Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why is Debian the way it is?

blog.liw.fi

Post reply on HN
Print view View original

131–140 of 198 posts

Re: Why is Debian the way it is?

#131

Post by gsliepen »

codedokode wrote: post #121

What I don't like in Debian: - 3rd-party software is not welcome; there is no mechanism for installing it securely because you are supposed to either install software from official repository or compile what you have written yourself. For example, if you want to install Sublime Text, or VS Code, there is no way to do it securely, without giving untrusted software access to your browser history and SSH keys. Of course…

Almost all software that Debian packages is 3rd-party. The issue is usually that software like Sublime Text or VS Code is non-free. That is not in itself an impediment for being packaged; after all there is the "non-free" section of the archive. However, often non-free software is also not free to be distributed by third parties. Thus, Debian would break the law if they did.

You don't need to adapt your software that much to have it run on Linux distributions; there are standards that the distributions implement that you can rely on. Often software that claims to only support one particular distribution will run perfectly fine on others. Linux distributions are not unfriendly towards third party software, but they have no obligation at all to spend effort to make that software work, it's the third parties that should do that work.

The bug tracker being email based is because when Debian started, that was the normal way to communicate on the Internet (besides IRC). A lot of tools were built on it, and the Debian developers themselves are used to it, so there is little incentive to change this.

The Debian developers would say that apt is not buggy; it's just that if there are conflicts, they have to be resolved in some way, which means deleting some of the conflicting packages. It also does ask you to confirm in this case. Although it would indeed be better if it would detect this is a very unsatisfying solution.

Re: Why is Debian the way it is?

#132

Post by duped »

bscphil wrote: post #108
asveikau wrote: post #101

Earlier quoted context omitted.

I think either approach makes sense depending on who you are. If your goal is to distribute software across multiple distros and operating systems, bundling dependencies makes sense. If your goal is to maintain a distro, shared libraries that you can apply a security patch to exactly once is obviously better. But these are two different people with either goal.

> If your goal is to distribute software across multiple distros and operating systems, bundling dependencies makes sense. Of course, an important "exception to the exception" is when you're making software that can easily be distributed by distributions, e.g. because it's end user software and open source. I think the optimal cases for bundled dependencies are (a) large closed source binaries that never change, like…

> is when you're making software that can easily be distributed by distributions, e.g. because it's end user software and open source.

I have trouble understanding why this is desirable for either authors or end users. Even for open source end user applications, I want the software that I'm running to be reflective of the software that was authored and not the software that some distro maintainers think it should be.

Re: Why is Debian the way it is?

#133

Post by jwilk »

bostik wrote: post #53
dietrichepp wrote: post #39

Earlier quoted context omitted.

Yeah. I keep coming back to Debian after trying out another distro for a while. There are some specific complaints I have about technical choices for Debian, like the way daemons autostart post install. But these complaints are outweighed by the benefits of using a distro with coherence across packages and upgrades. Apt is also just such a phenomenal package manager. It is fast out of the box, and supports some relat…

I'm a Debian user since 1998 and have had it as my personal desktop since that time. I'd think that counts for something. > Apt is also just such a phenomenal package manager. It is fast out of the box, This wasn't always the case. There's a good reason almost all guides first written before 2015 specifically instructed everyone to use 'apt-get' directly. For quite some time the more uniform 'apt' frontend really was…

> For quite some time the more uniform 'apt' frontend really wasn't intuitive or helpful.

What do you mean?

Re: Why is Debian the way it is?

#134

Post by imp0cat »

klysm wrote: post #107
Narann wrote: post #41

Earlier quoted context omitted.

> the .deb ecosystem still feels like its stuck in the late 90s linux era to me. Can you elaborate, please? What do you mean by this?

Quirky, clunky tooling with a bunch of arbitrary shit you have to memorize to use correctly. People enjoy that kind of thing after they learn it.

Enjoy? No. But yeah, it gets easier once you've done it a few times.

Re: Why is Debian the way it is?

#135

Post by colanderman »

jwilk wrote: post #129
pwdisswordfishc wrote: post #104

Earlier quoted context omitted.

For quite some time the more uniform 'apt' frontend really didn't exist at all.

Indeed. The "apt" frontend was added in 2014 and included in a stable release in 2015. So I don't know what tool other than apt-get could "guides first written before 2015" use.

aptitude. And before that, dselect (which I believe predated APT entirely).

