I welcome AppImage and Flatpak.
In his world developers don't do that, they throw a pile of source files into the wind and let package maintainers put it together for a distribution.
_("Warning:\n\n" "This version of xscreensaver is VERY OLD!\n" "Please upgrade!\n" "\n" "http://www.jwz.org/xscreensaver/\n" "\n" "(If this is the latest version that your distro ships, then\n" "your distro is doing you a disservice. Build from source.)\n" ),
YES, THAT WHAT USERS WOULD SEE, if only Debian maintainer haven't removed this patch.
jwz.org/blog/2016/04/i-would-like-debian-to-stop-shipping-xscreensaver/
Thus distros have to work around that by freezing lib versions and any software depending on said lib version for the support period of the distro release (5-10 years).
What is "funny" is that Debian here is doing no different from what RH had been doing with RHEL for ages, yet Debian gets all the flak...
Never mind that xscreensaver has a very prominent splash screen with JWZ's email on it on every launch. Maybe if he didn't want every idiot on the net emailing him, he should not show it in their face all the time. He may be brilliant in some ways, but sometimes he can be an raging asshole.
Hell, sometimes i wonder why he keeps supporting Linux as he seems to have no love for anything but Apple these days.
If you want to view the jwz.org link, copy the URL, and open it in Incognito.
However, there is still a large amount of software out there for which the above does not hold. That software is not currently being installed with a package manager - it is the curl | bash scripts you see all the time, as well as a whole bunch of other more manual methods of downloading and installing. It is this software that solutions like flatpack and snap are for, and it is improving both the security and usability in these cases.
So no. I don't, but that doesn't make curlbash good either.
There are big improvements coming like PipeWire, DConf sandboxing, etc but it will not happen over night.
v_lisivka never mentioned sandboxing as an issue. They were clearly talking about the fact it's a free for all user submitted repo which have a provable history of people adding malware.
From my understanding, Flatpak provides sandboxing and asks the user to confirm exceptions, which if it works reliably does seem like I win something security-wise going from "go to vendor website, use their installation script" to "go to vendor website, get their flatpak thing, know that it can't totally screw my system without me granting it exceptions".
Parent claims it's only a usability benefit, so I'd like to know details about the problems with its sandboxing (totally willing to accept that they exist, sandboxing is tricky and not a cure-all)
On Mac.
This is mostly a sovled problem on Linux. Hell even slackware has this mostly solved.
I will concede there is a lot of Linux users out there either misinformed or simply don't mind the hassle of upgrading via random curl scripts if at all.
Maybe it will help them? Maybe it will just increase the target size making exploitation more worthwhile / likely?
Who knows.
For me, if it's not in the Arch repos (or aur) I'm incredibly unlikely to install it, to the point I don't actually have any software installed out of band other than stuff I specifically work on.
Massive amount of identical work that the WASTE majority of the time, does not improve anything for the end user.
Security should come from moving into well maintained platform, automatic scanners and many users. Instead of the package maintainers being the 'security reviewers' we should have app stores and sub repositories with security reviews.
Nothing stops a distro from only offering flatpaks from their own repo.
Centralizing and automating these things will allow for far better security processes in the long run.
Just try to do some of these steps on 2-3 versions (versions for non-rolling distributions) of each of the following distributions: RHEL, Debian, Ubuntu, Arch, Gentoo.
The Linux distribution ecosystem is insane.
It's also one of the reasons users and proprietary software have been rare on Linux.
It's also one of the reasons users and proprietary software have been rare on Linux.
It may be why proprietary software is lagging, but I think most users prefer an OS level package manager. They just didn't know about them until the Appstore.
The Linux kernel is everywhere thanks to Torvalds (overly late in the opinions of some BSD devs) declaring the API/ABI sacrosanct, and holding the other kernel developers to that (much to the chagrin of some that want to do hail mary changes for sake of security or ego).
But the userspace above had been reimplemented again and again because the various libs and such are fundamentally unstable. In far too many cases you can even do a x.y.z+1 update without getting some kind of breakage.
Often because someone decided that spec adherence was more important than real life stability, and thus pushed a patch through that altered the API behavior to be more in line with a spec that nobody had complained about for a decade or more.
The Appstore works on phones and tablets because they are primarily consumption-only devices, and because users are not given any other choice (also, the installer/uninstaller model has a lot of its own suck). I don't know about you, but that's not what I want out of personal computing.
Nobody is complaining that applications are in a central location.
Edit: I have no idea why you think this is condescending.
Edit response: It is condescending because it imagines the user is incapable or uninterested in the way their system actually works, as a mere pusher of buttons to make the blinkenlights go. Sure, some users are like that, but largely it is a convenient excuse to dismiss criticism.
The market share of any PC desktop operating system has mostly to do with the type of office work that took place in the 90s, when computers took over.
That's slowly changing as the web is taking over, and Chromebooks, Android, Mac, and "regular" Linux desktops becomes a viable platform for sharing your work with others.
Consider that the usecase for a personal desktop computer may be different from that of a smartphone or tablet. There's more to personal computing than a web browser.
Of course an easier to use third party packing system would make the desktop easier to use, but that's not where the pain points are. (Especially since most third party binary packaged software is just something you unpack and run.)
