<story><title>Linux Mint drops Ubuntu Snap packages</title><url>https://lwn.net/SubscriberLink/825005/6440c82feb745bbe/</url></story><parent_chain><item><author>still_grokking</author><text>As a user I don&amp;#x27;t like neither Snaps (that for sure as this is Cannonical only) nor FlatPaks (as they seem conceptually a &amp;quot;80% solution&amp;quot; which combines the problems of package systems with the problems of self-contianed apps, but don&amp;#x27;t improve on anything).&lt;p&gt;For me the only acceptable solution besides proper .debs are AppImages. AppImage doesn&amp;#x27;t try to &amp;quot;replace&amp;quot; the package management for desktop apps like the former two candidates. It tries to complement package systems for some special cases (like for example commercial software, or for the cases where the user &amp;quot;just wants to try something out&amp;quot; without &amp;quot;polluting&amp;quot; the whole system with a lot of dependencies).&lt;p&gt;For my desktop needs AppImage is like &amp;quot;Docker, the good parts&amp;quot;. A simple self contained format that runs everywhere without any further dependencies. Compared to that Snap and FlatPak are bloated annoyances.</text></item><item><author>lawl</author><text>&amp;gt; but from the User perspective it seems like FlatPaks[1] are much better and address the issues that this article raises&lt;p&gt;This is interesting, because the last few days I was actually working on packaging an application of mine as a snap&amp;#x2F;flatpak.&lt;p&gt;From my PoV, they both have their fair share of issues.&lt;p&gt;Snaps enforce a sandbox, which I think is actually a good idea, because the desktop security model is somewhat broken. If your application cannot run as a sandboxed app, you need to be granted special permissions by canonical after manual review (my app needs this), where they also discuss if they can make a new permission in a safe way for your usecase that everyone can use afterwards.&lt;p&gt;On one hand this sucks because I need to ask canonical for permission to publish something, and there&amp;#x27;s no certainty that I will get these permissions as a nobody for a new app nobody ever heard of before. On the other hand, I think I like that they&amp;#x27;re doing something about the desktop security model.&lt;p&gt;The next problem is, if this is denied, how do I ship updates? Provide a self updater? Easy to write, but if everyone does that, we can just go full windows and abandon package managers. Tell people to just curl | bash? That&amp;#x27;s not more secure than a potentially shady snap.&lt;p&gt;But I do have to praise canonical for being very helpful in IRC and the forums for helping me debug issues and file bugs against snap stuff.&lt;p&gt;Now flatpak on the other hand, just feels kinda weird to me.&lt;p&gt;It sandboxes things, but every application can pretty much grant itself access to everything. This is a completely different philosophy, but if you rely on everyone tightly sandboxing their applications without granting themselves permissions for sandbox escape, I think something like landlock[0] (when it lands) or pledge is &lt;i&gt;much&lt;/i&gt; more suited for this, and baked into the application.&lt;p&gt;Then there is this weird thing where flatpaks force a runtime on you. My application is a statically linked go binary. But flatpaks pretty much want to force me to add an entire freedesktop suite as a dependency, as you simply cannot choose no runtime.&lt;p&gt;(Community-)Support for building flatpaks? Pretty much non-existant.&lt;p&gt;So yeah, the entire linux upstream-packaging situation is still quite depressing honestly. And with the time and energy I have invested into this by now, I could have written a simple but sufficient self-updater about 10 times over.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;landlock.io&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;landlock.io&amp;#x2F;&lt;/a&gt;</text></item><item><author>jonquark</author><text>I can see why Snap is like it is from Canonial&amp;#x27;s perspective - but from the User perspective it seems like FlatPaks[1] are much better and address the issues that this article raises&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;flathub.org&amp;#x2F;home&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;flathub.org&amp;#x2F;home&lt;/a&gt;&lt;p&gt;(Disclaimer: I&amp;#x27;m talking in a personal capacity but the company I work for in my day job now owns Red Hat - I don&amp;#x27;t work on Linux Operating Systems).</text></item><item><author>psanford</author><text>From the linked announcement: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.linuxmint.com&amp;#x2F;?p=3906&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.linuxmint.com&amp;#x2F;?p=3906&lt;/a&gt;&lt;p&gt;&amp;gt;  Applications in this store cannot be patched, or pinned. You can’t audit them, hold them, modify them or even point snap to a different store. You’ve as much empowerment with this as if you were using proprietary software, i.e. none. This is in effect similar to a commercial proprietary solution, but with two major differences: It runs as root, and it installs itself without asking you.&lt;p&gt;This is a great summary of why people rightfully feel nervous about Snap. People run linux because they want visibility and control into what is happening on their systems. Canonical seems to want to take away that visibility and control from their users.</text></item></parent_chain><comment><author>arminiusreturns</author><text>AppImages are the only thing I run also, as a full time linux user and admin. I just hate the proliferation of questionable services, especially in systemd land. A lot of my focus is on minimization of stack, and snap and flatpak just don&amp;#x27;t stand up to scrutiny imho.</text></comment>
