3 ms·

I get that you already preempted this, but: Flatpack is a weird extra layer on top of Linux. Most distros have package managers that work just fine. These packa

I get that you already preempted this, but: Flatpack is a weird extra layer on top of Linux. Most distros have package managers that work just fine. These package managers predate Flatpack and basically are the main thing that the distro provides (other than the community, of course).

frollogaston 1y ago
Many Ubuntu or Debian users still use Flatpak, don't they? Even though there's already apt-get.
- binkHN 1y ago
  You, kind of, don't have much of a choice. There's thousands of packages and it's a ton of work. In addition, as Linux continues to get more popular, more vendors are releasing software that doesn't care to work with newer libraries, so Flatpack handles this nicely.
  - frollogaston 1y ago
    I only use Linux on servers, so the kind of stuff I need is always traditional apt-get, but yeah I always assumed using it on a PC would involve tons of snap or flatpak apps where they don't want to deal with the complexities of dependencies. Ok, I do have one spare Linux laptop in my garage that I barely use, and I'm pretty sure how ever I installed Chromium used snap.
    - pjerem 1y ago
      In my experience, most of the apps, even the desktop ones, are still packaged by the distribution. Flatpack is useful for the few ones that aren’t or for actively developed apps that get new useful features frequently.
    - bee_rider 1y ago
      I mostly use Linux on my laptop. I thought you server folks needed this kind of functionality—you guys have to, like, serve stuff, be visible on the network, install weird software for business needs, right? As an individual, I can crank up the firewall, trust all of the people who use my laptop (it is just me) and not install sketchy software.
      - frollogaston 1y ago
        I'm not a server pro, I just use some dev servers at work and have home servers. Most I did was administer the dev servers for small startups where I was mainly a SWE. So what I mean is, I've mostly only used Linux remote+headless and not on my laptop/desktop.
- LtWorf 1y ago
  I don't know anyone who uses it.
- padraic7a 1y ago
  I don't think so. I'm on Ubuntu and mostly use debs (apt), I'll use Snaps if that's the easiest way to get an update. I use Appimages for some ephemeral stuff or when that's the only way developers release it (some 3d printing stuff). I haven't installed Flatpaks at all because it doesn't jibe with the distro overall.
- lproven 1y ago
  Ubuntu? I suspect not. Why would you when Snap is right there and is just as easy? Debian: probably, yes. Ubuntu derivatives such as Mint, Zorin OS, and ArduinOS use Flatpak instead. Others, such as Asmi and Linux Lite, remove snap and offer the user the option of adding it back if they wish.
  - frollogaston 1y ago
    Ah, I thought Ubuntu only had the Debian package manager, but that's not the case anymore.
    - lproven 1y ago
      Good heavens no. This has not been the case for a decade or more! The first version with snap as standard was 16.04 in 2016: https://ubuntu.com/blog/canonical-unveils-6th-lts-release-of-ubuntu-with-16-04 https://ubuntu.com/blog/canonical-unveils-6th-lts-release-of... However Ubuntu Core, its immutable distro built entirely from snap packages, was launched in 2014 and there was a Core version of Ubuntu 12: https://old-releases.ubuntu.com/releases/ubuntu-core/releases/ https://old-releases.ubuntu.com/releases/ubuntu-core/release... There are about half a dozen cross-distro packaging schemes for Linux, including Nix, Guix, AppImage, Flatpak, Snap, and 0install. However two are mainstream and supported by large vendors: Flatpak is from the GNOME organisation and is backed by Red Hat and Fedora, and Snap is a Canonical project and part of Ubuntu, the single most widely-used distribution by a considerable margin.
- fc417fc802 1y ago
  Sure, but not as my first choice.
AlienRobot 1y ago
>Flatpack is a weird extra layer on top of Linux My brother in christ, systemd, x11 and even GNU are weird extra layers on top of Linux. Linux is just the kernel. This is exactly what "redefining Linux so it's never responsible for 99% you need to put on top of Linux to have a functional modern OS" is about.
- bee_rider 1y ago
  I explicitly acknowledged that in the other half of the sentence you partially quoted. I also explained why I thought it was not really right to focus on the deficiencies of Flatpack… so, I’m not sure what the point in repeating that would be. In conclusion, > Linux is […] exactly what […] you need I agree!
- LtWorf 1y ago
  See, that's why calling it "linux" instead of "gnu/linux" confuses people and generates confused comments such as yours :)
CJefferson 1y ago
But those are even worse from this point of view, I have no control over which apps can access my camera, or microphone. I'm personally disappointed that sandboxing isn't easier in Linux. I hoped it would move past Windows and Mac, imagine a world where the majority of libraries are sandboxed too, we only let compression and decompression libraries read one stream and write to another, this would improve security. This has been done by both Google (in Android) and Apple (in iOS and Mac OS X), but hasn't seen general acceptance in Linux (as far as I can tell).
- realusername 1y ago
  Because on Linux, everything is based around trusted security since you have access to the sources whereas on iOS and Android, every single app you install could be a malware so those systems are based on untrusted security.
  - AStonesThrow 1y ago
    Hahaha, oh that is a hilarious attitude, you really believe that F/OSS means that implicit trust can be granted all across the supply chain. That I have access to the source makes a lick of difference in terms of vulnerabilities or exploits that can be found. Once in college I cited Linus's Law in an impassioned apologia for Open Source. And I was duly corrected. Because Linus's Law really has no basis in reality. https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law The reason Linux has such a model of blind trust in system services and applications is because it was based on Unix, which had an even more naïve model, because mostly, it was administrators and authorized users installing that stuff, there was more top-down monitoring and control, and just a smaller incidence of naked malice. It's the same thing we see in earlier versions of Windows, or macOS, or the Internet. Look at the Internet in the mid-90s. Was it secure, with all the open source running on it? Hell naw. Every OS and protocol is vulnerable and attacked, and every OS and protocol revises security models based on modern-day threats. F/OSS saves nobody and mitigates virtually nothing. To answer the GP, sandboxing has to be bolted-in to Linux after the fact. Linux's POSIX model is so old and needs to be so compatible. The only sandboxing in SVR3 Unix was chroot(2), you know? The Docker support and cgroups and virtualization are all new layers, and need careful integration. Nobody says that F/OSS doesn't need sandboxing. Nobody says that F/OSS is so secure that it can deviate from better-secured models. Quite the opposite. Android and iOS are clean starts, mostly; didn't need to be backwards compatible, so they're tuned to the latest threat models of adversarial computing as you describe. But every single app you install on Linux could be a malware, too. I have no idea what "trusted security" or "untrusted security" are, but they aren't real terms of art in Cybersecurity, and they do nothing to describe the provenance or evolution of Linux security (which often has a lot of unused mitigations such as AppArmor or SELinux that get turned off right quick.)
poulpy123 1y ago
if they were working fine there would be not need for flatpak
- einsteinx2 1y ago
  Arguably they are working fine, and there is no need for flatpak. That’s been my personal experience anyway.
- bee_rider 1y ago
  The article is about the fact that work on Flatpack has really slowed down. So it is reasonable to wonder if maybe nobody found it useful enough to work on it.

