Oh Snap! Canonical now doing manual reviews for new packages due to scam apps
Oh Snap! Canonical now doing manual reviews for new packages due to scam apps
After repeatedly suffering issues with scam apps making it onto the Snap Store, Canonical maker of Ubuntu Linux have now decided to manually look over submissions.
You're viewing a single thread.
I've heard all the arguments about how these new packaging formats are supposed to make things easy for developers and for users with different use cases than my own (apparently), but I will continue to avoid them until they have further matured. I'm relieved that this is still possible.
The idea is good I think but the implementation has only ever caused me problems and seems to have a bunch of frustrating edge cases.
I've been using snaps for a few years now and while they still could use some improvements, the snaps I'm currently using seem to be fairly indistinguishable from deb-based packaging thanks to bug fixes they have done over the years. I think the idea of containerized applications is a good one, I think it actually can be safer. Performance is also fine for me with snap applications even like Firefox snap startup speed, although I'm using an R9 5900x and Gen 4 M2 NVMe SSD so maybe that's why, or maybe they really have improved the snap software and it is just as fast now for the most part.
I've had to swap Firefox on my laptop for the deb package, the snap took like 5sec to open, whereas the deb opens instantly. Other than that, i don't see much of a difference, but i run into sandboxing issues quite often (same with flatpak though)
I had a "Save As" issue in Firefox snap where it just wouldn't be able to save pages, but since upgrading to either Ubuntu 20.04 or 22.04 (can't remember which version fixed it), that problem has gone away entirely.
The problem for me is portability. Flatpak, Snap, Appimage, docker, podman, lxc, they all do the same thing, but they’re splitting the market into “servers” and “desktops”.
We need a portable container runtime we can build from a compose file, run cli or gui apps, and migrate to a server with web app capability displaying the UI. There are too many build targets, and too much virtual market segmentation.
Nix tries to solve the issue, but the problem is you have to use Nix.
True. Actual package managers are still thousands of times superior to flat and snap.
That scentence makes little sense as both are using package managers that work similarly. Flatpak even uses ostree which is more advanced.
My thing (I'm not the guy you replied to) is all the various user-facing complaints that I tend to see in these discussions. I use a distro where I can get current versions of anything I've ever needed, and I know how to maintain my system.
As a user, even if the various alternatives are fine most of the time, without concerns about security, integration, etc - I've never read anything that would make me want the additional complication. (I say this recognizing that there are security concerns regardless of how you get your software - I'm not saying these new solutions are inherently worse in that regard.)
I suppose at some point I'll want or need to embrace flatpak/appimage/snaps, but I can't find any reason I'd do so now - it feels like it increases the number of gotchas I need to worry about when installing software without actually giving me anything I want that I don't already get with my "legacy" package manager.
We dont live in such a perfect world. Linux has a small marketshare for non-server software, so packaging is done by your distro.
You would need to have user-facing settings for Apparmor or SELinux to replicate what already exists with Flatpak.
Principle of least privilege.
Maybe you prefer native packages, but bubblejail or SELinux confined users are complicated as hell and both are pre-alpha in my experience.
So yes you add bloat, dependencies etc. But you also add stability, a small core system, take load of OS developers and unify the packaging efforts so that it is done by developers not packagers.
This reduces complexity a lot, as the underlying system is not as important anymore, and you can just use whatever you want. Software is separated from the OS.
Flatpak is the only good format, as explained in this talk
(Snap has no sandboxing outside of Ubuntu and is thus not portable, Appimages are inherently insecure)
I will check out the video, thanks! I still say you can have the aur and arch repos when you pry them from my cold, dead fingers, but I'm openminded.
Here is an alternative Piped link(s):
Piped is a privacy-respecting open-source alternative frontend to YouTube.
I'm open-source; check me out at GitHub.