3 ms·

It's not a problem with everything. Distributions tend to add editorial input here and try to do something they consider reasonable for their users, staking the

by rlpb 3y ago

It's not a problem with everything. Distributions tend to add editorial input here and try to do something they consider reasonable for their users, staking their own reputation on that without trying to pass it off to the component publisher. For example, I doubt that Debian would would take an update from an upstream that is detrimental to their users. They would follow a friendlier fork first. Debian maintainers follow their users' interests first. (I'm a Debian Developer) Edit: and that means you can generally trust automatic updates on Debian.

account42 3y ago
This is why the push towards application sandboxing and distribution by the developers themselvs is IMO misguided. I'd much rather have my applications run unrestricted but vetted and if neccessary patched by a trusted third party (the distro) than lock whatever dark patters and anti-features developers come up with into a box ... where it still has access to all interactions with that box. In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro.
- rlpb 3y ago
  > In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro. But in the case of something like Firefox, distros are barely vetting anything, and are reluctant to patch because such patching rapidly becomes unmaintainable. Most dependencies don't end up unbundled, either. So distribution Firefox packages are really external packages in distribution package clothing, more so than any other package, really. This is why I want sandboxing anyway - because I understand the limits of what is practical. And sandboxing and limiting interaction through well-defined interfaces is better for security anyway, because security vulnerabilities happen regardless, and sandboxing does provide some level of mitigation. Finally, the distribution packaging model is insufficient for many users. Even if you are fine with it, most users want something newer than their distribution release, and we can see that they are prepared to give up security and system stability for it. This is a real need for these users, and sandboxed third party packaging mechanisms provide a real solution for them, even if you can manage without.

by rlpb 3y ago

account42 3y ago

This is why the push towards application sandboxing and distribution by the developers themselvs is IMO misguided. I'd much rather have my applications run unrestricted but vetted and if neccessary patched by a trusted third party (the distro) than lock whatever dark patters and anti-features developers come up with into a box ... where it still has access to all interactions with that box. In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro.

rlpb 3y ago
> In particular, I wouldn't trust a Firefox distributed by Mozilla without oversight but I still use the Firefox packaged by my distro. But in the case of something like Firefox, distros are barely vetting anything, and are reluctant to patch because such patching rapidly becomes unmaintainable. Most dependencies don't end up unbundled, either. So distribution Firefox packages are really external packages in distribution package clothing, more so than any other package, really. This is why I want sandboxing anyway - because I understand the limits of what is practical. And sandboxing and limiting interaction through well-defined interfaces is better for security anyway, because security vulnerabilities happen regardless, and sandboxing does provide some level of mitigation. Finally, the distribution packaging model is insufficient for many users. Even if you are fine with it, most users want something newer than their distribution release, and we can see that they are prepared to give up security and system stability for it. This is a real need for these users, and sandboxed third party packaging mechanisms provide a real solution for them, even if you can manage without.