4 ms·

I have no broad evidence of this, but I suspect that the more beginner-friendly Linuxes are guilty of a lot of the sins that you laid out here. I seem to rememb

I have no broad evidence of this, but I suspect that the more beginner-friendly Linuxes are guilty of a lot of the sins that you laid out here. I seem to remember some controversy with Canonical recording your searches when hitting the super key, and Ubuntu having Amazon ads built in by default. People who love to geek out about computers can of course install Arch or Gentoo or NixOS Minimal and then audit the packages that they're installing to see that there's no obvious security violations, but it's unrealistic to think that most non-software-engineer people are going to do that. I really don't know how to fix this problem; there will always be an incentive for Microsoft (and every other company) to plaster as many ads as they think that can get away with, as well as collecting as much data as possible. I don't know that I would support regulation on this, but I don't know what else could be done.

lupusreal 2y ago
Debian is a perfectly reasonable choice for casual linux users. Ubuntu's supposed usability improvements over Debian are greatly exaggerated. It's mostly just marketting.
- tombert 2y ago
  Fair enough. I haven't used Debian in quite awhile (I think since 2009 or so?), so I can't speak to current stuff, but I do remember it being pretty hard to install then. I'm sure they have refined it considerably since then, and of course I am fifteen years more experienced now than I was. Personally it's hard for me to go back after I accepted the dogma of NixOS, but maybe if I manage to talk my parents into using Linux I'll install Debian for them.
  - 1oooqooq 2y ago
    install arch. not even kiding. make a "shutdown" button on the desktop that locks everything and do a full upgrade. any issue is solved with, try tomorrow after a reboot. you'd be surprised how fast fixes arrive at rolling distros
    - tombert 2y ago
      I do NixOS-minimal. As far as I'm aware it doesn't really add any runtime overhead in comparison to Arch, the package manager is generally quite good at figuring out which changes are going to break your system, and everything is snapshotted on every rebuild so for the most part I can be fearless. Doing a full upgrade is generally as straightforward as pointing to the latest version's repo and doing something like `sudo nixos-rebuild switch --upgrade`. That works great for a geeky dude like me, but I don't think I'll ever be able to convince my parents on the beauty of NixOS, so having a straightforward mypackage.deb thing that they can download and click on to install stuff probably would be an easier sell. I ran Arch for about a year, and I liked it, but I had to abuse the `snapper` tool because I was constantly breaking things with the video driver and the like. It worked but I personally think that NixOS's model is just more elegant.
      - 1oooqooq 2y ago
        you still need a os. and i fail to see how nix would make video driver problem any better. the problem with running debian is that fixes are often not backported, specifically for things end users will care about, like libre office
        tombert 2y ago
        > you still need a os. and i fail to see how nix would make video driver problem any better. That's actually easy to answer; video drivers can be really finicky to get working. If you screw it up, it's very easy to get into a state where you have no GUI. Nowadays I am proficient enough to work my way around the command line and I probably could fix a bad driver, but 13 years ago that wasn't really the case, and if I broke the GUI there was a risk where I'd have to nuke the machine and start from scratch. I've also had issues where updating the kernel breaks drivers, and I wasn't able to figure out how to downgrade it. With NixOS, since adding packages and boot parameters and the like require a rebuilding of the configuration.nix, and each rebuild takes a snapshot, if something is broken all I have to do is reboot and choose a previous generation to get it into a working state, and I can debug the configuration from there. This actually happened somewhat recently; I had a NixOS server that I was controlling via SSH that I broke the networking support for. It's kind of annoying to control a server if you can't connect to it, but all I had to do is plug in a keyboard and a portable monitor, reboot, and select a previous generation, and fix the broken change, and rebuild. The entire process took like fifteen minutes. > the problem with running debian is that fixes are often not backported, specifically for things end users will care about, like libre office Are there not more evergreen releases of Debian?
  - prmoustache 2y ago
    > do remember it being pretty hard to install then. It has always been easier than windows, which has never stopped the millions of people who used to format their drive and reinstall every few years after suffering from slowdowns.
- progmetaldev 2y ago
  I agree, I discovered Ubuntu around 2003/2004 when they were giving out free CDs to anyone that requested them. Once I discovered that Ubuntu was based on Debian, I started using Debian and wouldn't look back. Even if you need something that only Ubuntu provides, you can get the .deb package for it and install it yourself. I prefer relying on Debian stable if I need to maintain anything for more than a year or two (and am realistic that software usually fails fast, or hangs around for a long time). It's possible that my knowledge is dated at this point, but I always preferred working with the Debian filesystem and tools more than Red Hat/Fedora's filesystem and tools (rpm and yum). Apt and apt-get somehow "clicked" with me more than Red Hat's tools, and I even took multiple classes on Red Hat administration and general usage (although do far less administration in comparison to software development than I used to do in the early 2000's to mid-2010's).
abrouwers 2y ago
I mean, if you have no evidence of this, why even post such an (incorrect) conspiracy theory comment?
