Boxxy puts bad Linux applications in a box with only their files | Hacker News Reader

Boxxy puts bad Linux applications in a box with only their files

github.com

182 pointsicar98 comments

Lots of comments in the thread from February 2023: https://news.ycombinator.com/item?id=34730520

FYI. There is a XDG checker called "xdg-ninja"[1]

> A shell script that checks your $HOME for unwanted files and directories.

> When xdg-ninja encounters a file or directory it knows about, it will tell you whether it's possible to move it to the appropriate location, and how to do it.

1. https://github.com/b3nj5m1n/xdg-ninja

Indeed. Although this tool looks like a way to work around those holdouts which refuse to provide an official customisation point

Oh this is my project! I haven’t had energy to work through pending issues for a while due to health reasons; I do still have interest in maintaining it but my health makes it a struggle.

I'm sorry to hear that. Thanks for the tool and wishing you a speedy recovery!

Sorry to hear that. Amazing GitHub username by the way.

From the README:

  It wants to put its config in ~/.tmux.conf. With boxxy, you can put its config in ~/.config/tmux/tmux.conf

From tmux(1):

  By default, tmux loads the system configuration file from /etc/tmux.conf, if present, then looks for a user configuration file at ~/.tmux.conf $XDG_CONFIG_HOME/tmux/tmux.conf or ~/.tmux.conf.

XDG_CONFIG_USER defaults to "$HOME/.config".

Very poor choice for an example.

This is a (relatively) recent addition to tmux, I remember this being an annoyance a while ago, and you can find the discussion on GitHub if you search.

Heh, but if its in Debian stable then its probably not recent.

It was added upstream in 2020. Since tmux is often used on servers that don’t upgrade frequently, I still regularly work on some servers without this feature.

In related news, Vim just added XDG support upstream as well. Just waiting for Zsh to follow suit now :)

I've been working around this on Zsh by using ~/.zshenv to source the rest of the config from ~/.config/zsh for years now.

I would welcome the change.

I've been using symlinks for Vim and Tmux for ages and waited for them to catch up. Seems they've done it, finally.

> then looks for a user configuration file at ~/.tmux.conf [...] or ~/.tmux.conf

If the tmux devs are confused then it looks like a perfect example of why we need a standard for `.config` or similar. I have proposed something similar in the past for code repositories to remove the config file clutter to a subdirectory, but it's hard to gain traction.

This looks like a careless mistake to me, not really a fundamental confusion :-)

> it looks like a perfect example of why we need a standard

A standard wouldn't fix mistakes in the manpage. What is your proposal?

I took the message to be is that your home directory doesn't actually belong to you and you should store most of your work elsewhere on the system.

Now I just have a `/work` folder and I don't have to care what applications want to do with their configurations.

It's a well-known tool and the example is one which people will very often encounter. A lot of tooling is terribly behaved, regardless of this specific example.

Same for .aws (the motivating example), kind of

https://docs.aws.amazon.com/sdkref/latest/guide/file-locatio...

I don't see an option for the whole .aws folder. I'm sure some random stuff gets out in there, but for the life of me I can't think of any other files besides credentials and config.

Maybe some credential provider scripts/hooks? But in that case i think you can just specify the location wherever it is already... IDK.

The biggest utility I could see boxxy for is when other tooling doesn't honor those env cars/alternate configs from default. But... I mean symlinks always worked fine for me.. but I gotta admit this is better, and I'm thinking about installing it just to see what boxxy scan comes up with. I recently did a bunch of work to clean up my devenv and get it in .zshenv, this could help with that.

On a tangent: it bugs me that the default XDG directory structure doesn't fully match the standard Linux directory structure. What's with these inconsistent defaults?

    XDG_DATA_HOME="$HOME/.local/share"  # okay, reasonable
    XDG_CONFIG_HOME="$HOME/.config"  # ...uh, pardon?
    XDG_STATE_HOME="$HOME/.local/state"  # well at least it's in ~/.local
    XDG_CACHE_HOME="$HOME/.cache"  # ...but this one ain't; what in tarnation?

