4 ms·

I hope the community really gets behind Snap or Flatpak or one of the other systems for bringing a modern permissions and privileges system to the Linux desktop

I hope the community really gets behind Snap or Flatpak or one of the other systems for bringing a modern permissions and privileges system to the Linux desktop. It would help me be a lot more comfortable recommending Linux to non-technical people. What distro would you recommend to somebody like me who wants to be asked before an application gets access to my location, microphone, camera, network, etc...?

avgcorrection 3y ago
[deleted]
- bmicraft 3y ago
  It's a well known fact that firefox startup time when packaged as snap is significantly worse. This should be less noticeable for actual use. > On Firefox 119 I thought I was losing my mental faculties (even more) since I kept losing track of the cursor for a whole day. Turns out that it’s a Windows “feature” where you hide the cursor when you start typing into some input box. Maybe this is a Firefox-wide regression on Linux though. Difficult to find other examples of it on Linux via Google. Firefox hides the cursor while typing, but it should unhide as soon as it's moved (at least it does for me) > - More fun than a problem: `firefox --version` spews a warning: `update.go:85: cannot change mount namespace according to change mount ...` > - My dear XCompose wasn’t respected because of course you have to copy it to inside some dang `/home/me/snap/common/utensils/computer-applicances/apps/Firefox` tree Those should both be snap specific. > - The keyboard just does not work sometimes. No other apps seem to have this problem. So it’s apparently not some idiotic “applications that use X work but under Wayland it doesn’t” (or vice versa). Does a restart help? No. Seemingly only a computer reboot. I don't know about that one. Could be Ubuntu or snap, but it does not happen on Arch. Out of curiosity, are you running firefox through xwayland or native wayland? (It says so on the about:support page under "Window Protocol")
  - deleted 3y ago
    [deleted]
- AtlasBarfed 3y ago
  Now try saving something from Firefox. By default, it shoves it into some parallel file system within the snap. Oh did you forget to actually explicitly save it into the downloads directory? Yeah, you have no idea where it is now. Oh and of course when the download file explorer widget opens up, you can't get the mouse focus. Probably because there's some security boundary between Firefox and the file system. Usability of firefoxes vastly decreased as a result of snaps Finally, well this isn't a big deal to me. Apparently a lot of the open source people don't like it because the Firefox nap is basically just a call. The internet pull down binary command that pulls a huge binary blob and they don't like this.
  - avgcorrection 3y ago
    Yes! Downloading things in Firefox has been annoying too now that you mention it.
    - ComputerGuru 3y ago
      I know what you meant but generally really unfair to even mention or phrase it like that. “Downloading things in snap” is more correct. Snap has done such a disservice to open source software’s perceived quality.
      - avgcorrection 3y ago
        Ok.
  - antod 3y ago
    Weird. I use the Firefox snap (due to my lazy inertia), and my saves/downloads are all in $HOME/Downloads I don't think I did anything to change that either.
- signaru 3y ago
  This is why I've been using Firefox downloaded directly from Mozilla for a while now instead of the broken one shipped with Ubuntu. I just need to manually update via the "Help -> About" every once in a while, but things look much better otherwise.
  - avgcorrection 3y ago
    Thanks, I’ll try that soon. Chrome has nothing that Firefox doesn’t have, for me. As long as it works. :)
  - ComputerGuru 3y ago
    You don’t need to do that. You can install it via apt from the Mozilla ppa, then it updates automatically along with everything else.
    - signaru 3y ago
      It's nearly a year now that I am using Ubuntu 22.04 (and that the Firefox from Mozilla has no problems) so I don't remember all the details. I also tried using the apt version of Firefox as others also suggested. But it eventually got automatically replaced with the snap version after an update.
      - ComputerGuru 3y ago
        Yes, it’s stupid. Recent Ubuntu releases have added meta packages to apt that actually instruct snap to install instead. You have to first add the Mozilla Firefox ppa and then use apt pinning to say that you want the “Firefox” package from this repo and not that one. But then it works forever after.
bmicraft 3y ago
The thing about snap and flatpak is, that while canonical is heavily pushing snaps, the community seems to be mostly behind flatpak. What this boils down to for regular use is that some big companies only offer a snap for their proprietary app while most open source stuff seems to be on flatpak. With significant overlap of course.
AtlasBarfed 3y ago
Snaps are a dumpster fire on Ubuntu. In particular Firefox. Flatpak... I tried a dosbox flatpak and it was 3 gigs. Regular package? 3 megs. I run Linux mint to avoid them as much as possible. All of the flatpaks pretend nobody has files somewhere other than the home directory, and softlinks don't work. Have a mdadm raid in /mnt? Can't see it. So basic frequent use cases can't be supported by a "modern security and permission system". Then no thanks. All communication of this with the developers of snap, for example, are dismissed with a high amount of condescension. Which is pretty typical with most things whenever you have to deal with security. They imposed the dogma, and you have to comply to it. And the delay whenever the snap has to interact with the file system, there's like a 5 second delay every time it happens. When trying to access a SSD based file system. That is unacceptable Look we do not have infinite Moore's law steppings, or gigahertz of serial speed coming down the pipeline. Moore's law is running out. We can't be adopting some system like a stealing light, 50% of the practical performance of the user interface. Hard disc drives are going to start to not get bigger. The technologies we use for increasing the size of hard disk now already reduce the reliability of the drive. So snaps in their elk really are not something I look forward to. For now just run the distro's lake Linux mint which doesn't use them
