Live data from Hacker News

Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

jatan.blog

511–520 of 645 posts

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#511
post #359

> Snap applications auto-update and that’s fine if Ubuntu wants to keep systems secure. But it can’t even be turned off manually. OMG. Is this real? This is the exact reason I use Linux instead of Windows 10 or macOS. I am not a grandma who can't stay up to date on tech news. At the least there should be a toggle for power users. But no, you can only defer it. Am I the only one who doesn't like it when your already s…

snaps are intended for non-power-users that don't want to deal with dependencies. Those users want things to mostly work without worrying about murky downsides. Auto-updating is exactly the right behavior. If this is of concern to you, why are you using snaps? And why Ubuntu? What's the value-add over Debian?

There is a world of difference between automatic updates by default and _not being able to turn them off at all_.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#512
post #421

I am very diligent about applying updates as soon as I'm able and generally read the changelogs of the updates I'm applying in Ubuntu's Software Updater. One thing I will not do is willingly allow somebody else a way to deploy and execute code on my computer without my say so (which snap is). After reading the whole thread at https://forum.snapcraft.io/t/disabling-automatic-refresh-for... and seeing Gustavo Niemeyer'…

I have to use Ubuntu 18.04 for some things and even with a minimal installation, I found some things phoned home or pushed changes.

I could remove some packages, like ubuntu-report or unattended-upgrades, but some seemed to be intertwined with other packages in a (purposeful?) labyrinth of nested dependencies.

They made themselves critical and uninstalling would break or cripple other fundamental system components.

Some I disabled in the config files, like apport, motd_news and kerneloops. Some I disabled and masked in systemd and others like snapd and whoopsie/whoopsie-preferences, I had to do:

  dpkg -L snapd |
  while read f
  do
    cat /dev/null > "$f"
  done
I wonder how this kind of nonsense percolates through a company?

Is it developers from commercial software vendors changing jobs and solving the problems the same way they solved them for other corporate customers? Or is it marketing carefully plotting a release by release path to dominance? Or is it people who truly believe that having a viable market for linux software will be good?

I mean, there might be some truths - people lag with their updates, people don't defend their privacy, and people would like to pay for software but have no avenue to do so.

But accepting those truths and unilaterally forcing "solutions" might find linux is a different sort of animal.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#513
post #421

I am very diligent about applying updates as soon as I'm able and generally read the changelogs of the updates I'm applying in Ubuntu's Software Updater. One thing I will not do is willingly allow somebody else a way to deploy and execute code on my computer without my say so (which snap is). After reading the whole thread at https://forum.snapcraft.io/t/disabling-automatic-refresh-for... and seeing Gustavo Niemeyer'…

It's probably not a surprise to you, but this is a hotly debated topic inside Canonical. And I apologize for that thread, as it really doesn't represent our best attempt at external debate.

Changing a paradigm usually involves pushing the envelope and breaking some existing assumptions; systemd is everybody's favorite example of that in the Linux world. The root of this issue with snaps is the trade-off between built-in security and user control. Some points to consider:

1. Browsers like FF and Chromium [on Windows] simply self-update, and disabling that requires configuration. So there is at least some precedent for taking the position that user applications should just update themselves. Server apps are more complex and are a strong argument counter to the existing behavior, as is the fact that many apps cannot be refreshed without user impact.

2. Ubuntu, since 16.04 LTS, ships with unattended-upgrades enabled, which means that for debian packages the default behavior is already auto-updating (although automated reboots are not enabled by default, as that would be crazy for the general purpose case). That feels like the correct default, too, given the risk of running code exposed to exploitable, public CVEs — and how reluctant users (like my dad and my wife!) are to click on "Install now" in the update-manager dialog.

3. Debian package updates run as root. Snap updates run in userspace, and confined. So in principle the risk exposure for snap updates is much smaller. And snaps do have an auto-rollback mechanism for failed updates [a]. Counter to that argument is the fact that snaps are meant to be under third-party control, and that there is no clear mechanism to separate security patches vs updates which you get with the debian pocket mechanism (i.e. focal-security vs focal-updates).

The lack of any official [b] means of user control over the snap auto-update mechanism feels wrong to many of us, including me. And while we may seem somewhat opaque in these debates, the feedback we get in threads like this one (and the snapcraft.io one) actually feeds into our decision making. So please do keep pushing on this topic and we'll do our part internally.

[a] See https://kyrofa.com/posts/snap-updates-automatic-rollbacks for a detailed guide on this topic. Of course, if your snap refreshes and you hate the new version, downgrading isn't quite always possible.

[b] There are ways to, hmmm, control auto-updating (i.e. refresh.metered, refresh.hold) if you really want to; that thread has a few. That doesn't help the debate, but I'm sharing in case someone has a technical need for it.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#514

Earlier quoted context omitted.

It would be appropriate if you didn't try to misuse the present crisis to lend undue emotional weight to your argument. This is manipulative. Further your argument draws a connection but its spurious a sufficient difference in degree is a difference in kind. The way in which we comport ourselves while sick have the potential on net to kill millions of people where as the peril implied by users failing to update windo…

> It would be appropriate [...] This is manipulative. Please don't make unfounded accusations and personal attacks based on suppositions. It was just an easy to understand analogy of how your decisions can have consequences beyond yourself, and does the job without any hint of "emotional weight". The rest is in the eye of the beholder. > have the potential on net to kill millions of people Talk about manipulative and…

>perhaps the most critical aspect is that the perverse incentives are left to the judgement of users with little to no understanding of the system or the wider implications of misusing it.

This is true of capitalism and democracy. The worst choice for economics or governance except for all the other choices. I want a system that respects the users judgement not yours. No matter how well meaning you can't adopt the perspective of all users nor do I desire to see the mediocre results of smart people who know better than their users trying.

