Ubuntu 16.04 Reaffirms Support For Snap Packages Along Side Debian Packages

[Luke]

I posted this in the OMG Ubuntu comments, but I guess it is worth discussing here too:

"<snip>So what we see here is a path to the same kind of toxic app environment that many user try to escape by switching to GNU/Linux, and it is plastered with good intentions and naive users are cheering the developers on."

If that is so, the counter is to uninstall Snappy support and not to use the Ubuntu Core builds. Use the traditional Debian setup or Debian itself. I use small 32 and 64 GB SSD's as boot drives with multiple system partitions and do NOT have room for 30MB+ Windows style system partitions. Also, I would NOT want to be running any version of any application that not only has holes(they all do) but for which there is a large installed base of the same version that never changes. Why do you think I go to the trouble to lock down and disable the antifeatures in the latest Firefox builds instead of rolling back to a version without those features and staying there?

Linux being a moving target goes a long way to making exploits like ransomeware and NSA payloads a royal pain in the ass to develop, deploy, and keep working. Thus one piece of ransomware targettting Linux and it was itself cracked, while there are a whole bunch or Windows ransomlockers for which the only remedy is to nuke the whole system from orbit. Anyone paying ransom deserves to be hit again as they are enabling the whole situation.

Also, the NSA has used fancy hard drive firmware resident attackware that turns around and uses only a Windows payload, as Windows and the firmware are both targets that move slowly. The FBI's crack against a version of Firefox once used in Torbrowser and deployed against users of Freedom Roads hosting used only a Windows payload. The combination of a small desktop installed base and the royal pain in the ass of maintaining a payload to target at least three distros, mulitple versions, and worst of all rolling releases (like I prefer) has repeatedly deterred the development of Linux payloads for cross platform and hardware cracks.

Don't forget: most servers run Linux, so most server exploits are Linux cracks against small installs with no X server, etc! They can get in because a server has to listen to the outside world. A Linux tablet full of always-connected apps is almost the same thing, and it only takes one bad app in a cracked sandbox to let in a ransomlocker, the local cops on some anti-pornography crusade, or even a divorce lawyer with a 12 year old hacker son.

[Luke]

Another question: if Snap bundles the underlying libraries, does that include GTK, whose themes can break with every new version? If it does, GTK themes in Ubuntu will have to support multiple GTK versions with versioned subdirectories. My custom-written "UbuntuStudio_Legacy" theme does that so I only have to publish one version so I known this works. It's just something Ubuntu will need to think of or people will get some nasty surprises when a snap bundles say, GTK 3.20 on Ubuntu 16.04 which uses GTK 3.18. GTK 3.18 and GTK 3.20 are so different a theme for one is utterly broken on the other.

[jo-erlend]

Another question: if Snap bundles the underlying libraries, does that include GTK, whose themes can break with every new version? If it does, GTK themes in Ubuntu will have to support multiple GTK versions with versioned subdirectories. My custom-written "UbuntuStudio_Legacy" theme does that so I only have to publish one version so I known this works. It's just something Ubuntu will need to think of or people will get some nasty surprises when a snap bundles say, GTK 3.20 on Ubuntu 16.04 which uses GTK 3.18. GTK 3.18 and GTK 3.20 are so different a theme for one is utterly broken on the other.

Most people miss the point. Yes, you _can_ bundle GTK+, but you won't usually want to. Snaps should still depend on system libraries unless there's a very good reason not to. A developer might want to download a dev environment with a newer GTK+ etc, but for normal apps, you'll depend on system libs. But most app updates doesn't require new libs and that's where snaps make it a lot easier and faster. Because snaps don't require root, meaning they are a lot safer than PPAs. Further, apps are confined by AppArmor and things like that, so by default, an app only has access to its own data. X will still be a problem, but again; we're currently comparing to PPAs. Wayland and Mir will improve things further.

To the person earlier in the comments who said snaps are some kind of repurposed Docker… no. They both use features of the Linux kernel, but that doesn't mean they're the same thing.

[pq1930562]

if Snap bundles the underlying libraries, does that include GTK

Yes. The devs say it in the following video:

https://youtu.be/lHO8j8uo5Z4

Not remembering the exact point in the video where they are saying it though.

Just watch the video and you will see. The video answers a lot of questions.

[pq1930562]

PS:

Found the position in the video where they are addressing GTK+ / Qt (i.e. toolkit). They are talking about it beginning at around the 51:48 min mark, see:

https://youtu.be/lHO8j8uo5Z4

[Luke]

Yes. The devs say it in the following video:

https://youtu.be/lHO8j8uo5Z4

Not remembering the exact point in the video where they are saying it though.

Just watch the video and you will see. The video answers a lot of questions.

Anything Youtube is a serious nuisance for me. Have to get torbrowser running on a very slow connection, then force-download it as almost no video will stream at these speeds. All video handling on my systems is upload/download, and any connection to anything Google is Tor-only with Google and Youtube blocked in /etc/hosts for a normal connection. That is due to suspected browser fingerprinting on Google's part. Thus, I will take your word on this.

Anyway, GTK in snaps means a package could have a different GTK minor version (3.18 vs 3.20 worst case) thus breaking any theme that does not use minor versioned subdirectories to support multiple versions. My theme will work, Ubuntu needs to make sure all of theirs do too.

[pq1930562]

as almost no video will stream at these speeds.

As already mentioned in the previous post, the position in the video where they start to talk about GTK+ / Qt (i.e. toolkit) is at the 51:48 min mark.

So you can just jump to that position and start watching from there, without having to watch the entire video.