Hacker News Reader

Comment by michaelmrose | Hacker News Reader

If only Microsoft had run with the idea of package management and trusted repos that has existed in open source for decades without restrictions that inspire people NOT to use it. Example to release a debian repo to share your software with your users you have the option to handle hosting/payment if any yourself and keep 100% of the revenue not 70%.

Their position in the market is such that had they started pushing this around the time apt-get started to be a thing they would have had near 100% adoption and users would be used to installing everything that way and would be naturally suspicious of manual installation.

Bad actors could end up on a blacklist that users would opt to enable. You would even have multiple black list sources from people like antivirus vendors etc.

View on HN

Do you really want to live in that world? The world where I have to get past Google's, Apple's (iOS and Mac app store), Debian's and Steam's arbitrary rules about what is and isn't an acceptable app? Where a company/project's current head gets to decide what it is, and isn't, acceptable to install?

One of the reasons Windows flourished was the openness of the platform.

Linux is a much more open platform than windows. It's only downside is that most people think it's difficult to use.

I cannot think of any reasons why you'd think windows is open, especially when comparing it to Linux. You were talking about installing, yet fail to realise that pkg managers aren't the only way. I mean most Linux users regularly compile binaries directly from the source. How is that not open? Perhaps you'd like to elaborate.

Because part of being open is being accessible.

"It was on display at the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying beware of the leopard."

Linux is difficult to use for the kind of person who is downloading software from Download.com - "compiling binaries directly from the source" might as well be Klingon to them. Frankly as a geek I'm much happier with my Mac and Windows machine than I am with Linux. Even now things like the Linux Standard Base not being utterly standard demonstrate that Linux is still aiming for a different market.

There is a gulf between "my Mom is running Debian, she thinks it is Windows, hehehe" and "able to manage a Linux box even remotely competently".

Downloading applications via a package manager is basically the same as downloading applications on your phone via an "App Store" application. (Especially if you are using a package manager with a GUI)

Millions of people use app stores everyday. And I'd say a huge percentage of those people are the ones who would also download a program on their PC from download.com

Which sounds more accessible:

  1) click package-manger program
  2) type the name of the program you want to install
  3) click install

  OR

  1) open web browser
  2) go to http://yahoo.com
  3) type google
  4) click the first link
  5) google "download program_i_want"
  6) click on link leading to "www.download.com/malware/viruses/tracking/program_i_want"
  7) stare at the dozen different DOWNLOAD! buttons, and wonder which one
  8) click the biggest flashiest one
  9) wait for it to finish downloading
    (if it doesn't automatically start and installer)
    a)open File explorer
    b)Go to Downloads folder
    c)wade through the hundreds of other downloads until you find kd457sfjgs_download_app_i_want_setup_INSTALLER.exe.EXE
  10)Once the installer is started click the NEXT button a dozen times, inadvertently installing extra malware each time

Your cognitive dissonance is astounding. With most package managers, unless you know exactly what you want then you're up shit creek. That's assuming you even know what a package manager is, for the millions of people using App Stores every day they'd be completely lost if you asked them to install software on a Linux system.

People often don't go looking for a specific piece of software but rather an idea of what they'd like their software to do. Google and Apple have made tremendous efforts to make their stores discoverable, searchable, and to provide clear feedback and reviews from other users. They also make sure their store icons are front and center on their devices in the hopes that people can find them. The web is also littered with App Store links because the reality is that most people just Google for help.

The unfortunately thing is that there's little commonality or consistency between Linux Distros so if everyone were suddenly on Linux they'd each learn something slightly unique and you'd end up with a lot of frustrated users trying to help each other out while you scoff at them in the corner saying "Hurr durr Linux is easy".

I am guessing this was intended to be something like Ubuntu Software Center, not someone using apt or dpkg straight from the CLI. If I search for 'spreadsheet' in Ubuntu Software Center, I get results that are fairly easy to work with.