<story><title>Linux Mint drops Ubuntu Snap packages</title><url>https://lwn.net/SubscriberLink/825005/6440c82feb745bbe/</url></story><parent_chain><item><author>still_grokking</author><text>As a user I don&amp;#x27;t like neither Snaps (that for sure as this is Cannonical only) nor FlatPaks (as they seem conceptually a &amp;quot;80% solution&amp;quot; which combines the problems of package systems with the problems of self-contianed apps, but don&amp;#x27;t improve on anything).&lt;p&gt;For me the only acceptable solution besides proper .debs are AppImages. AppImage doesn&amp;#x27;t try to &amp;quot;replace&amp;quot; the package management for desktop apps like the former two candidates. It tries to complement package systems for some special cases (like for example commercial software, or for the cases where the user &amp;quot;just wants to try something out&amp;quot; without &amp;quot;polluting&amp;quot; the whole system with a lot of dependencies).&lt;p&gt;For my desktop needs AppImage is like &amp;quot;Docker, the good parts&amp;quot;. A simple self contained format that runs everywhere without any further dependencies. Compared to that Snap and FlatPak are bloated annoyances.</text></item><item><author>lawl</author><text>&amp;gt; but from the User perspective it seems like FlatPaks[1] are much better and address the issues that this article raises&lt;p&gt;This is interesting, because the last few days I was actually working on packaging an application of mine as a snap&amp;#x2F;flatpak.&lt;p&gt;From my PoV, they both have their fair share of issues.&lt;p&gt;Snaps enforce a sandbox, which I think is actually a good idea, because the desktop security model is somewhat broken. If your application cannot run as a sandboxed app, you need to be granted special permissions by canonical after manual review (my app needs this), where they also discuss if they can make a new permission in a safe way for your usecase that everyone can use afterwards.&lt;p&gt;On one hand this sucks because I need to ask canonical for permission to publish something, and there&amp;#x27;s no certainty that I will get these permissions as a nobody for a new app nobody ever heard of before. On the other hand, I think I like that they&amp;#x27;re doing something about the desktop security model.&lt;p&gt;The next problem is, if this is denied, how do I ship updates? Provide a self updater? Easy to write, but if everyone does that, we can just go full windows and abandon package managers. Tell people to just curl | bash? That&amp;#x27;s not more secure than a potentially shady snap.&lt;p&gt;But I do have to praise canonical for being very helpful in IRC and the forums for helping me debug issues and file bugs against snap stuff.&lt;p&gt;Now flatpak on the other hand, just feels kinda weird to me.&lt;p&gt;It sandboxes things, but every application can pretty much grant itself access to everything. This is a completely different philosophy, but if you rely on everyone tightly sandboxing their applications without granting themselves permissions for sandbox escape, I think something like landlock[0] (when it lands) or pledge is &lt;i&gt;much&lt;/i&gt; more suited for this, and baked into the application.&lt;p&gt;Then there is this weird thing where flatpaks force a runtime on you. My application is a statically linked go binary. But flatpaks pretty much want to force me to add an entire freedesktop suite as a dependency, as you simply cannot choose no runtime.&lt;p&gt;(Community-)Support for building flatpaks? Pretty much non-existant.&lt;p&gt;So yeah, the entire linux upstream-packaging situation is still quite depressing honestly. And with the time and energy I have invested into this by now, I could have written a simple but sufficient self-updater about 10 times over.&lt;p&gt;[0]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;landlock.io&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;landlock.io&amp;#x2F;&lt;/a&gt;</text></item><item><author>jonquark</author><text>I can see why Snap is like it is from Canonial&amp;#x27;s perspective - but from the User perspective it seems like FlatPaks[1] are much better and address the issues that this article raises&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;flathub.org&amp;#x2F;home&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;flathub.org&amp;#x2F;home&lt;/a&gt;&lt;p&gt;(Disclaimer: I&amp;#x27;m talking in a personal capacity but the company I work for in my day job now owns Red Hat - I don&amp;#x27;t work on Linux Operating Systems).</text></item><item><author>psanford</author><text>From the linked announcement: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;blog.linuxmint.com&amp;#x2F;?p=3906&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;blog.linuxmint.com&amp;#x2F;?p=3906&lt;/a&gt;&lt;p&gt;&amp;gt;  Applications in this store cannot be patched, or pinned. You can’t audit them, hold them, modify them or even point snap to a different store. You’ve as much empowerment with this as if you were using proprietary software, i.e. none. This is in effect similar to a commercial proprietary solution, but with two major differences: It runs as root, and it installs itself without asking you.&lt;p&gt;This is a great summary of why people rightfully feel nervous about Snap. People run linux because they want visibility and control into what is happening on their systems. Canonical seems to want to take away that visibility and control from their users.</text></item></parent_chain><comment><author>lawl</author><text>I tend to agree with you, but I really like updating all my software with one click&amp;#x2F;command.&lt;p&gt;So out of curiosity:&lt;p&gt;My application is already self contained and statically linked, so no AppImage needed, but it behaves like one, you can just run download and run it everywhere. And so what you&amp;#x27;re describing will be for sure an option for those who like it (in fact currently it&amp;#x27;s the only option in alpha).&lt;p&gt;How would you like to get updates for something like this? Visit the website yourself occasionally to check for updates? Have the application notify you a new version is available? Have an integrated updater so the binary can update itself?</text></comment>