>Snaps (not sure about flatpaks and confinement) are far better than the "curl ...|bash", PPA and other installer type vectors, even from your perspective

A bad thing compared to other bad things does not make the bad thing good. If you're missing a package on your distro, bug a package maintainer to build it, or step up and volunteer.

Yeah, because that's totally how software distribution should work. What's so wrong with the vendor just compiling and distributing an application? Why must this be needlessly complicated?

Yes, that is totally how software distribution should work. Vendors cannot be trusted, this has been proven over and over and over again. Having a dispassionate third party do the packaging keeps malware out of your computer. This is why we have browser extensions and android apps that spy on you. This is why we have a snap which was mining cryptocurrency on your computer a few weeks ago. This is why Mozilla can add spyware to Firefox. Vendor publishing is fundamentally broken.

> This is why Mozilla can add spyware to Firefox.

Mozilla has some interesting technical solutions to this problem: https://wiki.mozilla.org/Security/Binary_Transparency

Mozilla is the one adding the spyware, though.

https://blog.mozilla.org/press-uk/2017/10/06/testing-cliqz-i...

>Users who receive a version of Firefox with Cliqz will have their browsing activity sent to Cliqz servers, including the URLs of pages they visit.

And upstream issues such as this one should be fixed in upstream not patched endlessly with every other distro. That's the approach promoted by Arch Linux.

My point is that upstream can't always be trusted. With snaps there's no one between you and a potentially bad actor.

If you don't trust upstream why are you running their code?

I don't think it's reasonable for such a small group of people as Debian developers (or any other maintainers) to review each change looking for potentially malicious code. Especially in codebases as big as Firefox.

Well, you're free to believe that a platform that places you at the mercy of third party comrades who dictate what you can and cannot install or distribute "for your own good" is a good idea.

I disagree. Wholeheartedly.

We're not talking about some shady organization in some ivory tower. Package maintainers are people whose names and email addresses are available to you. Distros are also always looking for volunteers, you can volunteer and steer things the way you want. And if not, then there are dozens of other distros to choose from whose maintainers may agree with you more.

Yes, and look at how well all that fragmentation works.

We're clearly of very different opinions about what personal computing is all about.

Without the "fragmentation" the problem of third parties censoring applications would be even worse and it still wouldn't be any easier to deploy anything. If you want a proprietary centralized service loaded with malware, there are already plenty of those to choose from on other systems, complete with their own gatekeepers.

Neither MacOS nor Windows prevent you from installing any application you desire[0], direct from the vendor. That has only recently begun to change thanks to app stores, which bear a remarkable similarity to package repos.

[0]Ok, there are some hoops regarding unsigned drivers.