Re: Why is Debian the way it is?

#136

Post by rlpb »

asveikau wrote: post #101
rlpb wrote: post #97

"Self-contained" and "No bundled libraries" are two very important concepts that a subset of our ecosystem decided was too much work. Then they re-discovered all the problems that result, and have now coined terms like "software supply chain" to describe them. Meanwhile Debian doesn't suffer from any of this because it's been doing things so as to avoid these issues all along.

I think either approach makes sense depending on who you are. If your goal is to distribute software across multiple distros and operating systems, bundling dependencies makes sense. If your goal is to maintain a distro, shared libraries that you can apply a security patch to exactly once is obviously better. But these are two different people with either goal.

What about the user?

If your goal is to consume software for which you need long term reliability, accepting software that bundles an unmaintainable (to you) set of dependencies does not make sense. Unless you have no better option [edit: or if you're paying to delegate your problems to someone else I suppose].

As a user, using software sources that make the same choices Debian makes is always preferable for you if that alternative is available.

Re: Why is Debian the way it is?

#137

Post by Timber-6539 »

Karellen wrote: post #130
Timber-6539 wrote: post #127

Earlier quoted context omitted.

Is VS Code a text editor? I wouldn't consider anything that has internet access permissions or a suite of 3rd party user plugins/extensions a text editor but that's just me. Giving VS Code express permission to your home/filesystem (the default if you install it traditionally) is a security risk [0] [1] most people rarely think about. [0] https://blog.aquasec.com/can-you-trust-your-vscode-extension... [1] https://www…

> Is VS Code a text editor? Um, I thought it was? I've not used it, because I'm happy with (neo)vim for my dev needs, but I thought that's what it did? If VS Code isn't used to edit text, what is it for? Edit: (neo)vim and emacs both have 3rd party extension ecosystems, with extensions written in languages that can access the internet, so I'm not sure how that affects your test?

Nano is a good example of a text editor.

Re: Why is Debian the way it is?

#138

Post by ploum »

gautamcgoel wrote: post #84
FuriouslyAdrift wrote: post #11

I worked with Ian Murdock at Purdue in the days of the very first release. He was a sysadmin and devloper while I was a web designer for the libraries. The guy truly believed in the GNU/Linux 'way' and 'free as in speech' software. His initial drive was from the difficulty of packaging and package management and that is probably his biggest contribution. Network-of-Workstations (NOW... think peer-to-peer infratsructu…

Can someone explain the controversy surrounding Bruce Perens? I never heard the story and Google isn't being helpful.

I’m also interested by any source about that. I’m reading a lot about open source history and can’t find anything about that story (which seems quite important for those who want to understand Debian history)

Re: Why is Debian the way it is?

#139

Post by rlpb »

codedokode wrote: post #122
rlpb wrote: post #97

"Self-contained" and "No bundled libraries" are two very important concepts that a subset of our ecosystem decided was too much work. Then they re-discovered all the problems that result, and have now coined terms like "software supply chain" to describe them. Meanwhile Debian doesn't suffer from any of this because it's been doing things so as to avoid these issues all along.

Usually developer of application tests it only with a specific version of a library. If you use another version of library, you need to carefully test it and fix all found bugs and I am not sure if Debian has resources to do it. So we can assume that they simply use untested combinations of libraries and hope that everything will be ok (it won't).

As if this isn't an issue with fast-moving "let's bundle everything" upstream code drops either?

Distribution releases have the advantage that they have a large number of followers who share the same set of versions, and so can shake out the issues and fix the bugs together. In practice I think this beats what most upstreams that each pick their own sets of versions can achieve on their own.

It only takes one skilled engineer to fix any given issue in a given distribution release, even at today's scale. That's not a big burden, and is even available to those not skilled with a relatively inexpensive support contract.

Corporate upstreams additionally tend to focus on what matters to paying customers; other use cases can often receive a "not supported" answer. A community of followers operating on the same set of versions can address these use cases more easily, too.

Re: Why is Debian the way it is?

#140

Post by mcculley »

arun-mani-j wrote: post #52

I personally love and use Debian exactly for its principles and stability. I have heard users of other distros and a few upstream complaint that Debian "modifies" their packages? Is it so? If yes, there surely must be a good reason. Can someone tell me about it?

This is not always good. See https://www.debian.org/security/2008/dsa-1571
Post reply on HN