Hacker News Reader

Comment by hartator | Hacker News Reader

The only thing about Linux I never really like is the package system.

Like if you want to install a new software, you usually don’t get .exe or .dmg. If you are lucky, the developer or some fans took the time to package it. Then you can do ‘apt-get’ ‘yum’ or ‘pacman’. However, packages got stalled and sometimes don’t match the original author intent. You can also build from sources, but it takes time and you have to know a bit of CLI. It never felt true freedom to me. But more like whatever the community feels make sense for whatever distribution weird dictactorship. Just a feeling and I still love and support Linux.

View on HN

I have the complete opposite experience. Everything I use is nicely packaged in Debian/Ubuntu. At most I need to add a new package source and then I get automatic updates. In Windows and OSX you used to need to manually install a bunch of packages from a bunch of locations, with very dubious security. No wonder they've both implement app stores.

So strange, as i'm the polar opposite. I vastly prefer having everything update at once and be able to check versions, etc. I use homebrew and chocolately when I'm on macOS or Windows respectively to get that experience back.

I can understand trying to resolve dependencies can be a royal pain, espescially trying to find the distro's specific naming conventions, like libpq-dev vs postgresql-libs

Between Flatpak and AppImages we have good solutions for both people who prefer package managers as well as people who prefer a single file that can be run on double click.

As far as solutions goes, this problem is solved. They just need to be better known by software distributors.

Flatpak is over-engineered garbage. You still can't even install things on different disks without setting up an entirely new 'installation' or whatever they call it. And you still need a repo. Meanwhile I can trivially make most Windows software work from a USB drive I can carry around between computers.

AppImage can do that too, since it is a lot less over-engineered, but sadly very few developers use AppImage and it even distributions like Nitriux that claim to support AppImages don't display icons for them. Could be trivially solved with a standard for embedding icons in ELF, but the unix world hates the very concept of a program that isn't spread all over the file hierarchy and isn't full of hard-coded paths so it'll never happen.

I'm surprised to find that you have good luck with that; last time I looked, it was a nightmare for anything that didn't explicitly support portable mode because everything expects to save stuff into the registry.

There are several tools to help with that, like the PortableApps.com launcher, JauntePE, or even Cameyo. Programs that just use config files can usually be dealt with without those kinds of wrappers by changing an environment variable. But if you don't mind not bringing the config with you (and it often isn't an issue in my experience), you can usually just drop the folder on the drive and you're done.

> Flatpak is over-engineered garbage.

But, it works, especially for the use case of the "I need the latest and greatest versions of two packages".

> AppImage can do that too, since it is a lot less over-engineered, but sadly very few developers use AppImage and it even distributions like Nitriux that claim to support AppImages don't display icons for them.

So, use one of the other 20 distros where AppImages just work, perfectly, out-the-box.

Ignoring the issue with the oft-used fallback of distro roulette as a Linux evangelist defense mechanism, it isn't that they don't work, it's that their icons aren't displayed. There is not a single distro, including the ones that actually supposedly embrace AppImage, which displays AppImage icons correctly.

I agree with you.

The OS should give you only some essential end user applications (a bare-bones text editor, a terminal, a browser) and then the user should get their specific use applications (DAW, 3D modelling software, game engine, etc) from the application developer, not the OS maker.

We appear to be a dying breed. People who don't like walled gardens and middlemen between them and the people who make the tools they use.

There's not necessarily walls in the package manager model, in most cases it's possible to install binaries outside of the package manager.

It's just less convenient.

The same is true of the other walled gardens.

I fail to see how the package management in a Linux distribution could be considered a walled garden. Commonly it's cited as the exact opposite of that (see the table here: [1]). What type of freedom are you missing in something like Debian, where you can edit and recompile the core components of your system at a whim, the system even supporting you through source packages, and where anything outside the package management is just a "git clone" and a compilation away? I really don't know what more anyone could ask for. Certainly we don't want to go back to the 90s way of downloading unsigned .exe files from some random guy's web site and then going hunting for matching DLLs?

[1] https://en.wikipedia.org/wiki/Closed_platform

The freedom to not have to jump through ridiculous hoops like compiling from source just to use an application the distro didn't deem worthy of inclusion in their repo.

So .exe files it is? You can do that on Linux as well, by the way, it's just a horribly insecure way to distribute software.

I keep hearing that, and it is of course possible, but the point is that hardly anyone does it. That's what makes it meaningless that it can be done.

And it isn't insecure. If I trust the developer and get the software from them, it's just as good as trusting a repo maintained by random internets who have been known to not only not keep software in the repo up to date, but actually introduce vulnerabilities that weren't there before!