In my experience it's more like

    1) apt-get install programiwant
    2) Not found, did you mean libprogramiwant-dev.0.5.1ubuntu01?
    3) apt-get install libprogramiwant-dev.0.5.1ubuntu01
    2) this action will require 0.00001 kb of your 1000TB hard drive, do you want to continue? (Y/n)
    3) This will also install xxxxxx yyyyyy zzzzz xxxyyyyzz yyyyzzzxxx xxxxidontgiveashitaboutthisthirdpartylibraryzzzz xxxyyaaabbb xyayyyxzzzz xxxx-dev list of 1000 packages more, do you want to continue (Y/n)
    4) The following packages has been kept back and will be unloaded aaaa vbbbb aabbbb bbaaa, do you want to continue (Y/n)
    5) bzzzzzzz, loading
    6) The file .abc.etc.conf does not match the source version and will be overwritten by updating xxxxyyyzzz, do you want to (Keep/Local/Source/Abort)
    7) The file .abc.etc.conf01 does not match the source version and will be overwritten by updating xxxxyyyzzz, do you want to (Keep/Local/Source/Abort)
    8) System restart required
    9) programiwant
    10) programiwant: command not found

With ubuntus synaptics package manager you get a fancy GUI on top of this but most of the decisions and endless lists of libraries remain. There's even a "stability level" you have to choose ranging from 1 to 5, good luck with that grandma. Not saying it can't be done, the app stores are a great example of how it can work but there you are stuck inside the walled garden. And even there you still have problem #2 above of finding things, there's just so much crap in the app-store so even if you search for an exact match you will find imposterors trying to ride on the name, minecraft is a great example, search for it on Play store and you will have to scroll through pages and pages of minecraft-guides, blockcrafts, craftmines, minercrafter and whatnot before you even see the real minecraft.

You're being a bit disingenuous in making the latter seem more complicated than it actually is, though. It's only slightly more tedious than a repo, but it's no less accessible.

No, I don't think he is. Not even a bit. Sure, for us techies there's little difference. For your typical non tech user, each of those 10 steps can cause issues. This does not mean they are a moron, just they don't grok IT.

So many will download the file again each time they run it, or spam click next 20x to install, reading nothing. Or just click the topmost, or largest download GIF - which I pretty much guarantee is not the one they should use. Or install loads over the course of the PC's life, but uninstall nothing, leading to buying iPad or new PC basically because they have 4 printer drivers (pointlessly huge things these days), software for their last 3 phones, 234 screensaver apps the child thought was fun, several anti virus (none from a truly legit source).

For the truly non-techies nothing has changed since the days of a web full of crap adsense 5 pagers. Click a link, click another. Main thing that's changed in 15 years? The link probably isn't blue, or underlined.

The level of blind trust shown towards the web, and downloads is terrifying. "It's on the internet, it must be true."

> The level of blind

Is just as high if not higher for a nontechnical user to use Linux. Sure they can look at the source code, but that doesn't mean they'll be able to make sense of it.

What if they try to solve a problem themselves? Googling it will land them on any number of blogs or forums where people post cryptic instructions or link to bash scripts that might as well be black box binaries from their perspective.

>Is just as high if not higher for a nontechnical user to use Linux. Sure they can look at the source code, but that doesn't mean they'll be able to make sense of it.

Except that there is no adware, malware, spyware, or anything else bundled into a Linux repo. The end user may not know what is up, but Debian (and the whole community of package managers) is doing a lot more to protect the end user than CNet, Google or Apple is doing to protect the end user. It is de rigueur that if I install an app from the app store, it will try to spy on me, export my contacts, etc. This is far less likely with a Linux repo.

And when Dell ships a laptop running Debian, they've setup their own repos in the package manager which is along the same lines as installing a trusted root cert in Windows by Lenovo.

The trouble is that these systems are not easy to use and end users have to put their trust somewhere to get a system that is functional for them.

In fact, the malware is often very much too accessible. On these download sites, the software you actually want to download is not the biggest "DOWNLOAD NOW!" link. If you click that, you'll get something completely different. As so many people actually do get - they install accidentally something they weren't looking for, let alone all the malware that comes with it.

Also, the world doesn't end on package repository. In my experience with Linux, a lot of software I want is either very outdated or not in the repository at all. OTOH, for all intents and purposes you can assume that if something can't be found by Google, it doesn't exist.

Yet when I go to grab a piece of software off google I legit have no idea which site to click on.

"Is it speedfan.org or speedfan.net"? I can't remember a concrete example but I've had a few instances of being 50/50 on whether to give up altogether at the risk of getting the wrong thing

The first case only works if you already know the name of the program you want. Otherwise you're funneling straight down the google rabbit hole.