It'd make more sense to be consistent with how system-wide applications use /usr or /usr/local, like so:

    XDG_DATA_HOME="$HOME/.local/share"
    XDG_CONFIG_HOME="$HOME/.local/etc"
    XDG_STATE_HOME="$HOME/.local/var/lib"
    XDG_CACHE_HOME="$HOME/.local/var/cache"

This would make $XDG_(CONFIG|STATE|CACHE)_HOME consistent with $XDG_DATA_HOME, and also consistent with existing conventions around ~/.local/bin and ~/.local/lib.

The XDG spec ain't the only naughty naughty boy here, either. Flatpak puts all of its application data in ~/.var/app, whereas it'd make a lot more sense in ~/.local/var/lib/flatpak/app. And of course, the subject of Boxxy (and, as others mentioned, xdg-ninja) is the countless apps contributing further to the chaos.

Of course, all this would stop being an issue entirely if Linux would just embrace union mounts like Plan 9 did and overlay everything onto /bin, /lib, /share, /etc, and so on. Hell, if I were the not-so-benevolent dictator for life of the Linux ecosystem I'd take the opportunity to rename all those weird UNIX™ vestiges, too, like /etc→/conf and /var→/data - but if we're gonna hang on to those vestiges, the least XDG could do is encourage consistency with them.

Maybe I just need to make my own distro and finally say goodbye to what little remains of my sanity.

> boxxy is a part of the amyware discord server.

Can we reverse this trend? I've recently started to see an FAQ, on GitHub, hide the answer with a deeplink into Discord channels where you needed to find the guild to join first. I've never gotten disinterested in a project that fast. This needs to stop.

I disagree. The only time I'm actively engaging with a project is if it has a Discord server. I don't want to post questions in a public forum.

> I don't want to post questions in a public forum.

Why?

Because they are a discord user. And don't have a forum account. In todays world forums can also be a pain as looking at picture attachments most of the time require accounts.

Especially Discord "forums", the black hole of the internet. Neither real-time so I can get my question answered when I'm there, nor open enough to find old questions through Google, nor popular enough that people browse through them to answer.

People go "oh, Discord has forums, we don't need a web forum", and the world is now a little bit worse.

Maybe there's value in (semi-)automated discord exfiltration. Like A browser plugin that grabs all the data from any discord pages I look at and mirrors it somewhere on the open web.

There probably is, but instead of making something that breaks Discord's TOS while simultaneously increasing their popularity (because of this useful tool), I'd rather let projects realize that a web forum is better.

I agree but which alternative exists which is free which also provides voice chat option? On the other hand, many Discord servers never even use the voice chat option. I think Discord is more of an alternative to IRC than to forums. Maybe it does both good enough?

It definitely doesn't do forums well enough, and I've never been on a forum and thought "I wish there were a voice chat option here". Discord is OK for real-time chat (though I'd still like something more open), but asynchronous forum chats should be left to web forum software.

Matrix supports voice and video integration out of the box, as does Zulip.

I think voice chat is very popular with gaming discord users, not so much with software projects anyway.

In any case, it is so simple to just send a link to an open jitsi instance on any platform that it isn't that big of a deal if you do that once every full moon.

Unable to decrypt: The sender's device has not sent us the keys for this message.

It's very unfortunate that the entire Matrix ecosystem seems to be funded by people who want to build private branded messaging systems for enterprise and government and other users aren't the target audience anymore.

The Matrix Foundation tries to fund itself philanthropically by selling sponsorship and memberships at matrix.org/support, but it doesn’t remotely cover the full dev costs.

So there is absolutely no alternative but a) ensure the wider independent FOSS ecosystem can build general purpose apps (which they can and do - eg Cinny and FluffyChat), and b) have Element go off and build apps which people actually pay for (empirically that means govtech & enterprise).

