6 ms·

Too difficult. Their install instructions are also too complicated and involve reading about 5 lines of comments and 4 shell commands. It should NEVER be more

by dheera 4y ago

Too difficult. Their install instructions are also too complicated and involve reading about 5 lines of comments and 4 shell commands. It should NEVER be more than 1 line of shell or 2 mouse clicks to install anything. This is 2022, not 1995. It's faster to just search for "signal" in the snap store and hit "Install".

iakov 4y ago
All that time you've gained on the installation will be lost during the lethargic start of snapped application :P
tssva 4y ago
Unfortunately, this is the world Signal lives in. For binary debian packages to be installed securely directly from a vendor requires the installation of gpg keys which is what 2 of the 3 commands are regarding. If Ubuntu had spent resources to develop a convenient way for developers to directly provide binaries to the users of their OS instead of developing a system where they are gatekeepers and distribute all packages Signal would now be able to provide an easier secure method of installation. If you were providing a privacy focused product which in some uses that privacy can be the difference between life and death, would you want to turn over supply chain protection of that product to a 3rd party?
- turminal 4y ago
  You're already trusting debian/ubuntu maintainers with your entire system. Why would trusting them with one particular app make any difference?
- drran 4y ago
  > If Ubuntu had spent resources to develop a convenient way for developers to directly provide binaries to the users of their OS No way. I will never trust your binary.
  - mechanical_bear 4y ago
    Lol, like you audit the thousands of lines of code when you compile from source.
    - 411111111111111 4y ago
      What made you think they'd be willing to compile from untrusted sources? There are a lot of users that prefer the established trust model of a Linux distribution. They're willing to trust the mostly unpaid debian maintainers for example... but not John Doe, the temporarily set back billionaire who's just about to make it big
    - drran 4y ago
      Yes, I look at code. I'm professional developer. I will spend 1-2 minutes at scanning per thousand of lines.
      - mechanical_bear 4y ago
        I’m a developer too. Currently job title “senior enterprise systems engineer”. It would take me much longer than that to ensure the code is ok. Additionally without modelling the code (and proving it correct) in something like COQ, you will never understand the calculus of inductive constructions behind the code and have no guarantees as to its correctness.
irthomasthomas 4y ago
It's 5 lines. Took me 30 seconds. Well worth it for the performance gains. wget -O- https://updates.signal.org/desktop/apt/keys.asc https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg && cat signal-desktop-keyring.gpg | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null && echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt https://updates.signal.org/desktop/apt xenial main' |\ sudo tee -a /etc/apt/sources.list.d/signal-xenial.list && sudo apt update && sudo apt install signal-desktop
- marginalia_nu 4y ago
  Yeah, let's teach users to paste sudo commands into the terminal. That's great.
  - rosnd 4y ago
    What alternative do you propose?
    - marginalia_nu 4y ago
      What if there was some sort of a store of snaps where you could download vetted packages with a graphical interface. A snap store, if you will.
      - cyberphobe 4y ago
        Sounds great as long as they get proper permission to distribute the software they’re distributing. Otherwise it’s just another untrusted party in the supply chain
  - hsbauauvhabzb 4y ago
    Unless you audit every line of code the one liner executed, reviewing that one line doesn’t add much value.
  - ChuckNorris89 4y ago
cyberphobe 4y ago
It’s true, they should distribute a .deb that ensures the repo and key are installed so it gets updates. However, your suggestion that they should just capitulate and allow 3rd parties to violate trademark seems like a pretty bad take.
politelemon 4y ago
> It should NEVER be more than 1 line of shell or 2 mouse clicks to install anything. If it is critical or has the potential to compromise security, it should take however many lines that are required to ensure a safe installation. The landscape today is far too complex to expect simple deployments (one liners) to be safe. A few extra lines is a small tradeoff in that case. I shudder when I see curl|bash type installations being normalized.

by dheera 4y ago

iakov 4y ago

All that time you've gained on the installation will be lost during the lethargic start of snapped application :P

tssva 4y ago

Unfortunately, this is the world Signal lives in. For binary debian packages to be installed securely directly from a vendor requires the installation of gpg keys which is what 2 of the 3 commands are regarding. If Ubuntu had spent resources to develop a convenient way for developers to directly provide binaries to the users of their OS instead of developing a system where they are gatekeepers and distribute all packages Signal would now be able to provide an easier secure method of installation. If you were providing a privacy focused product which in some uses that privacy can be the difference between life and death, would you want to turn over supply chain protection of that product to a 3rd party?

turminal 4y ago
You're already trusting debian/ubuntu maintainers with your entire system. Why would trusting them with one particular app make any difference?
drran 4y ago
> If Ubuntu had spent resources to develop a convenient way for developers to directly provide binaries to the users of their OS No way. I will never trust your binary.
- mechanical_bear 4y ago
  Lol, like you audit the thousands of lines of code when you compile from source.
  - 411111111111111 4y ago
    What made you think they'd be willing to compile from untrusted sources? There are a lot of users that prefer the established trust model of a Linux distribution. They're willing to trust the mostly unpaid debian maintainers for example... but not John Doe, the temporarily set back billionaire who's just about to make it big
  - drran 4y ago
    Yes, I look at code. I'm professional developer. I will spend 1-2 minutes at scanning per thousand of lines.
    - mechanical_bear 4y ago
      I’m a developer too. Currently job title “senior enterprise systems engineer”. It would take me much longer than that to ensure the code is ok. Additionally without modelling the code (and proving it correct) in something like COQ, you will never understand the calculus of inductive constructions behind the code and have no guarantees as to its correctness.

irthomasthomas 4y ago

It's 5 lines. Took me 30 seconds. Well worth it for the performance gains. wget -O- https://updates.signal.org/desktop/apt/keys.asc https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg && cat signal-desktop-keyring.gpg | sudo tee -a /usr/share/keyrings/signal-desktop-keyring.gpg > /dev/null && echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt https://updates.signal.org/desktop/apt xenial main' |\ sudo tee -a /etc/apt/sources.list.d/signal-xenial.list && sudo apt update && sudo apt install signal-desktop

marginalia_nu 4y ago
Yeah, let's teach users to paste sudo commands into the terminal. That's great.
- rosnd 4y ago
  What alternative do you propose?
  - marginalia_nu 4y ago
    What if there was some sort of a store of snaps where you could download vetted packages with a graphical interface. A snap store, if you will.
    - cyberphobe 4y ago
      Sounds great as long as they get proper permission to distribute the software they’re distributing. Otherwise it’s just another untrusted party in the supply chain
- hsbauauvhabzb 4y ago
  Unless you audit every line of code the one liner executed, reviewing that one line doesn’t add much value.
- ChuckNorris89 4y ago

cyberphobe 4y ago

It’s true, they should distribute a .deb that ensures the repo and key are installed so it gets updates. However, your suggestion that they should just capitulate and allow 3rd parties to violate trademark seems like a pretty bad take.

politelemon 4y ago

> It should NEVER be more than 1 line of shell or 2 mouse clicks to install anything. If it is critical or has the potential to compromise security, it should take however many lines that are required to ensure a safe installation. The landscape today is far too complex to expect simple deployments (one liners) to be safe. A few extra lines is a small tradeoff in that case. I shudder when I see curl|bash type installations being normalized.