3 ms·

30K packages in Debian, nearly 20 years after it was first released. I know many apps are broken into multiple packages. By contrast, Apple's & Google's app sto

30K packages in Debian, nearly 20 years after it was first released. I know many apps are broken into multiple packages. By contrast, Apple's & Google's app stores have ~700K apps each, less than five years after they started. I don't believe Debian could handle that kind of scaling. I have given this thought. My issue with the current model is that, because packages tend to be several months out of date, third parties increasingly point users to their own installers or packages instead of those in the repos. MongoDB and Google Chrome are two examples. Besides making installation more awkward, this dilutes the security value of having the repository in the first place. The repository model only provides security if users don't need to install things outside it. I want to keep the centralised repository/app store with security guarantees - I think that's valuable for most users. But the responsibility for handling packaging and updating applications needs to shift from the distro to the application developers. This is only for applications, though: system components - core libraries, runtimes, window managers etc. - should still be managed cohesively by the distribution.

Nursie 14y ago
Chrome had a debian repo.... and I use chromium anyway, or firefox/iceweasel. What is a core library or runtime? Where do I draw the line? How do I know that app X is going to rely on the same version as app Y? Google and Apples' app stores are (comparatively) full of toys and crap, I'm sorry to say. If 1% of the stuff in there is useful I'll eat my hat* . They also have the advantage of targeting a single language and runtime, anything else has to be packaged with the app itself. I don't think this is a good or useful model for an open source ecosystem. For an open source platform and closed source ecosystem you may be on the money. (* disclaimer - author does not currently own a hat)
- takluyver 14y ago
  Drawing the line: almost any categorisation has debatable cases, but that doesn't mean it's not worth doing. It's quite obvious that an app like Firefox is different from something like Qt or Python. Dependencies: the distribution provides, e.g. Qt 4.8 and Python 2.7. Applications that support the distribution work on those versions because their developers knew that's what they needed to support. That's how it already works for open source apps. Usefulness: if the user wants a shiny toy, they'll go and get one. If that turns out to carry malware, it's just as much of a problem as if they were trying to install something 'useful'. It's not about what you consider useful, it's about what users want to use. Why should you care: when a new version of, say, Libreoffice comes out, why should I have to wait 2-8 months before I can benefit from it, on the 6 month distro release cycle? Windows users can upgrade the same day. Some things, like Firefox, now get fast-tracked updates, but there isn't the manpower for any distro to do that for all apps.
  - Nursie 14y ago
    I guess you and I use/view software differently. To me the new version hasn't really been released for my 'OS' until the distro packages it. When using a stability-oriented distro like debian, that's important. Usefulness: if the user wants a shiny toy, they'll go and get one. If there's something that's not in the standard repos then I have to consider taking the same steps as a Windows user - geting something with less that 100% trust and less than guaranteed stability. Usually at this point I'll look for an alternative that's better supported. I'm not trying to claim I am in any way representative, but my behaviour differs markedly from what your 'user' does. BTW - There is absolutely nothing to stop someone working on top of a 'normal' distro stuff to deliver cutting-edge apps. In fact it's pretty much been Ubuntu's selling point. It's also what Steam is doing. Just please don't ask distros to stop doing what they do best - make the seamless and painless experience that's made various forms of Linux my platform of choice for many years now.
Nursie 14y ago
I guess I'm trying to say - as a user why would I care if someone else packages the app? All I'm going to get is more security risks (multiple versions of libraries from all sorts of sources) and less compatibility (third party packagers will screw it up as they're not focussed on my distro).
lhnn 14y ago
I suppose it wouldn't be absurd to have another repository in Ubuntu, say, for unvalidated packages, kind of like the PPA, but without having to manually add the PPA to your repo. If, along with main/universe/multiverse/restricted, they had "badlands" or something, that contained all packages that would otherwise be in a PPA, it could be more scalable.

Nursie 14y ago

Chrome had a debian repo.... and I use chromium anyway, or firefox/iceweasel. What is a core library or runtime? Where do I draw the line? How do I know that app X is going to rely on the same version as app Y? Google and Apples' app stores are (comparatively) full of toys and crap, I'm sorry to say. If 1% of the stuff in there is useful I'll eat my hat* . They also have the advantage of targeting a single language and runtime, anything else has to be packaged with the app itself. I don't think this is a good or useful model for an open source ecosystem. For an open source platform and closed source ecosystem you may be on the money. (* disclaimer - author does not currently own a hat)

takluyver 14y ago
Drawing the line: almost any categorisation has debatable cases, but that doesn't mean it's not worth doing. It's quite obvious that an app like Firefox is different from something like Qt or Python. Dependencies: the distribution provides, e.g. Qt 4.8 and Python 2.7. Applications that support the distribution work on those versions because their developers knew that's what they needed to support. That's how it already works for open source apps. Usefulness: if the user wants a shiny toy, they'll go and get one. If that turns out to carry malware, it's just as much of a problem as if they were trying to install something 'useful'. It's not about what you consider useful, it's about what users want to use. Why should you care: when a new version of, say, Libreoffice comes out, why should I have to wait 2-8 months before I can benefit from it, on the 6 month distro release cycle? Windows users can upgrade the same day. Some things, like Firefox, now get fast-tracked updates, but there isn't the manpower for any distro to do that for all apps.
- Nursie 14y ago
  I guess you and I use/view software differently. To me the new version hasn't really been released for my 'OS' until the distro packages it. When using a stability-oriented distro like debian, that's important. Usefulness: if the user wants a shiny toy, they'll go and get one. If there's something that's not in the standard repos then I have to consider taking the same steps as a Windows user - geting something with less that 100% trust and less than guaranteed stability. Usually at this point I'll look for an alternative that's better supported. I'm not trying to claim I am in any way representative, but my behaviour differs markedly from what your 'user' does. BTW - There is absolutely nothing to stop someone working on top of a 'normal' distro stuff to deliver cutting-edge apps. In fact it's pretty much been Ubuntu's selling point. It's also what Steam is doing. Just please don't ask distros to stop doing what they do best - make the seamless and painless experience that's made various forms of Linux my platform of choice for many years now.

Nursie 14y ago

I guess I'm trying to say - as a user why would I care if someone else packages the app? All I'm going to get is more security risks (multiple versions of libraries from all sorts of sources) and less compatibility (third party packagers will screw it up as they're not focussed on my distro).

lhnn 14y ago

I suppose it wouldn't be absurd to have another repository in Ubuntu, say, for unvalidated packages, kind of like the PPA, but without having to manually add the PPA to your repo. If, along with main/universe/multiverse/restricted, they had "badlands" or something, that contained all packages that would otherwise be in a PPA, it could be more scalable.