Hacker News Reader

Comment by rlpb | Hacker News Reader

> Applications in this store cannot be patched, or pinned. You can’t audit them, hold them, modify them...

I think it should be noted that this generally applies to the addition of "third party apt repositories" in general, use of which is the problem that snaps fix[1]

Some snaps are built from Free Software and reproducible sources, as are some third party apt repositories.

In other words, if this criticism bothers you, then you should never install from any third party apt repositories ever. If some are acceptable to you, then so should some snaps.

If you don't want to use third party software ever, then you can still use Ubuntu without snaps.

[1] Third party apt repositories often break users' systems.

View on HN

> if this criticism bothers you, then you should never install from any third party apt repositories ever.

This does not follow at all. Third-party apt repositories work just like Ubuntu's apt repositories; you have just as much ability to audit, hold, pin, etc. in both cases.

If there is a difference in reliability (software from third-party repos is more likely to break your system--and, btw, software from Canonical's repos has also broken systems in the past, so "avoid third party repos" is not a guaranteed way to avoid software breaking your system), using snaps to install third-party software instead of third-party repos does not fix that problem: the third-party provider is still just as unreliable as before and their software is just as likely to do something stupid.

Third-party apt repositories are a security nightmare: you are giving a third party unrestricted semi-silent root access to your computer. I can trust my distro provider with this, but it should be strongly discouraged for third-parties. Instead, installing PPAs to get updated builds of standard packages seems considered “normal”. At least, this doesn’t hold true for snaps.

> I can trust my distro provider with this, but it should be strongly discouraged for third-parties.

Again, it all depends on how much you trust the third party compared to how much you trust your distro provider. I don't have many third party PPAs installed on my computer because there aren't many third parties I trust that much. But there aren't zero either.

Also, a big part of my trust of my distro provider is based on having source code forced to be open, and another big part is based on them not doing things behind my back. Snaps significantly erode both of these aspects of trust.

> Instead, installing PPAs to get updated builds of standard packages seems considered “normal”.

Perhaps we should consider why this is: because people want up-to-date software on their computers (desktop or server), instead of being beholden to whatever version distribution maintainers have decided you can have.

If you don't want software that has been configured and tested to work together by a distro maintainer, you're volunteering to do that work yourself and become the sole maintainer of a bleeding-edge distro with a very small audience.

That's fine - and why I use macOS as a desktop: because Homebrew consistently gives me up-to-date versions of the software I want. If I were to use Linux on the desktop, it would be a distribution which also allows this with minimal fuss - almost certainly not a Debian derivative.

I understand the _reasoning_ behind the distribution model - I just don't think it works very well, and apparently nor do all the people who use PPAs in the course of everyday use to get up-to-date software.

It's also worth noting that FreeBSD does not have this problem - ports are updated _much_ more often than most Linux distributions seem to be.

FreeBSD is pretty much a checkpointed rolling release.

> audit, hold, pin

Originally you said audit, hold, modify.

You can audit snaps just as you can audit third party apt repositories. Either the publisher ships the source such that you can rebuild, or they don't.

You can hold snaps using this method: https://forum.snapcraft.io/t/disabling-automatic-refresh-for...

You can modify snaps just as you can modify what you get from a third party apt repository. Either the publisher ships the source such that you can modify and rebuild, or they don't.

> Originally you said audit, hold, modify

I didn't; the post you were originally responding to (the GP of my original post, which is the GP of this one) did. I am not the person who made that post.

You appear to be saying that you can audit, hold, modify, pin software in third-party repositories. That means you agree with what I was saying in the GP to this post, that you have just as much ability to do all these things with third-party repo software as you do with software distributed using snaps.

Reply on news.ycombinator.com