- fanatic2pope 3y ago
  > I tried a dosbox flatpak and it was 3 gigs. Regular package? 3 megs. You are counting the runtime size. That is shared between all apps that use the same runtime. As I already had it installed for another app, the download size for the dosbox flatpak on my fedora machine was 1.6MB. I also recommend installing flatseal to easily see and manage file access permissions of flatpak apps.
  - deleted 3y ago
    [deleted]
smoldesu 3y ago
Ideally, we get the best of both worlds. The isolation technology that Flatpak uses (bubblewrap) isn't exclusive to Flatpaked apps, so someone could probably make a distro with isolation by-default if they were motivated enough. > What distro would you recommend to somebody like me who wants to be asked before an application gets access Use an immutable distro like Silverblue or Kinoite. Those are more-or-less Flatpak-only, extremely stable and fairly rigid with security.
- ElectricalUnion 3y ago
  > The isolation technology that Flatpak uses (bubblewrap) isn't exclusive to Flatpacked I wish flatpacked apps actually used the isolation (most don't, so http://flatkill.org/2020/ http://flatkill.org/2020/ is still true today) but that isolation is mostly under the control of the packager, not you. On this point, Deno ( https://docs.deno.com/runtime/manual/basics/permissions https://docs.deno.com/runtime/manual/basics/permissions ) and pledge.com ( https://justine.lol/pledge https://justine.lol/pledge ) are better; you have to explicitly allow-list what you want, instead of hoping that the potentially very untrustworthy and third-party packager had your best interests in mind and denylisting what you don't want.
  - ForkMeOnTinder 3y ago
    Most casual users want to see a quick list of permissions and just click allow---not build their own allowlist for every app they download. If you want to build the allowlist yourself, doesn't firejail already do what you want?
    - criddell 3y ago
      It would be nice to grant permissions in a fine grained way and not just have a blanket accept or reject. For example, if I download a weather app, chances are it will want location and internet access. If I don't want it to have my precise location I should be able to deny location but grant access to the internet.
ragnese 3y ago
As someone who has been using Linux exclusively for my personal machines since 2007, here's the chicken-and-egg problem that the Linux world is constantly battling: new technology is always being released and pushed out before it actually works. It's happened constantly since I started using Linux: KDE 4.0, PulseAudio, btrfs (to be fair, most distros didn't really push btrfs as a default), Wayland, etc, and now Flatpak and Snap. And it's not to say that I don't understand the dilemma: you need to get user feedback to improve the tech, and the pool of Linux users is very small (for desktop stuff). But what that means is that desktop Linux is almost always in a state of partial brokenness. (And please also note that I'm giving a 100% pass on driver issues--that's a given when hardware manufacturers simply only care about working with Windows.) Honestly, when it comes to "just working," desktop Linux is worse today than it was when I first installed it on my budget laptop in 2007. Wayland is mostly fine for my uses, but others still struggle with its missing features; snaps/flatpaks are slow, bloated, and have strange behaviors because of the permissions models that are NEVER going to be obvious to a casual computer user; and managing an Ubuntu install is still really bad UX. As an example of the latter, I usually run an "expert" distro on my personal machines, but I decided to slap Ubuntu on a PC that I hooked up to my TV, and after a year or so of just chugging along and running updates whenever prompted, it started displaying errors that my boot partition was full. You've gotta be kidding me... THIS is supposed to be the "easy" distro for normal humans? How the hell do you expect non-tech people to micromanage the /boot partition and delete old kernels and shit? So, while I agree with all of the technical issues and complaints about things like permissions, security, etc, that advocate for Wayland and Flatpaks/Snaps and whatever, you can't pretend to care about adoption while also pushing out half-baked technology to "stable" versions as though everyone will be happy with beta-at-best functionality.
- babypuncher 3y ago
  I think part of it is because a lot of these more user-oriented features (desktop compositing, sandboxed app stores, hdr, etc.) don't get a lot of attention on Linux until after the two major commercial operating systems get them and prove people actually want them. The monied interests driving a lot of Linux development do not have the same need for these things as end users. To them, Linux is a server, or a lightweight embedded OS, or needed for some other specialized use case.
amelius 3y ago
Snap can't even fix basic things. Like running stuff over X11, or having your homedir on a different harddrive than /.
tehbeard 3y ago
Snap can die in a fire. Flatpak... I'll warily try it for "user facing" apps. But after a clusterfuck of trying to get a flatpak Jellyfin to work (HW accel fell over, and it wanted me to dumpster dive into flatseal to unsandbox it so that media OUTSIDE OF HOME could be accessed... never got around to looking at getting it to even boot at startup) I'll shy the hell away from it for daemons.
throw555chip 3y ago
> I hope the community really gets behind Snap or Flatpak NO. No. No. No Snap. No flatpak. No rolling release distribution nightmares either. Standard LTS for me (with snap and flatpak disabled with an apt preferences file).
- bmicraft 3y ago
  A standard stable LTS system with the ability to update your gui apps is basically what flatpak is all about. I agree though that Canonical is trying too hard to move system packages over to snaps.
akvadrako 3y ago
Enough of the the community is behind Flatpak that it's possible to run an immutable distro and get most of your apps as flatpaks without much trouble. Snap is terrible; there is no reason to consider it. Mostly because there is only one app store allowed and it's really slow to launch apps.

