7 ms·

Last I tried all three of the semi-popular formats like this, AppImage was the only one that didn't feel fundamentally wrong (though what I gather was the close

Last I tried all three of the semi-popular formats like this, AppImage was the only one that didn't feel fundamentally wrong (though what I gather was the closest thing to an official repository for them looked sketchy as hell—somehow they copied the exact CSS vibe as a content-scraped StackOverflow spam site). But that was a couple years ago. I know Snaps still suck, but haven't messed with Flatpacks since then, so maybe they're better now.

bandrami 4y ago
How many different versions of OpenSSL are running on my laptop right now? Who can say? That's the beauty of flatpak: if you sweep the problems of software management under a big enough rug, they go away and never bother you again.
- Volundr 4y ago
  Until openssl has another vulnerability.
  - yamtaddle 4y ago
    It's a problem of the many-distros model for Linux—or, if you prefer, it's a problem of Linux just being a kernel. You can't just target "Desktop Linux 15" and expect to have all the stuff that Desktop Linux 15 has, including a robust set of basic libraries and a unified GUI stack and standard same-on-every-copy-of-Linux-15 multimedia libraries and services and all that good stuff, and let the OS worry about keeping that secure without breaking your program. Programs end up having to be a lot more fiddly about their dependencies, and it causes problems. Now, maybe the Linux approach is so good and useful in other ways that it's worth putting up with that, but it is a big problem and people are going to solve it, one way or another. If the model can't be changed, then the only solutions available may be bad, but they'll be used, and widely.
    - fijiaarone 4y ago
      Freedom bad.
    - goodpoint 4y ago
      > It's a problem of the many-distros model for Linux No, it is not. If you want security you need dependency management and software lifecycle management on all OSes and platforms.
- IncRnd 4y ago
  Multiple copies of openssl is an problem that updates will hopefully solve. Multiple versions of openssl is a security problem that merely updating cannot solve.
- klooney 4y ago
  Flatpak has a concept of shared base layers, so if you update frequently you might notice 'org.gnome.Sdk' or whatever getting updated. This is a way to handle lots of the most popular shared dependencies. Besides, sufficiently quality minded projects always wind up vendoring all of their dependencies anyway. There's a reason Chrome has their own fork of everything down to the compiler.
  - redeeman 4y ago
    i gotta say, if chrome stands out to you as a shining beacon of quality, i'd hate to hear about what software you consider bad
    - afavour 4y ago
      I know “Chrome bad” is a meme-level comment at this point but it’s a hugely impressive piece of software, basically an operating system unto itself at this point. Not to mention the V8 engine etc. Plenty to criticise about it from a product perspective but from an engineering one it is kind of a marvel.
      - AYoung010 4y ago
        I think there's a strong argument to be made that modern web browsers are a good deal more complex than operating systems -- or at least most kernels.
        jehb 4y ago
        It all depends on how you draw your Venn diagrams, I suppose. Is Chrome a massively complex browser, or is it some window dressing and bookmark syncing sitting on top of Chromium, that itself is really just a simple UI around the Blink rendering engine. GNU/Chrome, anybody?
        klooney 4y ago
        Tbh I kind of see the whole chrome/chromium/blink stack as a single team at Google.
- Gigachad 4y ago
  Why would I care? Ok Spotify has an old package with some vulnerabilities in it. But flatpak has it sandboxed so the worst you could do is maybe steal my Spotify session token. That's more a problem for Spotify than it is for me. They will go and fix their package and I will reset my sessions. Meanwhile we have distros lagging behind for years to provide a new package because they can't break all the things depending on the old version.
  - Rotareti 4y ago
    > Meanwhile we have distros lagging behind for years to provide a new package because they can't break all the things depending on the old version. I'm glad I left this category of problems behind me 5 years ago when I switched both, my personal and my work laptop to arch-linux/i3wm. These two machines have been running for 5 years, almost daily, with almost no issues, with the latest software packages. If the hardware lasts, I will go on like this for another 3 to 5 years and then upgrade hardware and (maybe) switch to wayland. I don't see anything on the horizon which would make me switch away from this setup.
    - andreareina 4y ago
      My only complaint about arch/i3 so far is that updating Firefox forces a restart of Firefox, and I've got FF windows scattered over a few workspaces so I need to sift them back to their places. Come to think of it I can probably prune one of the windows... ETA: and maybe one of the workspaces...
      - 99112000 4y ago
        I'm almost sure this is an excerpt straight from https://youtu.be/7Nj9ZjwOdFQ https://youtu.be/7Nj9ZjwOdFQ
        andreareina 4y ago
        I'm flattered you think I achieve perfect window placement.
- serf 4y ago