- tombert 2y ago
  Well the Amazon ads in Ubuntu absolutely did happen, as well as the searches with the super key. [1] I'll admit it's maybe a bit of an extrapolation to assume that they're as bad as Microsoft, which is why I disclosed that I didn't have a ton of evidence for this. [1] https://www.gnu.org/philosophy/ubuntu-spyware.en.html https://www.gnu.org/philosophy/ubuntu-spyware.en.html I realize that GNU is sort of conspiratorial in its own right, but at least one entity seemed to agree that there's problems with it.
  - bregma 2y ago
    Well, here are the facts (I was an insider at the time, and this is my testimony). Searches were anonymized and sent through Canonical servers to provide extended search result sets. This was configurable and could be disabled. Canonical of course had your IP address so they could reply, just like any and every HTTP server does. Your search query was not stored anywhere or aggregated, and it was not associated back to the originating IP address except to reply. Your privacy was respected and protected at all times. The Amazon search did appear as a plugin in an early prelease. It was never shipped in a released Ubuntu. The goal was to make things as easy as possible, even for the technically averse (who were still commonplace a decade ago), while still respecting and protecting your privacy. Of course, no matter what you do, someone is going to scream for everyone to come witness the oppression inherent in the system. We did it anyway with the expectation of baseless knee-jerk outcry and we were not disappointed.
    - tombert 2y ago
      Yeah, fair enough, I'll admit what I said was probably reductive, and if you worked on it you certainly know a lot more than I do; obviously the engineers at Canonical aren't idiots and they're not mustache-twirling supervillains. Just to be clear, I did run Ubuntu on my laptop for quite awhile (for about two years starting immediately after ZFS got integrated support), and I did like it, so I don't mean to suggest it was a terrible product. I guess I'm just always worried about for-profit companies, because their goal isn't necessarily always aligned with the customer's best interest.
nicce 2y ago
> I seem to remember some controversy with Canonical recording your searches when hitting the super key, and Ubuntu having Amazon ads built in by default. It was also other way around with Microsoft. If you deploy Ubuntu VM in Azure, they contacted you in LinkedIn to offer commercial support. Not joking: https://www.theregister.com/2021/02/11/microsoft_azure_ubuntu_data_sharing/ https://www.theregister.com/2021/02/11/microsoft_azure_ubunt...
abdullahkhalids 2y ago
It's not surprising when a linux distribution was taken over by a capitalistic firm, it decided to forgo good values, and instead prioritized profits over everything else. > I really don't know how to fix this problem Stop using software made by companies that do bad things. Improve the software that doesn't.
- nicce 2y ago
  > Stop using software made by companies that do bad things. Improve the software that doesn't Or stop buying their stock... but that is difficult thing to embrace. As, we know, these companies are very profitable.
  - tombert 2y ago
    I'm not even sure how that's really realistic in the US at least. I think a lot of people with full-time desk jobs have a 401k or a Roth IRA, and most of those are stock-based (which is really the only way to make sure your money doesn't decay in value due to inflation), and those are generally going to be stuff like total-indexes or S&P500-based index funds. There's probably technically something else you could peg it to, so that's probably not strictly true, but I think an awful lot of people are sort of buying Apple stock without fully realizing it.
- tombert 2y ago
  I don't really think that's realistic. I can of course use software from non-profits or something at home, but we all work for a living, and every single job I've had has relied on software from a for-profit company in one way or another. I guess I don't have to be an engineer, but even if I were to go be a cashier at Taco Bell or something, I would still be stuck using a proprietary POS system. Unless I want to go live in a unabomber shed off the grid, I'm probably going to be stuck using software made by companies that do bad things. The software world is overwhelmingly run by Microsoft, Apple, Google, and Oracle (and probably a few others I'm missing), all of which do bad stuff all the time.
pompino 2y ago
> can of course install Arch or Gentoo or NixOS Minimal and then audit the packages that they're installing to see that there's no obvious security violations, but it's unrealistic to think that most non-software-engineer people are going to do that. It's a fantasy to think that random devs can audit kernel/security code. No single person can. Too many lines of code to audit (that you didn't write yourself). Even if you hired a team, by the time the team does the audit, the goalposts have moved with new source code.
- tombert 2y ago
  Sorry, I guess I didn't really mean to imply I was going to dissect everything line by line, but I can at least look to see if every package in there is directly open-source and if there are any packages that are being pulled in that are frequent security concerns. ETA: I know I can technically do that with Ubuntu or Fedora or OpenSUSE as well, it's not like it's a secret which packages they include, but what I like about NixOS Minimal or Arch is that I have to explicitly add every package I want. There are transitive dependencies obviously, so there of course can still be stuff on my machine I'm not happy with, but I still think it's better.
  - kenjackson 2y ago
    > if there are any packages that are being pulled in that are frequent security concerns. As an individual, do you think you can do that? I know a lot of packages with security concerns where CVEs are never issued. You just need to go to their PRs and luck into finding descriptions of a security fix. I doubt this would scale for a given individual.