frollogaston 1y ago

Many Ubuntu or Debian users still use Flatpak, don't they? Even though there's already apt-get.

binkHN 1y ago
You, kind of, don't have much of a choice. There's thousands of packages and it's a ton of work. In addition, as Linux continues to get more popular, more vendors are releasing software that doesn't care to work with newer libraries, so Flatpack handles this nicely.
- frollogaston 1y ago
  I only use Linux on servers, so the kind of stuff I need is always traditional apt-get, but yeah I always assumed using it on a PC would involve tons of snap or flatpak apps where they don't want to deal with the complexities of dependencies. Ok, I do have one spare Linux laptop in my garage that I barely use, and I'm pretty sure how ever I installed Chromium used snap.
  - pjerem 1y ago
    In my experience, most of the apps, even the desktop ones, are still packaged by the distribution. Flatpack is useful for the few ones that aren’t or for actively developed apps that get new useful features frequently.
  - bee_rider 1y ago
    I mostly use Linux on my laptop. I thought you server folks needed this kind of functionality—you guys have to, like, serve stuff, be visible on the network, install weird software for business needs, right? As an individual, I can crank up the firewall, trust all of the people who use my laptop (it is just me) and not install sketchy software.
    - frollogaston 1y ago
      I'm not a server pro, I just use some dev servers at work and have home servers. Most I did was administer the dev servers for small startups where I was mainly a SWE. So what I mean is, I've mostly only used Linux remote+headless and not on my laptop/desktop.
LtWorf 1y ago
I don't know anyone who uses it.
padraic7a 1y ago
I don't think so. I'm on Ubuntu and mostly use debs (apt), I'll use Snaps if that's the easiest way to get an update. I use Appimages for some ephemeral stuff or when that's the only way developers release it (some 3d printing stuff). I haven't installed Flatpaks at all because it doesn't jibe with the distro overall.
lproven 1y ago
Ubuntu? I suspect not. Why would you when Snap is right there and is just as easy? Debian: probably, yes. Ubuntu derivatives such as Mint, Zorin OS, and ArduinOS use Flatpak instead. Others, such as Asmi and Linux Lite, remove snap and offer the user the option of adding it back if they wish.
- frollogaston 1y ago
  Ah, I thought Ubuntu only had the Debian package manager, but that's not the case anymore.
  - lproven 1y ago
    Good heavens no. This has not been the case for a decade or more! The first version with snap as standard was 16.04 in 2016: https://ubuntu.com/blog/canonical-unveils-6th-lts-release-of-ubuntu-with-16-04 https://ubuntu.com/blog/canonical-unveils-6th-lts-release-of... However Ubuntu Core, its immutable distro built entirely from snap packages, was launched in 2014 and there was a Core version of Ubuntu 12: https://old-releases.ubuntu.com/releases/ubuntu-core/releases/ https://old-releases.ubuntu.com/releases/ubuntu-core/release... There are about half a dozen cross-distro packaging schemes for Linux, including Nix, Guix, AppImage, Flatpak, Snap, and 0install. However two are mainstream and supported by large vendors: Flatpak is from the GNOME organisation and is backed by Red Hat and Fedora, and Snap is a Canonical project and part of Ubuntu, the single most widely-used distribution by a considerable margin.
fc417fc802 1y ago
Sure, but not as my first choice.