  >How many different versions of OpenSSL are running on my laptop right now? Who can say? but that's a problem, too. i'd rather all things on a system be bottleneck-forced into using the latest version of security libraries that my system is actively updating; yes, this causes issues, but not issues like "There was a huge vulnerability found in X version Y, does it affect me?". in other words, i'd rather have system breakage than insecurity. That's a personal taste, I admit. that said, the sandboxing aspect behind 'the new ways' is fantastic.
  - bandrami 4y ago
    I do love the sandboxing, granted. But "let's just hope the app maintainers keep up with our rolling platform deprecations" is a horrible idea.
  - AnIdiotOnTheNet 4y ago
    Why don't you just turny our computer off then? It can't be exploited if it isn't actually running. Which is to say most people use a computer to run software, so if the software doesn't run the security is pointless anyway. Sure, if only some software breaks and you can wait for fixes that's a tradeoff, but given that in package maintainer land those fixes could be months or years away...
    - deleted 4y ago
      [deleted]
- api 4y ago
  That’s what the whole container revolution was about: “fuck it, we’ll just tar up entire Linux file system images to distribute stuff.”
- littlestymaar 4y ago
  > How many different versions of OpenSSL are running on my laptop right now? Who can say? That's the beauty of flatpak And how many of them are critically out of date because the software maintainer didn't update? Who can say? That's the beauty of flatpack (not). With flatpack you have all the downside of static linking with none of its advantages, how exciting. (and there's nothing as cool as having 7 full linux distros installed on your computer at once, just because software can't agree on which base image to use)
  - bandrami 4y ago
    I suppose it shouldn't surprise me that the sarcasm of my comment wasn't apparent to everyone.
    - littlestymaar 4y ago
      Poe's law strikes again.
- goodpoint 4y ago
  > if you sweep the problems of software management under a big enough rug, they go away and never bother you again. ...until attackers find a vulnerability in some library, then you are really in trouble. Just like docker, the bundling of tons of software into opaque blobs is terrible for security.
  - bandrami 4y ago
    Yeah I didn't realize people would take the joke there seriously. It's basically looking at package management and saying "this is hard so we won't try".
    - goodpoint 4y ago
      FWIW personally I detected your sarcasm but I replied knowing that the security risk would fly over people's heads here.
deleted 4y ago
[deleted]
rom-antics 4y ago
I wanted to like AppImage, but it just didn't seem integrated well enough. Flatpak gives you: - Installation (no manually moving files from ~/Downloads) - Launcher integration (no writing .desktop files by hand) - Auto updating As far as I saw, AppImage didn't have any of that. Though it was a while ago (and maybe some of this was my distro's fault). Has any of this improved lately?
- pkulak 4y ago
  Plus, it relies on system libraries like glibc. You can’t even use it on distros like Void and Alpine.
- edflsafoiewq 4y ago
  An AppImage is just a regular binary. Basically if you have a directory containing a binary plus other files it needs (libraries, assets, etc), AppImage packages the whole dir up into a single binary. That's it. Running the AppImage is the same as extracting the dir and running the binary inside it.
  - rom-antics 4y ago
    Right, it's just a binary. And if I'm installing an app, say Audacity, I would never go to GitHub and download the raw binary, because then I'd have to write the desktop file by hand, and also the app would never get updated when new versions are released. Instead I use a package manager or Flatpak. How are people keeping their AppImages updated?
    - edflsafoiewq 4y ago
      I, on the other hand, want exactly that. I've never used a desktop file, and I want to control when and if I upgrade.
      - eviks 4y ago
        You can control when, if, and what, as a feature of a good package manager, no need to throw the baby of convenience with it
lern_too_spel 4y ago
AppImage has no sandboxing. A properly packaged (unfortunately, still a big qualifier) Flatpak is safer to run.
- WesolyKubeczek 4y ago
  The quality of the flatpak's sandbox has been rightfully questioned many times. The most atrocious thing about it is that it's the app publisher who decides what the permissions should be. Little wonder that if you go to flatpak.org, you won't even see the words "sandbox", "safe", or "secure". Nor is their FAQ describing their sandboxing as a security feature, more like (limited) isolation technique. But this isn't stopping flatpak zealots who just won't shut up about the "sandbox == secure" falsehood. I don't know, I'd rather prefer a technology which is upfront about its lack of security than one which has glaring hole in what they call (a false sense of) "security". I treat flatpaks and appimages as mostly equal things and use them to keep and run proprietary stuff so that I know it won't be shitting its guts all over the host system.

bandrami 4y ago

How many different versions of OpenSSL are running on my laptop right now? Who can say? That's the beauty of flatpak: if you sweep the problems of software management under a big enough rug, they go away and never bother you again.