avgcorrection 3y ago

[deleted]

bmicraft 3y ago
It's a well known fact that firefox startup time when packaged as snap is significantly worse. This should be less noticeable for actual use. > On Firefox 119 I thought I was losing my mental faculties (even more) since I kept losing track of the cursor for a whole day. Turns out that it’s a Windows “feature” where you hide the cursor when you start typing into some input box. Maybe this is a Firefox-wide regression on Linux though. Difficult to find other examples of it on Linux via Google. Firefox hides the cursor while typing, but it should unhide as soon as it's moved (at least it does for me) > - More fun than a problem: `firefox --version` spews a warning: `update.go:85: cannot change mount namespace according to change mount ...` > - My dear XCompose wasn’t respected because of course you have to copy it to inside some dang `/home/me/snap/common/utensils/computer-applicances/apps/Firefox` tree Those should both be snap specific. > - The keyboard just does not work sometimes. No other apps seem to have this problem. So it’s apparently not some idiotic “applications that use X work but under Wayland it doesn’t” (or vice versa). Does a restart help? No. Seemingly only a computer reboot. I don't know about that one. Could be Ubuntu or snap, but it does not happen on Arch. Out of curiosity, are you running firefox through xwayland or native wayland? (It says so on the about:support page under "Window Protocol")
- deleted 3y ago
  [deleted]
AtlasBarfed 3y ago
Now try saving something from Firefox. By default, it shoves it into some parallel file system within the snap. Oh did you forget to actually explicitly save it into the downloads directory? Yeah, you have no idea where it is now. Oh and of course when the download file explorer widget opens up, you can't get the mouse focus. Probably because there's some security boundary between Firefox and the file system. Usability of firefoxes vastly decreased as a result of snaps Finally, well this isn't a big deal to me. Apparently a lot of the open source people don't like it because the Firefox nap is basically just a call. The internet pull down binary command that pulls a huge binary blob and they don't like this.
- avgcorrection 3y ago
  Yes! Downloading things in Firefox has been annoying too now that you mention it.
  - ComputerGuru 3y ago
    I know what you meant but generally really unfair to even mention or phrase it like that. “Downloading things in snap” is more correct. Snap has done such a disservice to open source software’s perceived quality.
    - avgcorrection 3y ago
      Ok.
- antod 3y ago
  Weird. I use the Firefox snap (due to my lazy inertia), and my saves/downloads are all in $HOME/Downloads I don't think I did anything to change that either.
signaru 3y ago
This is why I've been using Firefox downloaded directly from Mozilla for a while now instead of the broken one shipped with Ubuntu. I just need to manually update via the "Help -> About" every once in a while, but things look much better otherwise.
- avgcorrection 3y ago
  Thanks, I’ll try that soon. Chrome has nothing that Firefox doesn’t have, for me. As long as it works. :)
- ComputerGuru 3y ago
  You don’t need to do that. You can install it via apt from the Mozilla ppa, then it updates automatically along with everything else.
  - signaru 3y ago
    It's nearly a year now that I am using Ubuntu 22.04 (and that the Firefox from Mozilla has no problems) so I don't remember all the details. I also tried using the apt version of Firefox as others also suggested. But it eventually got automatically replaced with the snap version after an update.
    - ComputerGuru 3y ago
      Yes, it’s stupid. Recent Ubuntu releases have added meta packages to apt that actually instruct snap to install instead. You have to first add the Mozilla Firefox ppa and then use apt pinning to say that you want the “Firefox” package from this repo and not that one. But then it works forever after.

