Comment by waheoo | Hacker News Reader

Comment by waheoo | Hacker News Reader

Parent Full thread

> Instead, providing a cross distribution consistent installation experience is the main goal.

Who is asking this exactly?

As an arch user and technically a fedora, Gentoo, slackware, Ubuntu, debian user, I'm not asking for this.

I like how I install packages.

Installing garbage from a webpage like some windows pleb or having to eject weird desktop download things after drag and dropping things on a Mac is not something I want.

Please stop pushing this idea about flatpak being better, its not for a lot of users and for me, security doesn't even enter the equation.

But the idea that random flatpak maintainer has better security processes I place than the sec team for many distros is laughable at best.

You can wrangle the argument all you like about ideal world scenarios but the fact of the matter remains that suboptimal ideal still works out as more effective in the real world. Tragedy of the commons problems generally do require sub optimal solutions in the small to solve in the large.

There’s a lot of good software that isn’t in package repos. This isn’t a failure in the developers part. It takes knowledge and time and effort to package for a repo, let alone all the different repos on each distro. Flat pack gives a single way to distribute something and on that merit alone it’s valuable.

Again, to whom?

Arch has aur, arch can sideload rpm/Deb's, Mac has home brew, who needs this?

The only people I see using flatpak is the 50 odd Linux users we have at work, they constantly have dramas trying to make things work around home directory sandboxing, permissions, updating and more

> Single way

Why is this valuable? Just saying it doesn't make it true.

Why do we need a single way to install?

I'm not saying it's a bad thing, but giving up home dirs and a bunch of other platform specific benefits is a cost I'm not willing to pay for some made up ideal that gives me a worse experience.

Did you know, and this may shock you, that there are other people with other interests. Also, and this one is really going to blow your mind, these other "people" (plebes if you will), may value different things and want products that are of no interest to you.

Flatpak sounds like a shitshow, but the not because it doesn't meet your specific requirements.

> Again, to whom?

Are you trolling? I think the answer is obvious: less duplication of efforts may make the linux ecosystem be more lean which may mean more manpower to... bring the year of the linux desktop.

If you avoid duplication of effort by doing something worse than existing solutions, is that progress?

Distro package managers have more than 20 years doing this. If you want to replace them I think there should be fewer drawbacks. Otherwise you are throwing out decades of design, thought, bug fixes for something more problematic.

You are assuming that packaging is a substantial burden when compared to making a complex application and that that labor translates ultimately into tangible benefits.

If the packaging is done by the dev you are assuming that 1% extra effort wont be spent playing chess instead of adding features.

If the packaging is down by an interested party for that distro you are assuming that a person competent to write a package file is even competent to say write an app let alone interested in doing so.

To me at least, but I'm sure there is more people than me who wants this.

Almost every package manager on Linux distros allow you to install packages outside of the main repositories and still manage dependencies using the repos.

I agree there are a lot of distros to package for, but I'd say the bonus of not having to maintain and update all the dependencies outweighs that fact.

For example, there are a lot of tools that can generate Debian packages for you if you don't want to spend any time learning the manifests. I assume these exist for most distros.

Even if there are easy tools available, I'd still need to learn them for each distro I want to support. Heck, just figuring out the different names each distro uses for a particular package is a fair bit of work.

Just use Gnu Stow as a secondary package manager and install into the /usr/local tree.

The discussion is about packaging your software for users, not yourself. Stow is a solution for managing non-packages software on your personal system, not for distributing it.

Most people don't package their software for distros.

Smart distros keep things close to upstream so the burden is small.

This is a weird argument.

Now you want each developer to manage dependency updates for their application? I don't trust them to develop their own app let alone apply security patches properly.

As a Gentoo user, I very much welcome being able to pull in some applications that are closed source and/or not part of the portage tree without the hassle of finding out how exactly the base platform that it was compiled against looks like. For a while I had to keep a lot of 32bit versions of libraries around just to make Steam happy, and build the stupidly large qtwebengine just for the Nextcloud client. Nowadays I get both of them via Flatpak without hassle and can keep a leaner base system.

Why do you exactly run Gentoo in the first place if you don't actually value building the dependencies from source?

That's an odd question. I absolutely value having almost everything built from source and the control I get from that through use-flags.

That doesn't mean I enjoy compiling some incarnation of webkit every few weeks for multiple hours on a laptop, in particular if it's just for a single application (in this case: Nextcloud client). Same for 32bit stuff, I have absolutely zero use for these libraries outside of closed-source games, so I'd rather have them just work than full control over them.

As a Gentoo/Funtoo user, I feel like we can solve this problem with better security by running applications in Docker. See Funtoo's approach to Steam for example.

https://www.funtoo.org/Steam

As a free software developer of Windows, Linux and Mac software I would not want to have to need to be "approved by the gods" in order to release an application to the AppStore / SnapStore / Windows Store and whatever is called in the different flavors of linux.

I put my software in my webpage and whoever wants to download it and use it does it. If they don't trust it well then I'm sorry.

You can self-host Flatpak repositories with flat-manager, which differentiates Flatpak from the App/Snap/Windows Stores.

https://docs.flatpak.org/en/latest/hosting-a-repository.html

https://github.com/flatpak/flat-manager

Then don't use Flatpak!

The other side is that Software Developer Foo isn't necessarily going to have the resources/inclination to work with your distro maintainer. You may decide to avoid Foo's software as a result, and that's totally fine—but if I like Foo's software and want to use it, Flatpak gives me that opportunity.

I don't and I won't but I'm still looking to point out its shortcomings whenever it comes up.

Staying silent is as good as encouraging the echo chamber outright.

People are pushing this shit because it's trendy not because it's good.

Well, getting the wrong version (years old, not what the developer designated as stable & supported as of yesterday) of absolutely everything I care about is actually kind of really annoying with most contemporary linux distributions.

But basically, as with anything open source, if you don't like it, don't use it, make some other choices, or build your own. I see a lot of people whining and stamping their feet here but not a lot people building alternatives. Quit whining & start coding if it matters that much to you. As far as I can see there's Flatpack, Snap, and not much else here because nobody can be bothered apparently.

Microsoft calls typescript stable. I find bugs in it all the time.

I don't trust developers to designate things as stable.

I can see two opensource groups that benefit from this. Maintainers can produce quality packages that don't vary unintentionally between target systems with less effort to produce. Package consumers can rely on having the same quality packages on varying systems. I use Ubuntu Server mostly because its packages are highly consumed. If I could get the same packaging on a different system I wouldn't have to worry about arbitrary variations not related to the distro but different just because it's produced through a separate workflow.

Flatpak is supposed to be the solution for installing proprietary app while staying safe. For open source software, less value for using flatpak apart from no need for package in multiple format for different distro. Appimage also solve the same problem.

Now is flatpak secure for installing closed source app? At least not when they have full x11 access when using x11 desktop.

> As an arch user

> like some windows pleb

I'm not sure if you're serious or making fun of stereotypes and thus don't know how to respond.

Seriously making fun of windows plebs? Yes. How anyone trusts Mac/windows these days still amazes me.

Not that I expected different from a "l337" Arch user, but "Windows plebs" have had "chocolatey" and the Windows Store for a while now...

It's for the people who spent their free time to write the software that you use for free and call plebs.

Reply on news.ycombinator.com