4 ms·

If the distros continue to have their "app store" feel, where you get apps from distro maintainers as a trusted provider, then vaildating the barest amount of s

by lhnn 14y ago

If the distros continue to have their "app store" feel, where you get apps from distro maintainers as a trusted provider, then vaildating the barest amount of security and usability for programs uploaded to their archives would be even more of a chore. It would also tax bandwidth and drive space, FWIW. Windows got/gets away with it because they provide the OS and a few apps, and says, "go to download.com for all your needs!".

acabal 14y ago
To clarify I think moving towards the Windows approach is precisely what Linux needs. It rightly shifts responsibility away from the distro to the app maintainer. This is not incompatible with the central-sourced model like "apt-get install x"; there could be some central list of non-core packages plus 3rd-party download links that is hosted on a Canonical server. App developers would push their updated app information to that list, and everyone using the OS benefits without having to wait 6 months for Canonical to curate the next edition of their clockwork galaxy. I'm just spitballing here but the point is that theoretically we could still have something apt-get-ish and not rely on Canonical as the curator.
- dale-cooper 14y ago
  Could just take debian/ubuntu, remove all library dependencies from all packages and recompile them statically i guess. Not really sure if it's worth it. There's nothing stopping you from running something like debian stable and then manually downloading and installing things like Firefox, which is exactly what you would do on windows.
- Nursie 14y ago
  "To clarify I think moving towards the Windows approach is precisely what Linux needs." WT-actual-F? A model where people are trained to download and install random unvalidated garbage from the internet and live with the ad/crap/spy/mal-ware that that entails? Please god no. You can, if you want, install new repos and PPAs into ubuntu and debian quite easily, and yes running a decent repo takes maintainance. It's also the reason why debian stable is rock solid.
  - CJefferson 14y ago
    I already download and install lots of source package, which doesn't seem particularly any better than windows. How many github repositories bother building a deb package?
    - Nursie 14y ago
      Compared to the stuff you need to go out and find from somewhere on Windows, the amount of things available from apt on deb or ubuntu is incredible. You have to go to the web for a basic working system for windows, this is not the case on linux.
- takluyver 14y ago
  I agree, the model where the distro has to maintain packages for every application doesn't really scale. Ubuntu is moving towards this - they're encouraging developers to submit new applications to an App-Store like interface. There's still some centralised checking, but packaging and updating is the responsibility of the authors. There have been some teething troubles with reviewing applications, but I think the plan is to automate more of it.
  - Nursie 14y ago
    That's fine, but as a user this puts that sort of app on an entirely different footing from the 'I know this is going to work because the OS guys did it' that I get from official repos. I'm not sure how you can say it doesn't really scale. Last I saw there were 30K packages in debian. I'm not arguing that there should be no other way of installing anything here, but I would think very hard before criticising the current model. It works extremely well.
    - takluyver 14y ago
      30K packages in Debian, nearly 20 years after it was first released. I know many apps are broken into multiple packages. By contrast, Apple's & Google's app stores have ~700K apps each, less than five years after they started. I don't believe Debian could handle that kind of scaling. I have given this thought. My issue with the current model is that, because packages tend to be several months out of date, third parties increasingly point users to their own installers or packages instead of those in the repos. MongoDB and Google Chrome are two examples. Besides making installation more awkward, this dilutes the security value of having the repository in the first place. The repository model only provides security if users don't need to install things outside it. I want to keep the centralised repository/app store with security guarantees - I think that's valuable for most users. But the responsibility for handling packaging and updating applications needs to shift from the distro to the application developers. This is only for applications, though: system components - core libraries, runtimes, window managers etc. - should still be managed cohesively by the distribution.
      - 14y ago
- vacri 14y ago
  If you want a 'newer-than-distro' program, just use a PPA. It's a solved problem.
  - 4ad 14y ago
    No, it's not a solved problem since PPAs are Ubuntu specific both in the sense that nobody else is using them and in the sense that if someone makes a PPA that package depends on a specific Ubuntu release and won't work on any distribution. There needs to be a way for developers to provide distribution agnostic binaries. Distros can choose to provide whatever package management tools that consume the developer-produced raw data.
    - Nursie 14y ago
      "PPAs are Ubuntu specific both in the sense that nobody else is using them and in the sense that if someone makes a PPA that package depends on a specific Ubuntu release and won't work on any distribution." Well, you can use them on debian, other distros (Fedora etc) have a different model with equivalents. "There needs to be a way for developers to provide distribution agnostic binaries." Why? With source the distro maintainers can choose to build it as they like, apply patches if they feel the need, tweak it to run against the lib versions they have decided on etc etc. This is what makes linux distros great, that the binaries are built with and as part of the system. "Distros can choose to provide whatever package management tools that consume the developer-produced raw data." Big of you to allow them that freedom...
    - runeks 14y ago
      > There needs to be a way for developers to provide distribution agnostic binaries. Distros can choose to provide whatever package management tools that consume the developer-produced raw data. What prevents developers from providing statically linked binaries in PPAs right now?
      - Nursie 14y ago
        Nothing at all. I don't think there's really a developer appetite for doing this stuff. There is for commercial server software, but then folks working on that tend to target ultra-stable platforms.
- jcastro 14y ago
  Ubuntu has had something like this for a while now: https://myapps.developer.ubuntu.com/dev/ https://myapps.developer.ubuntu.com/dev/