bmicraft 3y ago

The thing about snap and flatpak is, that while canonical is heavily pushing snaps, the community seems to be mostly behind flatpak. What this boils down to for regular use is that some big companies only offer a snap for their proprietary app while most open source stuff seems to be on flatpak. With significant overlap of course.

AtlasBarfed 3y ago

Snaps are a dumpster fire on Ubuntu. In particular Firefox. Flatpak... I tried a dosbox flatpak and it was 3 gigs. Regular package? 3 megs. I run Linux mint to avoid them as much as possible. All of the flatpaks pretend nobody has files somewhere other than the home directory, and softlinks don't work. Have a mdadm raid in /mnt? Can't see it. So basic frequent use cases can't be supported by a "modern security and permission system". Then no thanks. All communication of this with the developers of snap, for example, are dismissed with a high amount of condescension. Which is pretty typical with most things whenever you have to deal with security. They imposed the dogma, and you have to comply to it. And the delay whenever the snap has to interact with the file system, there's like a 5 second delay every time it happens. When trying to access a SSD based file system. That is unacceptable Look we do not have infinite Moore's law steppings, or gigahertz of serial speed coming down the pipeline. Moore's law is running out. We can't be adopting some system like a stealing light, 50% of the practical performance of the user interface. Hard disc drives are going to start to not get bigger. The technologies we use for increasing the size of hard disk now already reduce the reliability of the drive. So snaps in their elk really are not something I look forward to. For now just run the distro's lake Linux mint which doesn't use them

fanatic2pope 3y ago
> I tried a dosbox flatpak and it was 3 gigs. Regular package? 3 megs. You are counting the runtime size. That is shared between all apps that use the same runtime. As I already had it installed for another app, the download size for the dosbox flatpak on my fedora machine was 1.6MB. I also recommend installing flatseal to easily see and manage file access permissions of flatpak apps.
- deleted 3y ago
  [deleted]

smoldesu 3y ago

Ideally, we get the best of both worlds. The isolation technology that Flatpak uses (bubblewrap) isn't exclusive to Flatpaked apps, so someone could probably make a distro with isolation by-default if they were motivated enough. > What distro would you recommend to somebody like me who wants to be asked before an application gets access Use an immutable distro like Silverblue or Kinoite. Those are more-or-less Flatpak-only, extremely stable and fairly rigid with security.

