3 ms·

As great as flatpaks are for providing sandboxing, the problem with them is that they are upstream software. When Audacity added telemetry it only affected bina

As great as flatpaks are for providing sandboxing, the problem with them is that they are upstream software. When Audacity added telemetry it only affected binaries downloaded from them, not distro-compiled binaries. When firefox stops you from loading your own extensions, that's because you're using a binary downloaded from them, not distro-compiled binaries. A decade ago I used to think distro package maintainers were unnecessary middlemen who were just introducing failure points (like the Debian openssl fuckup), but today they are truly the last line of defence from malicious upstreams. Even if something sneaks into a distro package it's possible to convince the distro package maintainer to disable it, because the maintainer's interests are aligned with you and not upstream.

akvadrako 3y ago
But you can get alternatives which have the telemetry removed. Like VSCodium and some Firefox forks. And instead of every distro needing to do those patches themselves, they can share the effort.
- Arnavion 3y ago
  Maintaining a firefox fork is a much bigger job than putting `--with-unsigned-addon-scopes=app --allow-addon-sideload` in the package build script. Distros already share effort implicitly because maintainers of distro X often look at what distro Y is doing for that package. Also users compare distros frequently and will tell the maintainer of distro X that the same thing works with distro Y.
- rlpb 3y ago
  But a user has to know to look for these alternatives. Use a distro you trust and you don't have to.
TommyTran732 3y ago
This doesn't make *any* sense. Even in the example you gave, Mozilla really wanted to block you from using extensions, they will just remove the entire store.
- Arnavion 3y ago
  It doesn't make sense because you need to read carefully. I said "loading your own extensions", ie loading extensions not from their store but by dropping a .xpi in /usr/lib/firefox/browser/extensions that you made running `zip` and changing the filename.
audidude 3y ago
The example you gave, Audacity, has a flatpak managed by one of the flathub admins, and most definitely does not include telemetry. https://github.com/flathub/org.audacityteam.Audacity https://github.com/flathub/org.audacityteam.Audacity
- Arnavion 3y ago
  1. My point was about using upstream software, not about the Audacity flatpak specifically. Audacity binaries downloaded from upstream's website have the problem I mentioned. 2. The Audacity flatpak is maintained by a Flathub dev only because Audacity upstream has not expressed an interest in maintaining it themselves, not because of some Flathub policy to reject telemetry etc. If they wanted to maintain the flatpak themselves they would be allowed to do that, since Flathub policy is to have upstream developers maintain their flatpaks. And that would lead to the problem I mentioned.
iudqnolq 3y ago
Conversely Debian broke Firefox's ability to update without requiring a restart.
- kiwijamo 3y ago
  Can you expand? I thought updates required a restart no matter what platform or distro.
  - iudqnolq 3y ago
    I misremembered. The effect is that you don't get the "Restart required" message, but the implementation is that they just postpone applying the update until your next re-open. > We also are not trying to force you to install updates before you can keep using Firefox. Firefox's update mechanism downloads updates while it is running and installs them at startup. ... In the case of Bug 1705217, the package manager updates Firefox's files on its own schedule that is outside of Firefox's control ... Firefox had no intention of forcing updates to be installed at an inconvenient time. https://bugzilla.mozilla.org/show_bug.cgi?id=1761859 https://bugzilla.mozilla.org/show_bug.cgi?id=1761859
    - Arnavion 3y ago
      That is not a difference in behavior between distro packages and upstream Firefox. If an update gets installed then FF requires you to restart it. So just like the upstream binary's updater doesn't install the update while you're still running it, you shouldn't update the distro package while you're still running it either.
      - iudqnolq 3y ago
        No, if you update upstream Firefox you'll see a prompt inviting you to restart when you want. If you update distro Firefox you'll see a page blocking everything telling you you need to update now. That's because upstream Firefox separates out downloading and applying the update.

akvadrako 3y ago

But you can get alternatives which have the telemetry removed. Like VSCodium and some Firefox forks. And instead of every distro needing to do those patches themselves, they can share the effort.

Arnavion 3y ago
Maintaining a firefox fork is a much bigger job than putting `--with-unsigned-addon-scopes=app --allow-addon-sideload` in the package build script. Distros already share effort implicitly because maintainers of distro X often look at what distro Y is doing for that package. Also users compare distros frequently and will tell the maintainer of distro X that the same thing works with distro Y.
rlpb 3y ago
But a user has to know to look for these alternatives. Use a distro you trust and you don't have to.

TommyTran732 3y ago

This doesn't make *any* sense. Even in the example you gave, Mozilla really wanted to block you from using extensions, they will just remove the entire store.

Arnavion 3y ago
It doesn't make sense because you need to read carefully. I said "loading your own extensions", ie loading extensions not from their store but by dropping a .xpi in /usr/lib/firefox/browser/extensions that you made running `zip` and changing the filename.

audidude 3y ago

The example you gave, Audacity, has a flatpak managed by one of the flathub admins, and most definitely does not include telemetry. https://github.com/flathub/org.audacityteam.Audacity https://github.com/flathub/org.audacityteam.Audacity

Arnavion 3y ago
1. My point was about using upstream software, not about the Audacity flatpak specifically. Audacity binaries downloaded from upstream's website have the problem I mentioned. 2. The Audacity flatpak is maintained by a Flathub dev only because Audacity upstream has not expressed an interest in maintaining it themselves, not because of some Flathub policy to reject telemetry etc. If they wanted to maintain the flatpak themselves they would be allowed to do that, since Flathub policy is to have upstream developers maintain their flatpaks. And that would lead to the problem I mentioned.

iudqnolq 3y ago

Conversely Debian broke Firefox's ability to update without requiring a restart.

kiwijamo 3y ago
Can you expand? I thought updates required a restart no matter what platform or distro.
- iudqnolq 3y ago
  I misremembered. The effect is that you don't get the "Restart required" message, but the implementation is that they just postpone applying the update until your next re-open. > We also are not trying to force you to install updates before you can keep using Firefox. Firefox's update mechanism downloads updates while it is running and installs them at startup. ... In the case of Bug 1705217, the package manager updates Firefox's files on its own schedule that is outside of Firefox's control ... Firefox had no intention of forcing updates to be installed at an inconvenient time. https://bugzilla.mozilla.org/show_bug.cgi?id=1761859 https://bugzilla.mozilla.org/show_bug.cgi?id=1761859
  - Arnavion 3y ago
    That is not a difference in behavior between distro packages and upstream Firefox. If an update gets installed then FF requires you to restart it. So just like the upstream binary's updater doesn't install the update while you're still running it, you shouldn't update the distro package while you're still running it either.
    - iudqnolq 3y ago
      No, if you update upstream Firefox you'll see a prompt inviting you to restart when you want. If you update distro Firefox you'll see a page blocking everything telling you you need to update now. That's because upstream Firefox separates out downloading and applying the update.