Volundr 4y ago
Until openssl has another vulnerability.
- yamtaddle 4y ago
  It's a problem of the many-distros model for Linux—or, if you prefer, it's a problem of Linux just being a kernel. You can't just target "Desktop Linux 15" and expect to have all the stuff that Desktop Linux 15 has, including a robust set of basic libraries and a unified GUI stack and standard same-on-every-copy-of-Linux-15 multimedia libraries and services and all that good stuff, and let the OS worry about keeping that secure without breaking your program. Programs end up having to be a lot more fiddly about their dependencies, and it causes problems. Now, maybe the Linux approach is so good and useful in other ways that it's worth putting up with that, but it is a big problem and people are going to solve it, one way or another. If the model can't be changed, then the only solutions available may be bad, but they'll be used, and widely.
  - fijiaarone 4y ago
    Freedom bad.
  - goodpoint 4y ago
    > It's a problem of the many-distros model for Linux No, it is not. If you want security you need dependency management and software lifecycle management on all OSes and platforms.
IncRnd 4y ago
Multiple copies of openssl is an problem that updates will hopefully solve. Multiple versions of openssl is a security problem that merely updating cannot solve.
klooney 4y ago
Flatpak has a concept of shared base layers, so if you update frequently you might notice 'org.gnome.Sdk' or whatever getting updated. This is a way to handle lots of the most popular shared dependencies. Besides, sufficiently quality minded projects always wind up vendoring all of their dependencies anyway. There's a reason Chrome has their own fork of everything down to the compiler.
- redeeman 4y ago
  i gotta say, if chrome stands out to you as a shining beacon of quality, i'd hate to hear about what software you consider bad
  - afavour 4y ago
    I know “Chrome bad” is a meme-level comment at this point but it’s a hugely impressive piece of software, basically an operating system unto itself at this point. Not to mention the V8 engine etc. Plenty to criticise about it from a product perspective but from an engineering one it is kind of a marvel.
    - AYoung010 4y ago
      I think there's a strong argument to be made that modern web browsers are a good deal more complex than operating systems -- or at least most kernels.
      - jehb 4y ago
        It all depends on how you draw your Venn diagrams, I suppose. Is Chrome a massively complex browser, or is it some window dressing and bookmark syncing sitting on top of Chromium, that itself is really just a simple UI around the Blink rendering engine. GNU/Chrome, anybody?
        klooney 4y ago
        Tbh I kind of see the whole chrome/chromium/blink stack as a single team at Google.
Gigachad 4y ago
Why would I care? Ok Spotify has an old package with some vulnerabilities in it. But flatpak has it sandboxed so the worst you could do is maybe steal my Spotify session token. That's more a problem for Spotify than it is for me. They will go and fix their package and I will reset my sessions. Meanwhile we have distros lagging behind for years to provide a new package because they can't break all the things depending on the old version.
- Rotareti 4y ago
  > Meanwhile we have distros lagging behind for years to provide a new package because they can't break all the things depending on the old version. I'm glad I left this category of problems behind me 5 years ago when I switched both, my personal and my work laptop to arch-linux/i3wm. These two machines have been running for 5 years, almost daily, with almost no issues, with the latest software packages. If the hardware lasts, I will go on like this for another 3 to 5 years and then upgrade hardware and (maybe) switch to wayland. I don't see anything on the horizon which would make me switch away from this setup.
  - andreareina 4y ago
    My only complaint about arch/i3 so far is that updating Firefox forces a restart of Firefox, and I've got FF windows scattered over a few workspaces so I need to sift them back to their places. Come to think of it I can probably prune one of the windows... ETA: and maybe one of the workspaces...
    - 99112000 4y ago
      I'm almost sure this is an excerpt straight from https://youtu.be/7Nj9ZjwOdFQ https://youtu.be/7Nj9ZjwOdFQ
      - andreareina 4y ago
        I'm flattered you think I achieve perfect window placement.
serf 4y ago
>How many different versions of OpenSSL are running on my laptop right now? Who can say? but that's a problem, too. i'd rather all things on a system be bottleneck-forced into using the latest version of security libraries that my system is actively updating; yes, this causes issues, but not issues like "There was a huge vulnerability found in X version Y, does it affect me?". in other words, i'd rather have system breakage than insecurity. That's a personal taste, I admit. that said, the sandboxing aspect behind 'the new ways' is fantastic.
- bandrami 4y ago
  I do love the sandboxing, granted. But "let's just hope the app maintainers keep up with our rolling platform deprecations" is a horrible idea.
- AnIdiotOnTheNet 4y ago
  Why don't you just turny our computer off then? It can't be exploited if it isn't actually running. Which is to say most people use a computer to run software, so if the software doesn't run the security is pointless anyway. Sure, if only some software breaks and you can wait for fixes that's a tradeoff, but given that in package maintainer land those fixes could be months or years away...
  - deleted 4y ago
    [deleted]
api 4y ago
That’s what the whole container revolution was about: “fuck it, we’ll just tar up entire Linux file system images to distribute stuff.”
littlestymaar 4y ago
> How many different versions of OpenSSL are running on my laptop right now? Who can say? That's the beauty of flatpak And how many of them are critically out of date because the software maintainer didn't update? Who can say? That's the beauty of flatpack (not). With flatpack you have all the downside of static linking with none of its advantages, how exciting. (and there's nothing as cool as having 7 full linux distros installed on your computer at once, just because software can't agree on which base image to use)
- bandrami 4y ago
  I suppose it shouldn't surprise me that the sarcasm of my comment wasn't apparent to everyone.
  - littlestymaar 4y ago
    Poe's law strikes again.
goodpoint 4y ago
> if you sweep the problems of software management under a big enough rug, they go away and never bother you again. ...until attackers find a vulnerability in some library, then you are really in trouble. Just like docker, the bundling of tons of software into opaque blobs is terrible for security.
- bandrami 4y ago
  Yeah I didn't realize people would take the joke there seriously. It's basically looking at package management and saying "this is hard so we won't try".
  - goodpoint 4y ago
    FWIW personally I detected your sarcasm but I replied knowing that the security risk would fly over people's heads here.

