Live data from Hacker News

Certbot deprecates operating system packages, “standardizes” on snaps

certbot.eff.org

21–30 of 57 posts

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#21
post #5

Earlier quoted context omitted.

A distro-independent avenue for distribution could be important, but surely we can do better than snapd.

Have we done better, or is snapd the best option for their needs as of today?

Snapd is not a solution to anything. It might be distro-agnostic, but it's tied to Canonical. The server is closed source and the client doesn't support multiple servers.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#23
post #9

Literally just switched from Ubuntu to Debian to get away from snaps

Linux Mint has even removed snap, which is impressive since they're downstream from Ubuntu.

After hearing some of the issues with it (here and elsewhere), I'm kinda grateful to them for making the effort.

Though this concerns me -- I use certbot on some debian servers, I hope that at least stays up to date.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#24
post #15

Snaps require you to allow each publisher to automatically push arbitrary software updates to your machine, and snap deliberately does not allow you to disable this misfeature. It's not a bug or an oversight -- it's part of the design of snap, and it's not going to change. Handing out the keys to the kingdom like this is supremely annoying on a desktop (e.g. Windows 10), but it's completely unacceptable on a server.…

I agree — the auto-updating nature of Snaps are a problem without an easy solution: https://askubuntu.com/questions/930593/how-to-disable-autore...

But I would also point out that on stable Debian it’s near impossible to deploy Certbot because the versions available are too old, especially the plugins. I’ve been routinely installing the snap instead because it’s a quick and easy way to deploy the service at the latest version.

The only other alternative to suggest is to request the Certbot project deploys custom deb repos or similar. But can we expect that of every project? Perhaps we need a new standard to replace snap, if so the only folks I can see large enough to promote it would be GitHub...

Since that’s unlikely to happen, maybe just noting the auto-update “feature” more prominently in their is all they should need to do?

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#25
post #15

Snaps require you to allow each publisher to automatically push arbitrary software updates to your machine, and snap deliberately does not allow you to disable this misfeature. It's not a bug or an oversight -- it's part of the design of snap, and it's not going to change. Handing out the keys to the kingdom like this is supremely annoying on a desktop (e.g. Windows 10), but it's completely unacceptable on a server.…

And if all that wasn't bad enough - snapd also purges package change history after something like 72 hours so you can't even tell what updates were applied and when to your system.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#26
post #15

Snaps require you to allow each publisher to automatically push arbitrary software updates to your machine, and snap deliberately does not allow you to disable this misfeature. It's not a bug or an oversight -- it's part of the design of snap, and it's not going to change. Handing out the keys to the kingdom like this is supremely annoying on a desktop (e.g. Windows 10), but it's completely unacceptable on a server.…

And if all that wasn't bad enough - snapd also purges package change history after something like 72 hours so you can't even tell what updates were applied and when to your system.

We usually call this an RCE exploit.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#28

snaps are tied to the proprietary Ubuntu store and they are not available on all of the Linux flavors. For instance, I don't see snapd on Alpine Linux: $apk search snapd $ Not cool, I think.

An alpine Linux core dev appears to maintain the alpine package for Certbot. I don’t see it being deprecated anytime soon.

The snap is very different and relies on systemd which isn’t commonly found in Alpine.

Re: Certbot deprecates operating system packages, “standardizes” on snaps

#29
post #23
post #9

Literally just switched from Ubuntu to Debian to get away from snaps

Linux Mint has even removed snap, which is impressive since they're downstream from Ubuntu. After hearing some of the issues with it (here and elsewhere), I'm kinda grateful to them for making the effort. Though this concerns me -- I use certbot on some debian servers, I hope that at least stays up to date.

Debian is still on version 0.x when the snap is at 1.1 ... this is one of those cases where the Debian stable branch is too stable when you need to ship software that interacts with a lot of remote APIs the way the certbot-dns packages do. It’s impossible to use the old Debian versions with the more secure API tokens from CloudFlare, for example.
Post reply on HN