> to use an application the distro didn't deem worthy of inclusion in their repo.

How did you come to this conclusion? Did you request the package be included in the distro you use? If so, and it wasn't provided, provide the bug report/feature request link ...

My point is I shouldn't have to beg some third party to include it. The developer made it, I want to run it, there's no need for anyone else to be involved in this process.

> The only thing about Linux I never really like is the package system.

I think you just haven't used it enough to understand the advantages. If you don't need the lastest-and-greatest released last week versions, the package system is much more efficient that individually downloading hundreds of packages.

While Mac OS X has homebrew, it is still deficient in my opinion compared to most distros (because casks don't get upgraded by default).

> Like if you want to install a new software, you usually don’t get .exe or .dmg.

Why would I want either? Both have lots of issues. For example, by default: * No auto-update * Duplication of libraries and other files I already have * Spotty updates (e.g. who can be sure whether all libraries used have been patched by the latest version you have)?

> If you are lucky, the developer or some fans took the time to package it.

This is the case for > 99% of the software I use, even obscure stuff. For the other < 1%, I package it for the distro I use, and submit it so it is available by default in future releases.

These days, many popular packages also provide .appimage files (similar to .app files on Mac OS X) or publish Flatpak's (including Slack, Spotify, VS Code, Skype etc. etc.), and these can be used on any recent distro.

> Then you can do ‘apt-get’ ‘yum’ or ‘pacman’. However, packages got stalled and sometimes don’t match the original author intent.

Sometimes the original author doesn't know best ... in most cases packagers upstream their changes or discuss them with upstream.

> You can also build from sources, but it takes time and you have to know a bit of CLI. It never felt true freedom to me. But more like whatever the community feels make sense for whatever distribution weird dictactorship. Just a feeling and I still love and support Linux.

It seems like you never exercised your ability to vote, and think that everyone else is dictating to you ...

Here is what makes Linux work well for me: only run LTS versions. Never build your own kernel. Never install anything that isn't in the package manager.

IS good soviet citizen, never uses software not approved by party.

>Never install anything that isn't in the package manager.

If I wanted to not get any work done I would be using Windows instead.

You clearly have never used Linux in any form. There are multiple package managers, granted.

However, one strength they all share is: "you usually don't get .exe or .dmg"! Absolutely! Apps are integrated and not simply add-ons as they are in Windows or Apple land. When I want to install say libreoffice or wireshark I simply ask the system to install them. I absolutely do not browse the internet and download something, extract it and run some "installer". When I update my system, all apps and the OS are updated in one go.

My system is curated for me, end to end, to a greater or lesser extent. When I update, all my system is updated - OS, apps and all.

I don't think yours is (whatever it is).

> When I update, all my system is updated - OS, apps and all.

Except for when the distro "gods" don't bother updating a package for years, so you always get the "stable" 5-year old version.

Please give me an example. The Linux kernel is about a week old on this laptop. The current version of Windows server is called 2019, the last one was 2016 (rofl)

Most websites also have rpm's and Deb packages.

And when the distro decides you have to give up some software because of a conflict it can't handle.

But you have to live under the wing of your distro mantainers, instead of installing whatever you want from any third party. Isn't Linux supposed to be about freedom?

Yes, you can install software using tarballs, but it's not usable for 90% of users, and not because of the distribution model, but because of the lack of standardization in a good, easy to use application-installing API.

I get the base OS along with a very long list of apps with any distro. For example Arch, Gentoo, Debian, Ubuntu, Fedora, Suse etc - all will curate a lot of apps for me. If I want to go off piste I download the code and crack on. I have several compilers to choose from LLVM, gcc int al out of the box.

tarball installs is pretty much close to the state of Windows app installations. You have to find the bloody things, download them each time and hope you have found the right one and not a trojaned one. Each one needs its own update routine and will not be updated when the rest of the system is updated.

The Windows and Apple software distribution model is archaic compared to all Linux/BSD etc distros.

>tarball installs is pretty much close to the state of Windows app installations.

Except that they're hard to install for a novice user.

>You have to find the bloody things, download them each time and hope you have found the right one and not a trojaned one. Each one needs its own update routine and will not be updated when the rest of the system is updated.

None of those are problems for me, the actual problems are: installing all the dependencies and then executing the make commands. Both of those could be solved with a well designed API.

>The Windows and Apple software distribution model is archaic compared to all Linux/BSD etc distros.