deleted 4y ago

[deleted]

rom-antics 4y ago

I wanted to like AppImage, but it just didn't seem integrated well enough. Flatpak gives you: - Installation (no manually moving files from ~/Downloads) - Launcher integration (no writing .desktop files by hand) - Auto updating As far as I saw, AppImage didn't have any of that. Though it was a while ago (and maybe some of this was my distro's fault). Has any of this improved lately?

pkulak 4y ago
Plus, it relies on system libraries like glibc. You can’t even use it on distros like Void and Alpine.
edflsafoiewq 4y ago
An AppImage is just a regular binary. Basically if you have a directory containing a binary plus other files it needs (libraries, assets, etc), AppImage packages the whole dir up into a single binary. That's it. Running the AppImage is the same as extracting the dir and running the binary inside it.
- rom-antics 4y ago
  Right, it's just a binary. And if I'm installing an app, say Audacity, I would never go to GitHub and download the raw binary, because then I'd have to write the desktop file by hand, and also the app would never get updated when new versions are released. Instead I use a package manager or Flatpak. How are people keeping their AppImages updated?
  - edflsafoiewq 4y ago
    I, on the other hand, want exactly that. I've never used a desktop file, and I want to control when and if I upgrade.
    - eviks 4y ago
      You can control when, if, and what, as a feature of a good package manager, no need to throw the baby of convenience with it

lern_too_spel 4y ago

AppImage has no sandboxing. A properly packaged (unfortunately, still a big qualifier) Flatpak is safer to run.

WesolyKubeczek 4y ago
The quality of the flatpak's sandbox has been rightfully questioned many times. The most atrocious thing about it is that it's the app publisher who decides what the permissions should be. Little wonder that if you go to flatpak.org, you won't even see the words "sandbox", "safe", or "secure". Nor is their FAQ describing their sandboxing as a security feature, more like (limited) isolation technique. But this isn't stopping flatpak zealots who just won't shut up about the "sandbox == secure" falsehood. I don't know, I'd rather prefer a technology which is upfront about its lack of security than one which has glaring hole in what they call (a false sense of) "security". I treat flatpaks and appimages as mostly equal things and use them to keep and run proprietary stuff so that I know it won't be shitting its guts all over the host system.