatic updates that they consider this a problem. Windows and macOS and Android and iOS are all automatically updated and nudge users into updating more frequently than automatically.
mook 4y ago
> Uh, wouldn't you, as the user, rather have the power to determine for yourself which version you'd like to stop upgrading at? Given that I'm not using Linux From Scratch, I'd say no: part of the reason I'm choosing a distribution is because I want to make somebody else deal with tracking updates (including security). I recognize that this comes with downsides (e.g. sometimes new versions have new bugs). I kind of miss the pre-internet times when shipped software is, well, shipped and static, and typically bundled all of its dependencies outside the OS (which was just listed on the box). On the other hand, I'm typing this on a smartphone that couldn't exist in that model…

marcosdumay 4y ago

I guess it's a reminder that most distros still don't have some way to report a bug for their package maintainers that is easier than reporting it upstream. Debian is almost there, but it's stopped almost there for a long time already.

bee_rider 4y ago
I wonder if the issue could be solved by upstream. Spin up a new email address for each release -- xscreensaver-1.0@some_domain.org, then once they've moved on to version 1.1, set up an auto response and stop checking the email address.
smoldesu 4y ago
I mean... for the most part, these are issues that the upstream maintainers should be fixing. For example, the font rendering in Bottles broke when they updated to GTK4. Instead of fixing this in the actual GTK4 codebase, the GNOME foundation recommended that everyone start using Flatpak, where they could apply a very specific system patch that works around this issue. This is the problem with encouraging this "use our kitchen sink" behavior. It encourages poor development practices, and it ends with developers grovelling and asking users to switch their packaging systems. Imagine if you tried installing an app on Windows or MacOS, and they demanded that you install a separate package manager along with it. It's an unacceptable demand to make of anyone, and certainly shouldn't be the behavior we encourage if we want to live in a world of high-quality Free Software.
- marcosdumay 4y ago
  If the upstream maintainers should fix, the distro maintainer is quite capable of forwarding the bug there. The upstream developers here are complaining because they get the bug reports, but can't fix the issue (at least the way they want to). That's independent on those few large groups that poped-up on the FOSS community that push a lot of badly maintained software. Yes, those are a problem too, just a different one.
  - Arnavion 4y ago

mftb 4y ago

It is the same old problem and what's interesting to me is that I never see it articulated very well. I suppose it's because people disagree about what the problem is. To me it's this, Linux and it's distribution mechanism is skewed towards servers, and IT since that's where most of it's installed base is. That's great. The distro/repo system is great, and works well. In addition to it, we need another system that serves workstations better. They don't have the same requirements in general. In particular there's a big divergence in availability, and security requirements. I really doubt there's enough economic inventive to serve this second use-case, but it's too bad, because I think we could have the best of both worlds.

corrral 4y ago
> To me it's this, Linux and it's distribution mechanism is skewed towards servers, and IT since that's where most of it's installed base is. It's not just servers—not having a very capable, standard, base set of packages to rely on for a workstation-targeting release (say, of GUI programs) is a huge problem. Instead, distros differ wildly on what they provide, users may have different versions of packages or even entirely different programs or libraries (the entire window server may differ!) serving similar purposes, some libs may simply be absent, et c. This is kinda OK if you stick to running software your distro bundles and only at the official version for your release of the distro, but quickly becomes hell (for the people packaging your programs, if not for you) as soon as you step outside that. This is why you see a lot of companies that support Linux for their commercial software being very specific about supporting e.g. only one or two distros, at some very limited set of versions. It's very hard to support "Linux" in general, especially for desktop-targeting software, because the Linux GUI and multimedia stacks are... well, they're a shitshow, frankly.
- mftb 4y ago
  Agree. I have definitely dealt with that stuff at my work. My goal is to try and frame it in a way, that gets people discussing it productively.
- skyde 4y ago
  could someone explain why you say linux gui and multimedia are a shitshow! GUI heavy application like chrome, firefox or openoffice run on all districts without any hiccup! what am i missing ?

melony 4y ago

And it is perfectly within upstream's rights to deny trademark and send a C&D to downstream.

wmf 4y ago
[Was the parent edited? I could swear it said "deny copyright".]
- melony 4y ago
  License is not the same as trademark, and most licenses do not grant trademark. You can distribute but you have to do it under a different name or brand (should upstream choose to enforce). All the people downvoting need to take a class on how IP laws work. C.f. Iceweasel

jancsika 4y ago

> Just leave me alone. But that's exactly what jwz asked! He wanted to be left alone by the army-of-people-who-are-not-you that kept reporting long-fixed bugs because they didn't know they were living in an ancient version of Debian. For a distro that blithely patched the entropy out of OpenSSL (in order to quiet a valgrind warning), you'd think they could figure out how to write a script that substitutes an Debian maintainer's email addy for the author's.