You know you can download .deb files for some stuff and they install fine.

You can download .deb files for everything, and they work great.

You can download all deb files. That's in fact what apt does. It downloads and then installs deb files.

You can also install the wrong .deb files, and wedge your system ;)

The only times I've ever needed to compile a package from its sources was when I was trying to hack away at it.

I've not had to compile a Linux kernel in almost 8 years.

Your argument is specious. You should seriously stop using it. As for the LSB, that hasn't stopped distributions in any way, shape or form. Debian got rid of their LSB meta-package because they didn't need it.

Plus: compiling from source does not mean the code is ad/spyware free.

Ok, assuming that it does not, how many instances in the wild have there been of ad/spyware distributed as source to be compiled on the target machine?

I would imagine that in a world where my mum is compiling from the 'source', the 'source' that she's compiling would be infected in the same way as Download.com is.

"Mom I have told you thousands of times! Configure, make and make install, not configure and make install!"

Ubuntu shipped a spyware package with a few releases. I assume they had a source release with the same package configuration, in which case they were doing exactly that.

Are you referring to the amazon search debacle? Because that does not fall into the same realm, it was very clear that it included this feature from the moment you start it up. It wasn't hidden at all.

That one yes. Many people including the FSF described it as "spyware".

If source distribution was the main way of getting software onto the computers of less technical users then it would be rife.

"Yeah, well I expect the lights had gone out."

Although I guess if this describes Linux, then closed source is generally more like the plans being on display at the local Galactic Council office on Proxima Centauri.

> I mean most Linux users regularly compile binaries directly from the source.

I think not really. It's not that common. Precisely because package management works nicely, you can do an apt-get install or yum install or whatever.

I have compiled Linux kernels and even written device drivers in the past, but in the past 5 years I haven't had a need to compile anything from source.

>I think not really. It's not that common

With 10 years on Linux only I had to do it a few times. I stared doing it more often on FreeBSD, out of my will, not being forced to compile stuff.

There was a lot of building from sources in mid-1990's (Linux 0.99 and all that), but ever since Ubuntu came out, there's been just no need.

I'm not missing that X86Config tweaking, either. But perhaps I've grown old; when I find a laptop that doesn't come up with X in RHEL, I just think it's a bad laptop.

And then comes along a Source Mage user.

Linux is not so much a platform as a toolkit for building them. Some Linux-based systems are very open. Some are completely locked down via code signing (e.g. many routers or DVRs).

Not that many Linux users compile binaries directly from source - and if they did it would completely bypass the protection of the official repositories. Fundamentally there's an unavoidable contradiction here: if you only allow installing software from the official repositories then you have a very locked down system, and if you allow installing software from outside the official repositories then the system is unsafe. Windows went for the second option; contrast with iOS which goes for the first. There are Linux-based systems that take the one approach and Linux-based systems that take the other, but both have their downsides.

> It's only downside is that most people think it's difficult to use.

That's because for most people it is difficult to use. Most people lack the technical vocabulary to even know how to find a solution for an issue on a general purpose Linux machine let alone follow the 20 pages of bash commands necessary to implement whatever highly specific fix someone posted on their blog.

Unfortunately Linux is so open that it allows developers to do whatever the hell they want and you end up with each Distro having a slightly different file structure, different default file systems, instances of software installing it's own versions of tools because it can't be bothered to support a given package manager, configurations being deleted during upgrades because a developer came up with a new way to implement configs, default passwords you shouldn't change because it breaks code, and permissions being twiddled during installations that wreak havoc.

My favorite is all of the half-assed front-ends for configuring software that only work with a small subset of the possible features and only on a particular version of the software with a particular kernel. And if you happen to edit the configs manually to enable a feature not present in the GUI, you'd better not ever load the GUI again because that change will be blown away.

The state of Linux is such that technical users can't even safely upgrade their systems for fear of breaking them. There's nothing like running update on your Distro's package manager De jour and having your Wifi stop working. Was it the driver? The configuration? The GUI that edits the configuration? Or having your PBX web front tell you that updates are available and when you hit install it gets about halfway through installing a list of packages that rivals the phonebook before failing, not rolling back, and making it so your system won't boot if you're foolish enough to attempt a restart.