ElectricalUnion 3y ago
> The isolation technology that Flatpak uses (bubblewrap) isn't exclusive to Flatpacked I wish flatpacked apps actually used the isolation (most don't, so http://flatkill.org/2020/ http://flatkill.org/2020/ is still true today) but that isolation is mostly under the control of the packager, not you. On this point, Deno ( https://docs.deno.com/runtime/manual/basics/permissions https://docs.deno.com/runtime/manual/basics/permissions ) and pledge.com ( https://justine.lol/pledge https://justine.lol/pledge ) are better; you have to explicitly allow-list what you want, instead of hoping that the potentially very untrustworthy and third-party packager had your best interests in mind and denylisting what you don't want.
- ForkMeOnTinder 3y ago
  Most casual users want to see a quick list of permissions and just click allow---not build their own allowlist for every app they download. If you want to build the allowlist yourself, doesn't firejail already do what you want?
  - criddell 3y ago
    It would be nice to grant permissions in a fine grained way and not just have a blanket accept or reject. For example, if I download a weather app, chances are it will want location and internet access. If I don't want it to have my precise location I should be able to deny location but grant access to the internet.

ragnese 3y ago

As someone who has been using Linux exclusively for my personal machines since 2007, here's the chicken-and-egg problem that the Linux world is constantly battling: new technology is always being released and pushed out before it actually works. It's happened constantly since I started using Linux: KDE 4.0, PulseAudio, btrfs (to be fair, most distros didn't really push btrfs as a default), Wayland, etc, and now Flatpak and Snap. And it's not to say that I don't understand the dilemma: you need to get user feedback to improve the tech, and the pool of Linux users is very small (for desktop stuff). But what that means is that desktop Linux is almost always in a state of partial brokenness. (And please also note that I'm giving a 100% pass on driver issues--that's a given when hardware manufacturers simply only care about working with Windows.) Honestly, when it comes to "just working," desktop Linux is worse today than it was when I first installed it on my budget laptop in 2007. Wayland is mostly fine for my uses, but others still struggle with its missing features; snaps/flatpaks are slow, bloated, and have strange behaviors because of the permissions models that are NEVER going to be obvious to a casual computer user; and managing an Ubuntu install is still really bad UX. As an example of the latter, I usually run an "expert" distro on my personal machines, but I decided to slap Ubuntu on a PC that I hooked up to my TV, and after a year or so of just chugging along and running updates whenever prompted, it started displaying errors that my boot partition was full. You've gotta be kidding me... THIS is supposed to be the "easy" distro for normal humans? How the hell do you expect non-tech people to micromanage the /boot partition and delete old kernels and shit? So, while I agree with all of the technical issues and complaints about things like permissions, security, etc, that advocate for Wayland and Flatpaks/Snaps and whatever, you can't pretend to care about adoption while also pushing out half-baked technology to "stable" versions as though everyone will be happy with beta-at-best functionality.

babypuncher 3y ago
I think part of it is because a lot of these more user-oriented features (desktop compositing, sandboxed app stores, hdr, etc.) don't get a lot of attention on Linux until after the two major commercial operating systems get them and prove people actually want them. The monied interests driving a lot of Linux development do not have the same need for these things as end users. To them, Linux is a server, or a lightweight embedded OS, or needed for some other specialized use case.

amelius 3y ago

Snap can't even fix basic things. Like running stuff over X11, or having your homedir on a different harddrive than /.

tehbeard 3y ago

Snap can die in a fire. Flatpak... I'll warily try it for "user facing" apps. But after a clusterfuck of trying to get a flatpak Jellyfin to work (HW accel fell over, and it wanted me to dumpster dive into flatseal to unsandbox it so that media OUTSIDE OF HOME could be accessed... never got around to looking at getting it to even boot at startup) I'll shy the hell away from it for daemons.

throw555chip 3y ago

> I hope the community really gets behind Snap or Flatpak NO. No. No. No Snap. No flatpak. No rolling release distribution nightmares either. Standard LTS for me (with snap and flatpak disabled with an apt preferences file).

bmicraft 3y ago
A standard stable LTS system with the ability to update your gui apps is basically what flatpak is all about. I agree though that Canonical is trying too hard to move system packages over to snaps.

akvadrako 3y ago

Enough of the the community is behind Flatpak that it's possible to run an immutable distro and get most of your apps as flatpaks without much trouble. Snap is terrible; there is no reason to consider it. Mostly because there is only one app store allowed and it's really slow to launch apps.