Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is Debian the way it is?

blog.liw.fi

Post reply on HN
Print view View original

121–130 of 198 posts

Re: Why is Debian the way it is?

#121

Post by codedokode »

What I don't like in Debian:

- 3rd-party software is not welcome; there is no mechanism for installing it securely because you are supposed to either install software from official repository or compile what you have written yourself. For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys. Of course, you can ignore security and run sudo curl http://script , but it doesn't guarantee that the installer won't break something. It is like we are back in 95 when every second program would replace system DLLs in Windows folder and break other software.

- there are third-party repositories, but they can cause conflicts and you better not use them, but there is no other way to install third-party software.

Third-party software is very important, I install OS to run it, and it surpises me that Linux is so unfriendly to third-party software, including closed-source software and doesn't provide means to install and run it securely and reliably and without making developers adapt it to every existing distribution.

- their bugtracker is email-based and as I don't use email it is completely alien to me. But maybe this is not bad because it stops most of people from posting bugs and saves time to reply to them.

I also tried Fedora, and here is what I don't like:

- they release a new version every 6 or 12 months and it is incompatible with older version, and you have to use a very weird way to upgrade: first, you need to install non-standard plugin (dnf-plugin-system-upgrade), then you need to download packages, then reboot into a temporary OS, then if everything is ok, it will create a new OS, and reboot into it. It looks complicated, easy to break and probably requires a lot of disk space, while Debian can upgrade everything in place.

- if a system component like Gnome is crashing, there will be neither log records nor crash dumps and you will never figure out why it has crashed

Also, APT is buggy when dealing with mixed 32-bit/64-bit packages: I wanted to install a package once and it suggested to delete half of the system to do it; luckily I have noticed that the package list is too long before agreeing. Why would package manager delete packages when I ask to install something, I don't understand. As a bugtracker requires using email, I didn't report it, and it would be difficult to reproduce this anyway.

Re: Why is Debian the way it is?

#122

Post by codedokode »

rlpb wrote: post #97

"Self-contained" and "No bundled libraries" are two very important concepts that a subset of our ecosystem decided was too much work. Then they re-discovered all the problems that result, and have now coined terms like "software supply chain" to describe them. Meanwhile Debian doesn't suffer from any of this because it's been doing things so as to avoid these issues all along.

Usually developer of application tests it only with a specific version of a library. If you use another version of library, you need to carefully test it and fix all found bugs and I am not sure if Debian has resources to do it. So we can assume that they simply use untested combinations of libraries and hope that everything will be ok (it won't).

Re: Why is Debian the way it is?

#123

Post by klysm »

gorgoiler wrote: post #115
klysm wrote: post #91

Earlier quoted context omitted.

I’m pretty convinced it was net positive in the long term. If Debian hadn’t gone with systemd, then where would it be today? Stuck in shell script hell?

We would have been forced to bite the bullet and implement a packaging extension that allowed debs to describe what to start at boot time, when, and how. The compatability layer would have allowed any init system to be used. Instead we welded the systemd engine into the chassis and pray that when it comes to replacing it we aren’t the ones on the hook.

> The compatability layer would have allowed any init system to be used.

I don’t see how such a compatibility layer would work in a way that doesn’t suck horribly.

Re: Why is Debian the way it is?

#124

Post by Karellen »

codedokode wrote: post #121

What I don't like in Debian: - 3rd-party software is not welcome; there is no mechanism for installing it securely because you are supposed to either install software from official repository or compile what you have written yourself. For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys. Of course…

> For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys.

First, if you don't trust a bit of software, why are you installing it?

But more importantly - you don't want your text editor to be able to open and edit your browser history files, or your ssh key files?

If my text editor wasn't able to open and edit those files, I'd consider it extremely broken!

Re: Why is Debian the way it is?

#125

Post by Barrin92 »

LeoPanthera wrote: post #77
Dwedit wrote: post #67

Debian's policies also led to a heavily restricted version of RetroArch being available instead of the real version. Specifically, RetroArch has its own package management functionality built-in through its "Core Updater" feature, which downloads and installs emulators in the form of library files. This is banned by Debian because it sidesteps the whole package manager system. Meanwhile, you can still build the full…

RetroArch provides a Flatpak, making this mostly a non-issue.

no, from a distribution standpoint it's a pretty grave issue. As the name suggests distributions distribute, and if we start to unbundle the OS from the application layer, Debian loses the very thing people chose it for.

It's in a sense like a legacy carmaker or newsroom being more concerned with its own control than with the product. Doesn't end well over the long term.

Re: Why is Debian the way it is?

#126

Post by Karellen »

humanrebar wrote: post #119
samueloph wrote: post #81

Earlier quoted context omitted.