And if you ask for help what do you get? RTFM! Install MINT! You should use XYZ instead. Run this script I wrote for you...

"It's only downside is that most people think it's difficult to use"

I don't know about that, but I know that none of the tools I use in my field works on Linux, and I'm not talking about rocket science, I'm talking about print and web design.

Openness aside.

Which one of the apps on download.com (that bundle crapware) would not be considered acceptable in a store? What crazy apps wouldn't conform to those rules? And how many people would actually be interested in those apps?

I've jailbroken an iOS device once just to check out what amazing things apple doesn't want in the store. I wasn't impressed; cydia looked like crap, iOS <7 looks bolted in an ipad app, tacky icons everywhere, and the top X downloads were all tacky looking mods for things like the lock screen. That was back when though, I've looked up some lists of stuff and I'll admit some of the available things can be convenient if you're into that sort of thing.

> Do you really want to live in that world? The world where I have to get past Google's, Apple's (iOS and Mac app store), Debian's and Steam's arbitrary rules about what is and isn't an acceptable app?

Actually yes. With the caveat that I can still install applications outside of the repositories and/or install third party repos. With Android and Debian I can. And Steam isn't quite the same since it's an application rather than OS so you can bypass Steam entirely (even on SteamOS).

That way you have some reassurances (albeit no guarantees) about the software you install, plus a method to manually bypass those protections if you so desire.

> One of the reasons Windows flourished was the openness of the platform.

No, that's not the reason. Or at least not the openness of the _software_ platform. The reason Windows flourished was the number of IBM-compatible clones out there and the monopoly Microsoft had -and successfully campaigned to retain for many years- on said hardware. Under those conditions Windows only needed to be "good enough" to compete rather than a market leader in openness, stability, security, nor any other measure that us geeks normally consider.

I have a computer illiterate family member on Ubuntu. He's easily able to install software outside the repo as long as the process is spelled out. See google earth's install process on Ubuntu.

I don't know about the others, but Debian is certainly not trying to decide for you what is and isn't acceptable to install.

Debian does not allow any kind of software in its own repositories, but it does nothing to prevent you from adding whatever repository you like, installing whatever .deb you like, and trusting whatever signing key you want to trust.

Linux solve that by allowing users to add repositories. I don't see why that would not work for Microsoft as well.

That just means malware sites like download.com will tell users to add the download.com repository.

Without curation package managers/app stores don't offer any additional security, but curation inevitably involves trusting somebody to make those decisions. Do you trust Microsoft to do that for most users?

Consider Chromebooks - one can unlock ChromeOS or replace it with Linux, but Google made it rather scary-sounding process for an average user, so malware site has very little chances to convenience the user to do it.

ChromeOS isn't an open platform and Chromebooks are dangerously locked down.

Microsoft could solve these issues on windows by forbidding software that they don't approve. It would undoubtedly improve the security of the platform. But it turns Windows into a walled garden instead of an open platform (consider - would Microsoft have allowed Firefox onto the platform? unlikely)

I do. I run Windows update on any machine that someone asks me to look at.

Debian, that well known walled garden.

Debian, Ubuntu, RedHat, SuSE and a multitude of Linux distributions are doing just fine.

In fact, you can package up your own .rpm or .deb and still install the software. But the likelihood of needing to do so is very, very small. And not only that, but it's extremely easy to see what those packages are made of - you just unzip and untar them and look at the metadata files and scripts.

So yeah, not only do I want to live in that world, I already do.

In fact, so do other Windows users - if they use OneGet or chocolatey. And many, many corporate users also live in that world as software is deployed via SSIS or just bog standard Active Directory.

uhhhhh....

Nothing about apt is walled off at all.

MS set one up with Windows 8, but they botched it. Their rules initially prevented open-source apps from showing up, but haven't properly enforced their own rules such that there are now plenty of clones/name-grabs on open-source projects.

Java is a bad actor. But I don't get to choose to use it or not. If it was up to me I would never use java and its attempts to install malware on my machine, its habbit of bugging me every day with update pop ups, and creating security holes in my browser, etc. But unfortunately if I want to be able to work from home occasionally I need to have software chosen by my employer running on my machine. Putting it on some blacklist wouldn't help.

What if i need a different version of mono? Or a different version of cmake, or some other third party package?

Reply on news.ycombinator.com