lupusreal 2y ago

Debian is a perfectly reasonable choice for casual linux users. Ubuntu's supposed usability improvements over Debian are greatly exaggerated. It's mostly just marketting.

tombert 2y ago
Fair enough. I haven't used Debian in quite awhile (I think since 2009 or so?), so I can't speak to current stuff, but I do remember it being pretty hard to install then. I'm sure they have refined it considerably since then, and of course I am fifteen years more experienced now than I was. Personally it's hard for me to go back after I accepted the dogma of NixOS, but maybe if I manage to talk my parents into using Linux I'll install Debian for them.
- 1oooqooq 2y ago
  install arch. not even kiding. make a "shutdown" button on the desktop that locks everything and do a full upgrade. any issue is solved with, try tomorrow after a reboot. you'd be surprised how fast fixes arrive at rolling distros
  - tombert 2y ago
    I do NixOS-minimal. As far as I'm aware it doesn't really add any runtime overhead in comparison to Arch, the package manager is generally quite good at figuring out which changes are going to break your system, and everything is snapshotted on every rebuild so for the most part I can be fearless. Doing a full upgrade is generally as straightforward as pointing to the latest version's repo and doing something like `sudo nixos-rebuild switch --upgrade`. That works great for a geeky dude like me, but I don't think I'll ever be able to convince my parents on the beauty of NixOS, so having a straightforward mypackage.deb thing that they can download and click on to install stuff probably would be an easier sell. I ran Arch for about a year, and I liked it, but I had to abuse the `snapper` tool because I was constantly breaking things with the video driver and the like. It worked but I personally think that NixOS's model is just more elegant.
    - 1oooqooq 2y ago
      you still need a os. and i fail to see how nix would make video driver problem any better. the problem with running debian is that fixes are often not backported, specifically for things end users will care about, like libre office
      - tombert 2y ago
        > you still need a os. and i fail to see how nix would make video driver problem any better. That's actually easy to answer; video drivers can be really finicky to get working. If you screw it up, it's very easy to get into a state where you have no GUI. Nowadays I am proficient enough to work my way around the command line and I probably could fix a bad driver, but 13 years ago that wasn't really the case, and if I broke the GUI there was a risk where I'd have to nuke the machine and start from scratch. I've also had issues where updating the kernel breaks drivers, and I wasn't able to figure out how to downgrade it. With NixOS, since adding packages and boot parameters and the like require a rebuilding of the configuration.nix, and each rebuild takes a snapshot, if something is broken all I have to do is reboot and choose a previous generation to get it into a working state, and I can debug the configuration from there. This actually happened somewhat recently; I had a NixOS server that I was controlling via SSH that I broke the networking support for. It's kind of annoying to control a server if you can't connect to it, but all I had to do is plug in a keyboard and a portable monitor, reboot, and select a previous generation, and fix the broken change, and rebuild. The entire process took like fifteen minutes. > the problem with running debian is that fixes are often not backported, specifically for things end users will care about, like libre office Are there not more evergreen releases of Debian?
- prmoustache 2y ago
  > do remember it being pretty hard to install then. It has always been easier than windows, which has never stopped the millions of people who used to format their drive and reinstall every few years after suffering from slowdowns.
progmetaldev 2y ago
I agree, I discovered Ubuntu around 2003/2004 when they were giving out free CDs to anyone that requested them. Once I discovered that Ubuntu was based on Debian, I started using Debian and wouldn't look back. Even if you need something that only Ubuntu provides, you can get the .deb package for it and install it yourself. I prefer relying on Debian stable if I need to maintain anything for more than a year or two (and am realistic that software usually fails fast, or hangs around for a long time). It's possible that my knowledge is dated at this point, but I always preferred working with the Debian filesystem and tools more than Red Hat/Fedora's filesystem and tools (rpm and yum). Apt and apt-get somehow "clicked" with me more than Red Hat's tools, and I even took multiple classes on Red Hat administration and general usage (although do far less administration in comparison to software development than I used to do in the early 2000's to mid-2010's).

abrouwers 2y ago

I mean, if you have no evidence of this, why even post such an (incorrect) conspiracy theory comment?