The Windows and apple software distribution works for all my use cases, the Linux model doesn't (eg: if I want many versions of the same package, if I want a package that isn't included in the repos, etc).

Also, from a philosophical and aesthetical point of view, the Windows & Mac distribution model is better: you get your OS from the OS developer, and you get your specific-use applications from the developer of said application. You are not dependent on a single entity that supposedly knows what you need better than you.

> You are not dependent on a single entity that supposedly knows what you need better than you.

This right here is what Linux Desktop doesn't seem to understand. The whole culture is ingrained with the attitude that they do, in fact, know what you need better than you.

> But you have to live under the wing of your distro mantainers, instead of installing whatever you want from any third party. Isn't Linux supposed to be about freedom?

You don't. Yes, but if you don't take advantage of the freedom, that's not freedom's fault.

> Yes, you can install software using tarballs, but it's not usable for 90% of users, and not because of the distribution model, but because of the lack of standardization in a good, easy to use application-installing API.

See Flatpak. Go look at what software is available at https://flathub.org/apps , but both GNOME and KDE have application managers that can install from Flatpak repos (configured to use Flathub by default), and possibly the distro's native package manager as well (via PackageKit).

Or you can also use AppImage files.

If you need the last version of Wireshark, it’s getting complicated. And when you have a setup with Wireshark that works why update it? I am dubious that Wireshark can be an attack vector so security updates won’t be useful. Installing last versions is very straight forward when you are on Osx or Windows. You just go to the website and download it. Plus you get the original binaries not a doctored version to fit whatever launcher and log organization is currenty trending at Ubuntu HQ. Don’t get me wrong I still love my Ubuntus. But this we need to rewrite all software to fit our distributions is not a strenght. I think this line of thinking is kind of shared by Linus himself.

Going to dozens or even hundreds of different websites to download the latest versions of software and then manually installing them all isn’t fast at all.

c.f. apt-get upgrade or similar, which takes a few seconds.

>c.f. apt-get upgrade or similar, which takes a few seconds.

Except when the package isn't included, or it isn't the version you needed, because then you have to spend 40 minutes trying to install all the dependencies and building the package from source, instead of the 3 minutes it would have taken to install an .exe on Windows.

> because then you have to spend 40 minutes trying to install all the dependencies and building the package from source, instead of the 3 minutes it would have taken to install an .exe on Windows.

No, you take 2 minutes to install it using flatpak, or download a .appimage file.

And if neither of those are available, you spend that 40 minutes packaging the software, and submitting it to the distro you use for inclusion.

(If it was already packaged, but not new enough, that's a ~5 min job to do the update for your distro)

> And when you have a setup with Wireshark that works why update it? I am dubious that Wireshark can be an attack vector so security updates won’t be useful.

Ignoring feature enhancements and bug fixes for a moment, do you really think it improbable that there are security issues in a piece of software whose entire job is to sit on the network and record everything that it sees and then translate and interpret it?

If an evil app is already communicating on the web and is already on your computer, what can it gain more?

Wireshark (usually) runs in promiscuous mode; it'd be "an evil app is already able to send something visible from your network interface" - which to be fair, might help for internal uses. It does usually mean that anything on your local network can attack you.

Because the "evil app" is just a specially crafted JPG that your browser opened up that triggers some edge case in the old unpatched version of Wireshark that is inspecting traffic.

You have a very limited imagination. Wireshark is regularly attacked -- it parses random data it gets off the network, therefore it can be attacked using deliberately malformed packets. See https://www.wireshark.org/security/ for more info.

Every single of these vulnerabilities are crashes and infinite loops. The worst thing you can do - if I am running a 5-year old Wireshark - is to make it crash if I am visiting one of your web services. And you probably can already do that in newer versions if you dig enough.

"you usually don't get .exe or .dmg"! Absolutely! Apps are integrated and not simply add-ons as they are in Windows or Apple land. When I want to install say libreoffice or wireshark I simply ask the system to install them. I absolutely do not browse the internet and download something, extract it and run some "installer". When I update my system, all apps and the OS are updated in one go."

I think a lot of this is learned, or conditioned behavior ... there are a great many UNIX packages that could very easily (and very nicely and conveniently) exist as static linked, single file executables.

This is how a lot of software distribution worked in the 90s - for say, some Solaris tool or whatever. Granted, the distribution mechanism (some .edu FTP site somewhere) was totally insecure, but the packaging mechanism was great.

> You clearly have never used Linux in any form.

Can you please edit out personal swipes from your comments here? This one would be fine without that first sentence.

https://news.ycombinator.com/newsguidelines.html

Reply on news.ycombinator.com