The hope is that if/when Element is profitable doing the latter, then Element can get back to investing in the broader Matrix ecosystem again. (Separately, it’s fascinating to see how little much of the Matrix ecosystem seems to appreciate the $$M that Element has put in over the years. Funny old world.)

edit: oh, and the unable to decrypt errors should be pretty much gone now; we just spent the last 6 months on crypto doing nothing but killing them.

Uh... I can replicate them right now as I speak, I use fluffy chat on my one phone, fluffy on another android, schildichat and cinny on Linux.

I am logged out of my schildichat every few days, cinny breaks a bit, and sometimes messages just show "could not decrypt message".

They "eventually" show on all sessions but I am facing them now.

My old sessions are broken, only new messages are visible across new sessions.

I use matrix as my daily driver so i it doesn't bother me much but I can say an average user might not.

Also,

Fluffychat android doesn't work with audio calls. Notifications are broken, I get "some" notifications, some days, sometimes after a few weeks, sometimes none.

right. we’ve been chasing them down and fixing them in matrix-rust-sdk, so can’t speak for clients using other stacks.

Discord's terms of service can suck my ass. There's no legal or moral obligation there. And I would hope they taking the valuable information out of Duscord would drain the moat and make it less popular, hard to predict though.

There definitely isn't any obligation, but it does mean you'll need to do a ton of work for the resulting cat and mouse game.

> There's no legal ... obligation there

Well, it's a gamble. With the risk they will sue you and win.

Although realistically you’d have to be scraping them on a corporate level with actual returns on the scraping for them to sue.

You can (and should) run a Discord export on your favorite servers and upload them to Archive.org

The best value is avoiding those project like hell.

My rule is if I need to join the Discord and I can’t figure it out with the given docs, I don’t use that project. It’s helped me save a lot of headaches with dealing with their “community” who are more likely to spam NSFW than actually commit to a discussion of the project.

I think discord serves a functional quite like email mailing lists, but with a twist. Email mailing lists, by their nature, gatekeep and filter out younger or less technical people, while discord by its nature is doing the same but inverted. It filters the sort of people that would be far more comfortable with mailing lists.

This is it exactly. Discord is, inherently, where quick gratification prospers. Immediate memetic responses followed by swapping to the next server for the next high.

It's okay-ish for when you need to ask questions. But we're trending towards gating binaries and general documentation there too.

Discord must be aware that their secret ingredient is that people are "admins" over others, and that people actually quite like being in power and having a different colored name. And all that without the technical barrier of having to setup forums or Teamspeak (not that such gatekeeping kept terrible people from being admins)

That sounds awful. You want a venue where younger and less technical people can get help and guidance from the more experienced people, not an echo chamber full of the least experienced users.

Well, I think discord appeals more to the young or less technical, in other words young and technical people, like the developers of many new projects, seem to like it. It's a model of software collaboration for their generation which their parents neither get nor appreciate, and I think that is part of the appeal to them.

I dislike Discord for the same reason I disliked some IRC networks. There's a lot young people on a powertrip and generally very clique-y behavior. But at least IRC wasn't also run by a huge uncaring tech company known to completely ignore the GDPR (or interpret it in asinine ways) that will eventually run out of VC money and disappear.

Is there a reason why projects opt for a Discord server rather than setting up a subreddit? Is it simply because Discord is easier to moderate?

Reddit attracts a lot of trolls. Managing the reddit takes work (moderation, keeping up with stupid reddit drama).

With a project discord, you're filtering out people immediately -- typically only people who want to be there wind up there. It makes things easier for a lot of people this way.

> With a project discord, you're filtering out people immediately -- typically only people who want to be there wind up there. It makes things easier for a lot of people this way.

Well. Yes. You filter out a lot of people, including legitimate users who would be interested but aren't going to deal with Discord. I'm not convinced that's actually a win.

Anything would be better. A subreddit, a traditional web forum, a mailing list, an NNTP group, an IRC channel -- I'd take any of them over Discord.

To pile on, from what I've seen, Reddit is shit for a community of people getting to know each other.