It's actually not that hard. If you make updates something that silently happens periodically without interrupting the users or making many changes to the UI that the users rely on they will let you update the parts they don't directly touch all you want to secure their systems.

When you want to make major changes make them opt in and test them to ensure they are actually substantially superior. After a while deprecate the old UI. People will tolerate infrequent major changes far better than constant small breaking changes to their workflow.

Again if you don't make updates suck you don't have to coerce people into doing them. If you are figuring out how to coerce users for their own good you are solving the wrong problem.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#515
post #421

I am very diligent about applying updates as soon as I'm able and generally read the changelogs of the updates I'm applying in Ubuntu's Software Updater. One thing I will not do is willingly allow somebody else a way to deploy and execute code on my computer without my say so (which snap is). After reading the whole thread at https://forum.snapcraft.io/t/disabling-automatic-refresh-for... and seeing Gustavo Niemeyer'…

It's probably not a surprise to you, but this is a hotly debated topic inside Canonical. And I apologize for that thread, as it really doesn't represent our best attempt at external debate. Changing a paradigm usually involves pushing the envelope and breaking some existing assumptions; systemd is everybody's favorite example of that in the Linux world. The root of this issue with snaps is the trade-off between built…

Why not at least have an option per install to control the update behavior?

I might want the latest Chrome and Firefox. But I don’t necessarily want the latest update to other applications.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#516

Earlier quoted context omitted.

Windows lets you set your network connection as metered, and doing so prevents it from applying automatic updates. I recently switched back to linux myself, but there are certain utilities and conveniences and options in Windows that linux distros don't yet provide, and ubuntu definitely is not meant to be light weight in any sense of the term. Is switching to something else an option at this point?

I think part of the problem is that many newish users equate Linux with Ubuntu, good and bad. There are many other options and Ubuntu should not be the default anymore.

I've tried several Linux distros, but always go back to Ubuntu as it tends to work with the least fuss. Still a lot of fuss compared to Windows and Mac for desktop software, but less for development, so it balances out. Ubuntu 20.04 is super snappy (catch the pun?) and really has been working well for me. I strongly recommend it. It feels like a new computer.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#517

Earlier quoted context omitted.

Shared dependencies made sence back in the day, when the world was a simpler place and there was less variety. We have long since arrived at a point where its much more sensible to sandbox every application, with a majority of it's dependencies - less things break, less compatability problens, easier updates, greater reliability. All major operating systems have done this now, Windows, Mac, etc. There is no turning b…

Is it? On the Linux desktop there haven't been any new desktop apps for well over a decade (up to maybe Krita and the Blender redesign). Inkscape has been 20 years in the making and just released 1.0. These apps are basically developed against the X Windows API from 1983 or so. So for which hypothetical apps exactly we do need these enormous container formats isn't clear at all. It's not that the existing desktops ap…

Developers love to reinvent things. "Not Invented Here" and all that.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#518

> Snap applications auto-update and that’s fine if Ubuntu wants to keep systems secure. But it can’t even be turned off manually. OMG. Is this real? This is the exact reason I use Linux instead of Windows 10 or macOS. I am not a grandma who can't stay up to date on tech news. At the least there should be a toggle for power users. But no, you can only defer it. Am I the only one who doesn't like it when your already s…

We work at remote sites on cell connections. Part of the reason we moved to Ubuntu from Windows was the ability to control data usage, which is expensive. Automatic updates quickly become a significant slice of the bill when random decisions like these get pushed on users. Ubuntu was supposed to help prevent us from needing to chase this.

FWIW, for this very reason, there is refresh.metered=hold, as I note in my comment earlier in the thread.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#519
post #400
post #22

We tried to make an internal IoT device using Ubuntu Core and snaps because the capabilities of it were very promising. We started a PoC and about halfway through we hit a major roadblock. Our enterprise network does certificate substitution, and Ubuntu Core absolutely does not allow you to install your own certificates globally, so our devices would never receive updates. We tried EVERY hack we could think up, short…

> We tried EVERY hack we could think up Just to be sure, installing the CA from that MITM box didn't work? Because that should be the generally recommended solution and I can't see why snap would have a hardcoded CA list separate from the system. If that didn't work, it's indeed a bug, but a rather weird one; definitely worth posting to the bug tracker.

The CAs are hard embedded in the core snap. They're pulled from some specific package when built, but snaps themselves are immutable. We attempted to overwrite it in several different ways, but the OS is just simply mounting these folders from the core snap (which is immutable), and then marking those mounted paths them as immutable.

That being said, there are a list of paths you can write to, and they're listed here (for core18): https://github.com/snapcore/core18/blob/master/static/etc/sy...

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#520
post #512
post #421

I am very diligent about applying updates as soon as I'm able and generally read the changelogs of the updates I'm applying in Ubuntu's Software Updater. One thing I will not do is willingly allow somebody else a way to deploy and execute code on my computer without my say so (which snap is). After reading the whole thread at https://forum.snapcraft.io/t/disabling-automatic-refresh-for... and seeing Gustavo Niemeyer'…

I have to use Ubuntu 18.04 for some things and even with a minimal installation, I found some things phoned home or pushed changes. I could remove some packages, like ubuntu-report or unattended-upgrades, but some seemed to be intertwined with other packages in a (purposeful?) labyrinth of nested dependencies. They made themselves critical and uninstalling would break or cripple other fundamental system components. S…

I was aware of `motd_news` and disable it on each new install, but I somehow completely missed `apport` and `kerneloops`. Trying to keep up with Canonical's attempts is why I switched all my new systems to Debian. Far more stable and predictable.
Post reply on HN