Debian can't really directly pay contributors (there are some rare few cases like lawyers, etc....), so that would be one of the reasons for what the article is talking about. The best thing someone could do in this scenario would to be hire someone to work on/improve Debian directly.

Someone could form a nonprofit org that funds packaging work in Debian. Or maybe even a for-profit one. I'm pretty sure a lot of big consumers would rather pay for expertise instead of having an in-house Debian "upstream" team.

https://www.debian.org/donations

> The easiest method of donating to Debian is via PayPal to Software in the Public Interest, a non-profit organization that holds assets in trust for Debian.

https://www.spi-inc.org/

> Software in the Public Interest (SPI) is a non-profit corporation registered in the state of New York founded to act as a fiscal sponsor for organizations that develop open source software and hardware. Our mission is to help substantial and significant open source projects

Edit: But also, freexian

https://www.freexian.com/lts/debian/

> To achieve the 5 years of support, and properly cover all Debian packages, Freexian organizes a corporate sponsorship campaign with the goal of funding the work of multiple Debian contributors who are established as independent workers.

> If you are not yet convinced, here are seven reasons why you should help fund the Debian Long Term Support initiative (LTS):

Re: Why is Debian the way it is?

#127

Post by Timber-6539 »

Karellen wrote: post #124
codedokode wrote: post #121

What I don't like in Debian: - 3rd-party software is not welcome; there is no mechanism for installing it securely because you are supposed to either install software from official repository or compile what you have written yourself. For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys. Of course…

> For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys. First, if you don't trust a bit of software, why are you installing it? But more importantly - you don't want your text editor to be able to open and edit your browser history files, or your ssh key files? If my text editor wasn't able to ope…

Is VS Code a text editor? I wouldn't consider anything that has internet access permissions or a suite of 3rd party user plugins/extensions a text editor but that's just me.

Giving VS Code express permission to your home/filesystem (the default if you install it traditionally) is a security risk [0] [1] most people rarely think about.

[0] https://blog.aquasec.com/can-you-trust-your-vscode-extension...

[1] https://www.techradar.com/news/hackers-are-using-malicious-m...

Re: Why is Debian the way it is?

#128

Post by convolvatron »

SSLy wrote: post #118
convolvatron wrote: post #87

Earlier quoted context omitted.

not entirely. I was involved in the IETF in the early 90s. At that time the old guard were the sort of second wave of internet designers (Clark, Estrin, Zhang, Cerf, Deering, Jacobsen....not going to pretend to list everyone). They primary worked off of (D)ARPA grants, although some of them them did work at places like Parc, and certainly places like Cisco. during that time, alot more money was being dumped into this…

proto design has been killed by incompetent enterprise firewall vendors and administrators (or, well, their managers). the stupid dance tls1.3 has to do is best case in point.

yeah. there are plenty of reasons. I do think the shift to the client(nat)/server(default-free) model did alot of damage. ATM was also a huge suckhole that killed momentum. and I think ISP just stopped listening to what the ietf had to say for the most part.

Re: Why is Debian the way it is?

#129

Post by jwilk »

pwdisswordfishc wrote: post #104
bostik wrote: post #53

Earlier quoted context omitted.

I'm a Debian user since 1998 and have had it as my personal desktop since that time. I'd think that counts for something. > Apt is also just such a phenomenal package manager. It is fast out of the box, This wasn't always the case. There's a good reason almost all guides first written before 2015 specifically instructed everyone to use 'apt-get' directly. For quite some time the more uniform 'apt' frontend really was…

For quite some time the more uniform 'apt' frontend really didn't exist at all.

Indeed. The "apt" frontend was added in 2014 and included in a stable release in 2015.

So I don't know what tool other than apt-get could "guides first written before 2015" use.

Re: Why is Debian the way it is?

#130

Post by Karellen »

Timber-6539 wrote: post #127
Karellen wrote: post #124

Earlier quoted context omitted.

> For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys. First, if you don't trust a bit of software, why are you installing it? But more importantly - you don't want your text editor to be able to open and edit your browser history files, or your ssh key files? If my text editor wasn't able to ope…

Is VS Code a text editor? I wouldn't consider anything that has internet access permissions or a suite of 3rd party user plugins/extensions a text editor but that's just me. Giving VS Code express permission to your home/filesystem (the default if you install it traditionally) is a security risk [0] [1] most people rarely think about. [0] https://blog.aquasec.com/can-you-trust-your-vscode-extension... [1] https://www…

> Is VS Code a text editor?

Um, I thought it was?

I've not used it, because I'm happy with (neo)vim for my dev needs, but I thought that's what it did?

If VS Code isn't used to edit text, what is it for?

Edit: (neo)vim and emacs both have 3rd party extension ecosystems, with extensions written in languages that can access the internet, so I'm not sure how that affects your test?

Post reply on HN