undefined | Better HN

0 pointstannhaeuser7y ago0 comments

A poor package repository is a consequence of too many packaging formats, and lack of volunteer maintainers, though (I, too, could have made more to help). So coming up with package formats all the time - .deb, .rpm, .apk, Alpine's pm format, pkg, .dmg, flatpack, snap, docker and whatnot - is exactly the problem (cf. https://xkcd.com/927/). Maybe Slackware got it right after all by only building from upstream .tgz source archives. We'll see in a decade or two what software is even remotely in a usable state still.

0 comments

derefr7y ago

Those aren't "package formats"; they're different names for a very small set of actual container formats (e.g. tar, zip), with the names there to namespace different incompatible OS file-layout hierarchies and sandboxing technologies.

If it was just about packaging, everyone would just have a build server that creates their binary once and then slams it through https://github.com/jordansissel/fpm.

But there are more fundamental differences between OSes than how the insides of their packages look. The packages are "differently shaped" to prevent you doing something stupid and damaging your OS by installing a package that will spew files in all the wrong places, and rely on classes of protections that aren't there.

AnIdiotOnTheNet7y ago

Hmm... it's almost like maybe applications shouldn't spew their files all over in the first place, then you wouldn't have to worry about putting them in the wrong places...

derefr7y ago

If you can tell me what a self-contained equivalent to, say, the libpam package would be, I’m all ears.

Oh, also, a subset of case 2 is: packages that contain servers need to register the server as a service with the OS’s init system, and every OS has its own init system that expects a service definition file in its own distinct format and location.

1 more reply

im3w1l7y ago

The reason applications spew files all over the place is because that's how you hook into other systems. Want a man-page? There's a folder for that. Want to autostart? Folder for that. Want your program to be runnable without specifying the full path? Put it in path.

The reason configuration sucks is because we use filesystems, which are necessarily hierarchical, when we should use a more general database.

If we had a table where the first column was "thing to be configured" and the second column was "program" things would be much better. We could query by the first column to get e.g. all programs that want to automatically start, or all programs in path. Or we could query the second column to get all configuration for a given program.

Database people have done a lot of work on how to prevent inconsistent state, and we are stupid for not leveraging that.

1 more reply

xfer7y ago

> We'll see in a decade or two what software is even remotely in a usable state still.

Most distributions need non-free explicitly enabled, so almost all packages are open source, so it is irrelevant to distro packaging format.

tannhaeuserOP7y ago

Open source doesn't ensure it'll even build against new compilers, libs, language runtime, and all the other stuff we're reinventing all the time to keep the hamster wheel spinning. What open source desktop apps are you using that need sandboxing anyway all of the sudden? GIMP, Inkscape, Audacity? Come on.

voltagex_7y ago

>GIMP, Inkscape, Audacity

Yep - all of those. GIMP has scripting capabilities and exposure to vulnerabilities via image codecs, same as Inkscape, and Audacity could be linked to ffmpeg, which is a huge attack surface.

WrtCdEvrydy7y ago

> We'll see in a decade or two what software is even remotely in a usable state still.

Fucking none of it, that's your answer.

j / k navigate · click thread line to collapse

0 comments

derefr7y ago

If it was just about packaging, everyone would just have a build server that creates their binary once and then slams it through https://github.com/jordansissel/fpm.

AnIdiotOnTheNet7y ago

Hmm... it's almost like maybe applications shouldn't spew their files all over in the first place, then you wouldn't have to worry about putting them in the wrong places...

derefr7y ago

If you can tell me what a self-contained equivalent to, say, the libpam package would be, I’m all ears.

1 more reply

im3w1l7y ago

The reason configuration sucks is because we use filesystems, which are necessarily hierarchical, when we should use a more general database.

Database people have done a lot of work on how to prevent inconsistent state, and we are stupid for not leveraging that.

1 more reply

xfer7y ago

> We'll see in a decade or two what software is even remotely in a usable state still.

Most distributions need non-free explicitly enabled, so almost all packages are open source, so it is irrelevant to distro packaging format.

tannhaeuserOP7y ago

voltagex_7y ago

>GIMP, Inkscape, Audacity

Yep - all of those. GIMP has scripting capabilities and exposure to vulnerabilities via image codecs, same as Inkscape, and Audacity could be linked to ffmpeg, which is a huge attack surface.

WrtCdEvrydy7y ago

> We'll see in a decade or two what software is even remotely in a usable state still.

Fucking none of it, that's your answer.

j / k navigate · click thread line to collapse