tombert 2y ago
Well the Amazon ads in Ubuntu absolutely did happen, as well as the searches with the super key. [1] I'll admit it's maybe a bit of an extrapolation to assume that they're as bad as Microsoft, which is why I disclosed that I didn't have a ton of evidence for this. [1] https://www.gnu.org/philosophy/ubuntu-spyware.en.html https://www.gnu.org/philosophy/ubuntu-spyware.en.html I realize that GNU is sort of conspiratorial in its own right, but at least one entity seemed to agree that there's problems with it.
- bregma 2y ago
  Well, here are the facts (I was an insider at the time, and this is my testimony). Searches were anonymized and sent through Canonical servers to provide extended search result sets. This was configurable and could be disabled. Canonical of course had your IP address so they could reply, just like any and every HTTP server does. Your search query was not stored anywhere or aggregated, and it was not associated back to the originating IP address except to reply. Your privacy was respected and protected at all times. The Amazon search did appear as a plugin in an early prelease. It was never shipped in a released Ubuntu. The goal was to make things as easy as possible, even for the technically averse (who were still commonplace a decade ago), while still respecting and protecting your privacy. Of course, no matter what you do, someone is going to scream for everyone to come witness the oppression inherent in the system. We did it anyway with the expectation of baseless knee-jerk outcry and we were not disappointed.
  - tombert 2y ago
    Yeah, fair enough, I'll admit what I said was probably reductive, and if you worked on it you certainly know a lot more than I do; obviously the engineers at Canonical aren't idiots and they're not mustache-twirling supervillains. Just to be clear, I did run Ubuntu on my laptop for quite awhile (for about two years starting immediately after ZFS got integrated support), and I did like it, so I don't mean to suggest it was a terrible product. I guess I'm just always worried about for-profit companies, because their goal isn't necessarily always aligned with the customer's best interest.

nicce 2y ago

> I seem to remember some controversy with Canonical recording your searches when hitting the super key, and Ubuntu having Amazon ads built in by default. It was also other way around with Microsoft. If you deploy Ubuntu VM in Azure, they contacted you in LinkedIn to offer commercial support. Not joking: https://www.theregister.com/2021/02/11/microsoft_azure_ubuntu_data_sharing/ https://www.theregister.com/2021/02/11/microsoft_azure_ubunt...

abdullahkhalids 2y ago

It's not surprising when a linux distribution was taken over by a capitalistic firm, it decided to forgo good values, and instead prioritized profits over everything else. > I really don't know how to fix this problem Stop using software made by companies that do bad things. Improve the software that doesn't.

nicce 2y ago
> Stop using software made by companies that do bad things. Improve the software that doesn't Or stop buying their stock... but that is difficult thing to embrace. As, we know, these companies are very profitable.
- tombert 2y ago
  I'm not even sure how that's really realistic in the US at least. I think a lot of people with full-time desk jobs have a 401k or a Roth IRA, and most of those are stock-based (which is really the only way to make sure your money doesn't decay in value due to inflation), and those are generally going to be stuff like total-indexes or S&P500-based index funds. There's probably technically something else you could peg it to, so that's probably not strictly true, but I think an awful lot of people are sort of buying Apple stock without fully realizing it.
tombert 2y ago
I don't really think that's realistic. I can of course use software from non-profits or something at home, but we all work for a living, and every single job I've had has relied on software from a for-profit company in one way or another. I guess I don't have to be an engineer, but even if I were to go be a cashier at Taco Bell or something, I would still be stuck using a proprietary POS system. Unless I want to go live in a unabomber shed off the grid, I'm probably going to be stuck using software made by companies that do bad things. The software world is overwhelmingly run by Microsoft, Apple, Google, and Oracle (and probably a few others I'm missing), all of which do bad stuff all the time.

pompino 2y ago

> can of course install Arch or Gentoo or NixOS Minimal and then audit the packages that they're installing to see that there's no obvious security violations, but it's unrealistic to think that most non-software-engineer people are going to do that. It's a fantasy to think that random devs can audit kernel/security code. No single person can. Too many lines of code to audit (that you didn't write yourself). Even if you hired a team, by the time the team does the audit, the goalposts have moved with new source code.

tombert 2y ago
Sorry, I guess I didn't really mean to imply I was going to dissect everything line by line, but I can at least look to see if every package in there is directly open-source and if there are any packages that are being pulled in that are frequent security concerns. ETA: I know I can technically do that with Ubuntu or Fedora or OpenSUSE as well, it's not like it's a secret which packages they include, but what I like about NixOS Minimal or Arch is that I have to explicitly add every package I want. There are transitive dependencies obviously, so there of course can still be stuff on my machine I'm not happy with, but I still think it's better.
- kenjackson 2y ago
  > if there are any packages that are being pulled in that are frequent security concerns. As an individual, do you think you can do that? I know a lot of packages with security concerns where CVEs are never issued. You just need to go to their PRs and luck into finding descriptions of a security fix. I doubt this would scale for a given individual.