Ubuntu Has Started Work On A New Desktop Snap Store

[tildearrow]

Sandboxing doesn't mean bundling every lib with your app. You can have the libs on your machine and have the app load the appropriate ones in a sandboxed environment. That's actually the correct way to approach things. Libraries are meant to be shared among multiple apps. Sandboxing is a good security practice because it limits access to the system. People place way too much trust in their favorite applications, linux distributions, etc. Sandboxing eliminates quite a bit of the need for trust. However to get the rest of the way there, we need the packaging system to display required permissions and allow the user to opt out of the ones they don't want (and those permissions should be enforced). Right now, none of the proposed formats does that. While you may say that it's an annoyance, that annoyance just might save your bacon the day you download a bad package and it asks for suspicious permissions.

As Linux desktop marketshare grows, it's going to become a target for "hackers" to attack. Unlike Linux, Windows has already dealt with this for many years and is hardened against quite a few attacks, yet Microsoft is still pursuing sandboxing, virtualization, etc. to further increase security. Linux distributions must do the same or they will end up in a similar fiasco to what Windows had where a worm takes over a metric ton of machines.

I know sandboxing and bundling are different terms.

What if I really really do not want to sandbox my app?

[tildearrow]

Otherwise, fix your code to the new library versions and ship it, like a normal human being.

I can't believe 10 users think that "recompiling" and "accepting the API breakage" is the right way. Wow.

Please tell me how in the freaking world can a "normal human being" (who doesn't know how to program, or even run make) fix code that is broken due to API breakage.

[betam4x]

I know sandboxing and bundling are different terms.

What if I really really do not want to sandbox my app?

I'll counter your question with one of my own. Why would you even care if it was sandboxed or not? It's transparent to you. That's like worrying about the compression algorithm the Linux kernel is using.

[mattlach]

There is no 'universal package manager'. There are different package managers for different distros, sometimes more than one (ubuntu with snap as well as apt/dpkg). Even distros using the 'same' package manager may have modifications or additional tools to manage packages which makes them incompatible.

You misunderstand what I meant by "universal". I meant one source of all packages on a system. Yes, you can still manually compile and install packages, or install them from binary blobs, but I'd argue in a well functioning well set up system ONLY packages handled by the package manager in the system, which keeps them up to date and patched should be used. All software on a system, one package manager.

In addition, depending on the package version, it may break your Linux install (installing ubuntu packages on a debian system for instance.) The whole reason Snap/Flatpak/AppImage came about is a desire for a better method of distributing applications in a distro independent, more consistent, more secure, more flexible way. Linux is way behind on 3rd party application distribution. In reality, these projects are about catching up to/surpassing Windows and macOS, who have had their own ways of installing applications since uh, the 90s.

Also, did I mention that the packages and package managers themselves quite often break? These large volumes of packages are maintained by volunteers, and if one slips up, it can cause dependency conflict nightmares. Or what happens if one goes rogue and inserts a package that installs an application with a back door? It has happened.[/quote]

No one is saying Apt or any other package manager is perfect. And yes, I understand things are a lot more convenient for developers if they can use one binary blob including all dependencies for all flavors of linux. I'd argue that the downsides to this type of distribution model FAR outweigh the minor convenience benefits. it's giving up a lot of what makes Linux great in exchange for some minor convenience for developers. No thanks.

Let's say for argument's sake that every distro out there uses snap. Not only would every distro have access to all Linux software, but that software would be sandboxed, dependencies would not be an issue, so install times would be much quicker and download times much shorter, and you are almost guaranteed to not break the system. In addition, removing the package is just as painless. Also, snap packages can be installed in the user's home folder, so they don't even need to be system wide. There are just too many arguments FOR the concept of a universal package format and package management system and not any real reasons to stick with what we have now other than 'it somewhat works and it's what I'm used to'. This also isn't change for the sake of change. Neither was systemd. Though that didn't stop people from hating on it.

I disagree. I'd argue this is a leap backwards in efficiency (now you are going to duplicate dependencies for every installed package) as well as for security. Now we have to trust individual package maintainers to include the latest patched dependencies in their packages rather than having the system keep track of and update dependencies system wide when needed.

And yes. SystemD was also a huge leap backwards. As is Netplan. And Wayland.

Just give me a eternally maintained version of Ubuntu Server Edition 12.04 LTS, and I'll be much happier. Don't mess with perfection. Upstart, IF up/down, Apt, no GUI tools to mess with. Perfect.

[tildearrow]

I'll counter your question with one of my own. Why would you even care if it was sandboxed or not? It's transparent to you. That's like worrying about the compression algorithm the Linux kernel is using.

One reason: filesystem access. Please tell me if it is possible to have full filesystem access from my sandboxed app's Open File dialog.

Flatpak has this "Portals" thing, but no, I mean, direct filesystem access.

[jo-erlend]

Flatpak is not limited to flathub. Fedora Silverblue will use flatpak by default, but from official fedora repos, so that's not an argument (or lets say it only applies for ubuntu). For desktop apps I personally find flatpaks far superior to snaps atm, especially the fact that they can share libraries, which saves a ton of disk/network capacity. But competition is good, lets see what will happen

Snaps have been able to share libraries for years now. For instance, if you want, you can use the gnome-3-28-1804 snap as the Gnome runtime for your app.

[jo-erlend]

Mean what it is, you bundle all depends in, since you're not involved in their development process, you just became a package of their software, i.e. you should provide critical bugs by bundling again and again or just don't care about and leave user to handle that.

This has not been true since 2015. Snapd have supported shared dependencies for years now. The problem is that people just keeps repeating mantras as if nothing in the software world ever changes.

[jo-erlend]

Appimage, Flatpak, Snap ... an alternative solution from the side of package managers would be to enable installation of multiple, even incompatible, packages on the same system and construct virtual per-binary filesystems with selected compatible libraries and data files to run particular binaries. This would also slightly diminish the need for Steam to have separate libraries.

This is exactly what Snapd is. A snap is a squashfs which can either contain all its libraries or use libraries from another snap for shared dependencies. You can have several versions of Gnome, for instance and you can install several copies of the same app of the same version of different versions.

[treba]

Snaps have been able to share libraries for years now. For instance, if you want, you can use the gnome-3-28-1804 snap as the Gnome runtime for your app.

Oh thanks for letting me know! So I assume updates to the calculator on ubuntu don't need to download 200mb anymore? That's nice

[jo-erlend]

Oh thanks for letting me know! So I assume updates to the calculator on ubuntu don't need to download 200mb anymore? That's nice

I wouldn't have to, no. It is the packager of the app/snap who decides whether to use shared dependencies or to bundle them. Snapd is still a young system and it still has a ways to go, but unlike Flatpak and AppImage, it is designed to be a full package management system and is used as such on Ubuntu Core.