Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD won't update Firefox, advises users to switch to ESR

undeadly.org

Post reply on HN
Print view View original

61–70 of 339 posts

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#61

Post by abtinf »

sandov wrote: post #41
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

I'll go one step further: The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. The way shared libraries are used in Linux is built upon the assumption that package managers and centralized repositories are the right way to do things.

Why are they “wrong at a fundamental level”?

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#62

Post by _delirium »

zozbot234 wrote: post #50
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

Outside packages should NOT be disrupted given semver. The whole point of using shared objects (dynamically-linked libraries) is so that when a problem arises you can update whatever pieces of code in a centralized, system-wide store and every single one of the projects you use can benefit from the new, up-to-date version. Using the latest version is just the right thing to do.

This works if you have a stable ABI, but breaks when libraries are written in languages that don't have a stable ABI (in Firefox's case, Rust). Then even a simple recompilation of one package breaks dynamic linking.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#63

Post by jiveturkey »

wbl wrote: post #9
smartmic wrote: post #4

> being too complicated to package (thanks to cbindgen and rust dependencies) Can anyone explain what is behind? Is it symptomatic for any programs with those dependency? Especially curious about rust because it seems to be hyped very much lately (I have almost zero rust experience and even less bias about it, just being curious)

The problem is updating the rust toolchain requires testing all other ports with that dependency to make sure nothing broke.

it wouldn't necessarily. you could just update rust, build firefox and test that. leave the others alone (with older rust).

now if the complaint is solely about rust, not specifically FF, then that's a different story. it might indeed be that FF is the only package using Rust right now?

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#64

Post by kelnos »

Analemma_ wrote: post #47
sandov wrote: post #41

Earlier quoted context omitted.

I'll go one step further: The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. The way shared libraries are used in Linux is built upon the assumption that package managers and centralized repositories are the right way to do things.

I agree, and I think that people are too emotionally invested in the package manager concept to back out now. I mean, for years Linux proponents have been touting it as the key advantage over software distribution on Macs/PCs.

I think the empirical evidence is against you here, though. If package managers weren't a good way to do things, brew wouldn't exist. Neither would the Mac app store, or whatever the equivalent on Windows is these days.

As a Debian user, I appreciate that the stuff I install had at least gone through some minimal vetting first. And if I have to add a third party repository or download something myself to run, I'm much more likely to view that as the possibly-dangerous action that it is, and try to actively assess the reputation and trustworthiness of what I'm installing.

That's certainly not an average, noon-technical user thing, though. Vetted app stores are there to help average users avoid malware, assuming they're doing their job properly.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#65

Post by zozbot234 »

_delirium wrote: post #62
zozbot234 wrote: post #50

Earlier quoted context omitted.

Outside packages should NOT be disrupted given semver. The whole point of using shared objects (dynamically-linked libraries) is so that when a problem arises you can update whatever pieces of code in a centralized, system-wide store and every single one of the projects you use can benefit from the new, up-to-date version. Using the latest version is just the right thing to do.

This works if you have a stable ABI, but breaks when libraries are written in languages that don't have a stable ABI (in Firefox's case, Rust). Then even a simple recompilation of one package breaks dynamic linking.

Doesn't Rust use static linking between crates as a rule, precisely because dynamic linking would break given reliance on anything but a pure C-like ABI? (BTW, the cbindgen tool mentioned in the linked article is meant to address precisely that - provide a clean interface to a Rust crate that won't break with internal ABI changes.)

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#66

Post by jiveturkey »

barrkel wrote: post #43
markstos wrote: post #35

Earlier quoted context omitted.

This is the old packaging design where disk space and bandwidth were expensive, so you tried to have one version of each library or package on disk. This design leads to cascading complexity and breakage when many package depend on the same library and some need different versions of the library. Modern packaging has changed the approach to bundle dependencies-- using more disk space and bandwidth but isolating apps…

Shared libraries aren't just about reducing disk space and bandwidth consumption; it's also about fixing bugs in one place fixing it for all consumers. It requires discipline to only fix bugs and not break consumers, though, and therein lies the devil.

It's also about memory consumption.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#67

Post by cptskippy »

blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

So this is kind of like the DLL hell Windows had?

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#68

Post by espadrine »

abtinf wrote: post #61
sandov wrote: post #41

Earlier quoted context omitted.

I'll go one step further: The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. The way shared libraries are used in Linux is built upon the assumption that package managers and centralized repositories are the right way to do things.

Why are they “wrong at a fundamental level”?

I believe they are suboptimal for the same reason that lexical binding won over dynamic binding in language design: it is easier to reason with immutable bindings, and to maintain as little global state as possible.

The work done in Nix and Guix is interesting in this regard.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#69

Post by seanparsons »

floatingatoll wrote: post #24
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

RedHat’s “streams” model will certainly do a much better job of handling this than the other distributions do today. I hope that the need for having multiple parallel versions of a dependency coexist is incorporated into the other distros, because I’ve lost a lot of sanity this past two decades to the assumption that “one installed version should be enough for anybody” on Linux and BSD servers.

Already handled in NixOS by Nix.

Re: OpenBSD won't update Firefox, advises users to switch to ESR

#70

Post by ars »

sandov wrote: post #41
blackhaz wrote: post #14

I am arguing about this on FreeBSD forums - from an end user perspective. I think the benefits of saving disk space by sharing libraries do not justify the inconveniences we, desktop BSD and Linux users, obtain from being forced to disrupt and upgrade hundreds of installed software packages, just because one single desired upgrade requires to pull its dependencies. The whole ecosystem falls down like a card house - o…

I'll go one step further: The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level. The way shared libraries are used in Linux is built upon the assumption that package managers and centralized repositories are the right way to do things.

> The whole "centralized, trusted repository that has all your apps" system is wrong at a fundamental level.

I've done it both ways. Centralized works a LOT better. It's not even close.

You get a more stable system, and you get security bugs fixed faster, and more reliably.

What you lose is access to the "latest and greatest", because it takes time for the new stuff to filter in. And that's OK.

Post reply on HN