Even the most easy to use packaging system you could imagine wouldn't impact the Linux desktop market share measurably.
Historical reasons like it being an open platform that developers could target without the requirement of third party approval, among other strengths.
Linux doesn't have anything like that traditionally. You have to make a deb, rpm, whatever Gentoo uses, etc. And ./configure && make && make install is laughably unintuitive.
Also, Google have done some serious work to ensure at least some backwards compatibility (and providing a support library, that i fail to recall the exact name of, for backporting various functionality).
While the FOSS world seems to lean on "compile it" along with "lacking resources" as an excuse for not maintaining anything more than incidental compatibility across releases.
The installer/uninstaller paradigm is almost as bad as the package manager paradigm in my opinion.
That's going from trusting 1 person to trusting thousands.
Spotify: https://www.spotify.com/uk/download/linux/
Package maintainers can also be a bad idea! They have the ability to make the user experience worse and create a lot of unnecessary work for vendors. The version of AbiWord on Ubuntu was out of date and unsupported for a while. There was a steady stream of people going through vendor support channels reporting bugs that had been fixed a year previously. The maintainers ignored the vendor's requests to update the package to a more recent, supported version.
You can't blame distribution maintainers for not wanting to expose their users to a constant stream of the newest exciting quirky features the authors have decided to cram into the current release just to be able to keep on top of all of the bugfixes. New releases all also tend to implicitly have new or different sets of dependencies, and distributors have a duty to make sure these various dependencies that exist in their distribution can coexist and interoperate
Authors declaring whatever versions they no longer care about as "unsupported" is a rather unhelpful trait that ignores where their users are (distributions) and what a lot of their users actually want (stability).
I'm sure developers would ideally like to have users suckling at the teat of their latest tagged changeset and perpetually excited about the latest enhancements in each and every release. But really I'd wager that most people, of the ~20-30 applications and desktop components they use every day, by and large... they'd just like most of them to behave like they did yesterday - or last week - or last month - as long as it's reliable.
Yes, and that is a great argument for why the unix model of applications spreading themselves over the file hierarchy and sharing everything is completely broken. Something as simple as updating to the latest and greatest version of an application should not require you to rebuild the entire goddamned OS! That Linux Desktop people don't get this is one of the big reasons there will never be a Year of the Linux Desktop.
The "year of the linux desktop" has always been a red herring. Let's leave 2006 behind, shall we?
How many copies of the Win32 widget interface do you think exist on a Windows installation? I'll give you a clue: it's one. This is because Windows has a defined and stable base system that developers can depend on being there so they don't need to ship their own copy of things in the base system.
Linux has no base system because that would mean agreeing on something.
Back-porting bug fixes isn't really an option at that point.
There are real downsides to the maintainer system - it creates a lot of extra, uninteresting work, and frequently no-one's that interested in doing it, especially for smaller packages. That's why there's so much interest in other models.
To give another example, if you install jupyter-notebook through apt on Ubuntu 18.04 today, you get a version with a security issue (CVE-2018-8768) that upstream released a fix for months ago. Package maintainers are not making anyone safer there.
This isn't some hypothetical, for the record. I'm explaining how this actually works in practice.
You're explaining how this works in response to concrete examples of where it hasn't worked. I understand how distro packaging works for some packages, but I've seen it fall down too many times for others, especially more niche things.
Do maintainers commonly audit source code to look for vulnerabilities? And at any rate, aren't the common security-critical libraries for flatpaks, like OpenSSL, already (in theory) provided and maintained by the runtimes?
All the major consumer OSs distinguish between system components, like cryptographic services and graphics libraries, and user-facing applications. The world hasn't collapsed for them so far, and in an ideal world that distinction allows for better delegation of responsibilities.
In 2006 the security landscape was very different. The common understanding of security being a tremendously subtle issue was much, much lower. A typical system from 2006 was much more trivially exploitable than one today. A lot of things can be said about security attitudes in 2006 vs now.
I can't see any real benefits to the Linux approach and never could. It's one of the reasons I ended up moving to macOS. There's hardly any malware there too and yet app developers build packages themselves.
>The world hasn't collapsed for [major OS vendors] so far
Hell yes it has. Malware and user-hostile is running rampant on the "major" platforms like Windows and macOS. Have you ever used a non-technical person's computer for a few minutes? It's like a warzone.
Personally, I think that says a lot about the Linux desktop and its community.
I have used non-technical people's Windows machines, and they were not a warzone. I've looked over the shoulder of plenty of other people using Windows & Mac computers, and generally not seen any obvious signs of malware infestation. There could be unseen malware lurking, but we can't assume that with no evidence.
Maybe this depends on the non-technical people you know, but it's definitely possible for people to use Windows/Mac computers and not be dropped in a pit of malware.
Flathub isn't trying to replace your package manager for everything, just for graphical desktop apps. As far as I'm concerned, it's more than welcome. I'm tired of hearing about a major release of a desktop app and not having it available for months. Even worse, I'm tired of hearing about a major release, experiencing horrible bugs when the maintainer updates it, and not having any long-term option to install the previous version so that I can get work done.
Flatpak solves all of this and more.