by lhnn 14y ago

acabal 14y ago

To clarify I think moving towards the Windows approach is precisely what Linux needs. It rightly shifts responsibility away from the distro to the app maintainer. This is not incompatible with the central-sourced model like "apt-get install x"; there could be some central list of non-core packages plus 3rd-party download links that is hosted on a Canonical server. App developers would push their updated app information to that list, and everyone using the OS benefits without having to wait 6 months for Canonical to curate the next edition of their clockwork galaxy. I'm just spitballing here but the point is that theoretically we could still have something apt-get-ish and not rely on Canonical as the curator.

dale-cooper 14y ago
Could just take debian/ubuntu, remove all library dependencies from all packages and recompile them statically i guess. Not really sure if it's worth it. There's nothing stopping you from running something like debian stable and then manually downloading and installing things like Firefox, which is exactly what you would do on windows.
Nursie 14y ago
"To clarify I think moving towards the Windows approach is precisely what Linux needs." WT-actual-F? A model where people are trained to download and install random unvalidated garbage from the internet and live with the ad/crap/spy/mal-ware that that entails? Please god no. You can, if you want, install new repos and PPAs into ubuntu and debian quite easily, and yes running a decent repo takes maintainance. It's also the reason why debian stable is rock solid.
- CJefferson 14y ago
  I already download and install lots of source package, which doesn't seem particularly any better than windows. How many github repositories bother building a deb package?
  - Nursie 14y ago
    Compared to the stuff you need to go out and find from somewhere on Windows, the amount of things available from apt on deb or ubuntu is incredible. You have to go to the web for a basic working system for windows, this is not the case on linux.
takluyver 14y ago
I agree, the model where the distro has to maintain packages for every application doesn't really scale. Ubuntu is moving towards this - they're encouraging developers to submit new applications to an App-Store like interface. There's still some centralised checking, but packaging and updating is the responsibility of the authors. There have been some teething troubles with reviewing applications, but I think the plan is to automate more of it.
- Nursie 14y ago
  That's fine, but as a user this puts that sort of app on an entirely different footing from the 'I know this is going to work because the OS guys did it' that I get from official repos. I'm not sure how you can say it doesn't really scale. Last I saw there were 30K packages in debian. I'm not arguing that there should be no other way of installing anything here, but I would think very hard before criticising the current model. It works extremely well.
  - takluyver 14y ago
    30K packages in Debian, nearly 20 years after it was first released. I know many apps are broken into multiple packages. By contrast, Apple's & Google's app stores have ~700K apps each, less than five years after they started. I don't believe Debian could handle that kind of scaling. I have given this thought. My issue with the current model is that, because packages tend to be several months out of date, third parties increasingly point users to their own installers or packages instead of those in the repos. MongoDB and Google Chrome are two examples. Besides making installation more awkward, this dilutes the security value of having the repository in the first place. The repository model only provides security if users don't need to install things outside it. I want to keep the centralised repository/app store with security guarantees - I think that's valuable for most users. But the responsibility for handling packaging and updating applications needs to shift from the distro to the application developers. This is only for applications, though: system components - core libraries, runtimes, window managers etc. - should still be managed cohesively by the distribution.
    - 14y ago
vacri 14y ago
If you want a 'newer-than-distro' program, just use a PPA. It's a solved problem.
- 4ad 14y ago
  No, it's not a solved problem since PPAs are Ubuntu specific both in the sense that nobody else is using them and in the sense that if someone makes a PPA that package depends on a specific Ubuntu release and won't work on any distribution. There needs to be a way for developers to provide distribution agnostic binaries. Distros can choose to provide whatever package management tools that consume the developer-produced raw data.
  - Nursie 14y ago
    "PPAs are Ubuntu specific both in the sense that nobody else is using them and in the sense that if someone makes a PPA that package depends on a specific Ubuntu release and won't work on any distribution." Well, you can use them on debian, other distros (Fedora etc) have a different model with equivalents. "There needs to be a way for developers to provide distribution agnostic binaries." Why? With source the distro maintainers can choose to build it as they like, apply patches if they feel the need, tweak it to run against the lib versions they have decided on etc etc. This is what makes linux distros great, that the binaries are built with and as part of the system. "Distros can choose to provide whatever package management tools that consume the developer-produced raw data." Big of you to allow them that freedom...
  - runeks 14y ago
    > There needs to be a way for developers to provide distribution agnostic binaries. Distros can choose to provide whatever package management tools that consume the developer-produced raw data. What prevents developers from providing statically linked binaries in PPAs right now?
    - Nursie 14y ago
      Nothing at all. I don't think there's really a developer appetite for doing this stuff. There is for commercial server software, but then folks working on that tend to target ultra-stable platforms.
jcastro 14y ago
Ubuntu has had something like this for a while now: https://myapps.developer.ubuntu.com/dev/ https://myapps.developer.ubuntu.com/dev/