AlienRobot 1y ago

>Flatpack is a weird extra layer on top of Linux My brother in christ, systemd, x11 and even GNU are weird extra layers on top of Linux. Linux is just the kernel. This is exactly what "redefining Linux so it's never responsible for 99% you need to put on top of Linux to have a functional modern OS" is about.

bee_rider 1y ago
I explicitly acknowledged that in the other half of the sentence you partially quoted. I also explained why I thought it was not really right to focus on the deficiencies of Flatpack… so, I’m not sure what the point in repeating that would be. In conclusion, > Linux is […] exactly what […] you need I agree!
LtWorf 1y ago
See, that's why calling it "linux" instead of "gnu/linux" confuses people and generates confused comments such as yours :)

CJefferson 1y ago

But those are even worse from this point of view, I have no control over which apps can access my camera, or microphone. I'm personally disappointed that sandboxing isn't easier in Linux. I hoped it would move past Windows and Mac, imagine a world where the majority of libraries are sandboxed too, we only let compression and decompression libraries read one stream and write to another, this would improve security. This has been done by both Google (in Android) and Apple (in iOS and Mac OS X), but hasn't seen general acceptance in Linux (as far as I can tell).

realusername 1y ago
Because on Linux, everything is based around trusted security since you have access to the sources whereas on iOS and Android, every single app you install could be a malware so those systems are based on untrusted security.
- AStonesThrow 1y ago
  Hahaha, oh that is a hilarious attitude, you really believe that F/OSS means that implicit trust can be granted all across the supply chain. That I have access to the source makes a lick of difference in terms of vulnerabilities or exploits that can be found. Once in college I cited Linus's Law in an impassioned apologia for Open Source. And I was duly corrected. Because Linus's Law really has no basis in reality. https://en.wikipedia.org/wiki/Linus%27s_law https://en.wikipedia.org/wiki/Linus%27s_law The reason Linux has such a model of blind trust in system services and applications is because it was based on Unix, which had an even more naïve model, because mostly, it was administrators and authorized users installing that stuff, there was more top-down monitoring and control, and just a smaller incidence of naked malice. It's the same thing we see in earlier versions of Windows, or macOS, or the Internet. Look at the Internet in the mid-90s. Was it secure, with all the open source running on it? Hell naw. Every OS and protocol is vulnerable and attacked, and every OS and protocol revises security models based on modern-day threats. F/OSS saves nobody and mitigates virtually nothing. To answer the GP, sandboxing has to be bolted-in to Linux after the fact. Linux's POSIX model is so old and needs to be so compatible. The only sandboxing in SVR3 Unix was chroot(2), you know? The Docker support and cgroups and virtualization are all new layers, and need careful integration. Nobody says that F/OSS doesn't need sandboxing. Nobody says that F/OSS is so secure that it can deviate from better-secured models. Quite the opposite. Android and iOS are clean starts, mostly; didn't need to be backwards compatible, so they're tuned to the latest threat models of adversarial computing as you describe. But every single app you install on Linux could be a malware, too. I have no idea what "trusted security" or "untrusted security" are, but they aren't real terms of art in Cybersecurity, and they do nothing to describe the provenance or evolution of Linux security (which often has a lot of unused mitigations such as AppArmor or SELinux that get turned off right quick.)

poulpy123 1y ago

if they were working fine there would be not need for flatpak

einsteinx2 1y ago
Arguably they are working fine, and there is no need for flatpak. That’s been my personal experience anyway.
bee_rider 1y ago
The article is about the fact that work on Flatpack has really slowed down. So it is reasonable to wonder if maybe nobody found it useful enough to work on it.