Posts aging out mean that discussions fade from view. That means that they die off, as other people don't join in. Combine that with karma, and you get people tending to just contribute content that is counter to community building.

I've seen some similar stuff happen on Discord servers (I'm looking at you, Discord servers with 50 topic channels), but I've also seen people slowly get to know each other better there.

Or, to summarize: I generally see Reddit as better for discoverability and Discord as better for community. But they're both inadequate as a whole.

I don't do drugs, mmm-nnn.

I was right about to go to another site and had to do a double-take when my eyes caught the title; I hadn't thought about her in YEARS. I hope it's boxxy on purpose.

It is not https://news.ycombinator.com/item?id=34730942

> No! I just thought it was a cute name ("put things in a box"), and it wasn't a common repo name on GitHub.

>I hope it's boxxy on purpose.

The default branch is `mistress`, I suspect the author has a sense of humour.

LOL That's amazing! I'm stealing that for my next open source project.

Beetles.

I don't know if the reference was on purpose, but I now have this 13 years-old remix on repeat : https://www.youtube.com/watch?v=LHNZVAjadqY

No relation: <https://news.ycombinator.com/item?id=34730942>

Related question: Which software do you recommend to sandbox a locally running AI agent, so that it can only access parts of the filesystem (e.g. one folder) and an allow-list of URLs?

Chroot or AppArmor+Firejail

Depends how much patience you have.

Firejail if you want ease of use (there are a lot of ready profiles to be used).

Bubblewrap if you want more security, at the cost of having to do more manual work.

TL;DR Firejail is a blacklist of things, while bubblewrap is an whitelist, so bwrap policies tend to be tighter.

That depends on the profile, firejail supports both.

What are people using to quickly test new ML models from github in a sandbox?

Do you fire up a docker image? Do you use virtualbox? ...

What's allowing the AI agent to access files at all in the first place?

People ascribe magical powers to them.

Why not docker?

Isn't this basically what `bubblewrap` already does?

Combinations of bwrap, chpst, env, setpriv, and setsid can become unreadable gibberish but otherwise work fine. There's lots of similarly useful stuff that can be combined for specific needs.

Or firejail?

People love to reinvent the wheel *shrug*

This seems significantly more lightweight than bubblewrap -- it doesn't attempt to do much in the way of containerization or isolation, just remapping certain files. I feel like this could be done in a small shell script if you reduce the configurability.

> alias aws="boxxy aws"

That's rather inconvenient to alias ever app, is there a more ergonomic way to rewrite the file access calls?

Is this like a better version of toolbx? Because I love toolbx and use it daily, but I wish it allowed for more granular configuration.

For example I'd want to create more containers for more specific use cases where they only have access to specific dirs in my HOME.

Try distrobox. The default behavior is like toolbx but you can change home folder to ~/distrobox/appx or go all-out and unshare everything.

https://github.com/89luca89/distrobox

You mean combining the --unshare-all and the --volume arguments to create my own list of HOME dirs to share? The docs are really sparse, lots of examples that use --unshare-all but nowhere do they explain it.

You can set DBX_CONTAINER_HOME_PREFIX=~/allmyboxes in ~/.config/distrobox/distrobox.conf to do that. It will share ~/allmyboxes/my-debian-distrobox1 as the home dir.

If you pass --dry-run, it will spit out the underlying podman/docker command. That was frankly better than trying to find documentation.

Yeah I figured out eventually that I can use --home and --volume to set an alternative home and then mount individual dirs from my home into the container's home.

Thanks, I'm using distrobox now.

GoboLinux users might be very interested.

OMG boxxy

Love that the user name in examples is mistress

I believe it is the default branch of git called 'mistress' instead of 'master' or 'main'.

Oh... tbh I've never thought about master this way. I just imagined the conversation: > mistress - it puts paths in `.config` > boxxy - yes mistress

Yes! GitHub username queer with default branch mistress was too good of a bit to pass up.

Well, at least a few of us noticed and think it was hilarious. Nicely done.

Reply on news.ycombinator.com