Flatpak politics getting out of hand?

astyle

astyle

Sigh... just recently, I came across a news item that I'd like to get people's opinion on...

OBS Studio Raises Issues With Fedora's Flatpak Package - Phoronix

www.phoronix.com www.phoronix.com
Reading through the article, it involves OBS Studio (Packaged as multimedia/obs-studio on the FreeBSD side of things), but it really seems like any other Open Source project could fall victim to this kind of spat.

I have called out poor packaging in FreeBSD before: Thread sienna_cichlid-driver.86670

We have a rather active thread about pkg 2.0 issues: Thread pkg-2-0-0-problems.96540

We do have lots of debates of pkg vs ports (Looking for such threads is left as an exercise for the reader).

We do have occasions when a port maintainer ended up letting the port expire after putting in lots of effort into trying to make it work on FreeBSD: math/sage is marked as an expired port. The same maintainer is still active on other ports (he's maintaining math/rkward).

We do have the Porter's Handbook as the official, definitive guide to getting a FreeBSD port of software published. As long as a dev has the patience to make sure the software still works after correctly following instructions in Porter's Handbook, and it's not under a license that makes such publishing impractical (illegal copy of something like metin2), software can be packaged for FreeBSD.

What has me shaking my head is the sheer pettiness I'm seeing in Linux camp... What I say next will only make sense to someone who actually read the Phoronix article I linked to.

I think it is understandable for a project like Fedora to want to prioritize their own packages over upstream. But if a piece of software is broken in the official repos, it really should be up to the user to be able to get the software from elsewhere, be it Flathub or Github or whereever. It does sound like it got ugly over specifically packaging between OBS Studio and Fedora. If Fedora wants to offer its own packages of OBS Studio, I do see it as responsibility of the Fedora project to properly package OBS.

Properly packaging software is a lot of work - which is why FreeBSD relies on volunteers to maintain ports, and has the Porter's Handbook as a definitive guide. Yeah, we do have some abandoned ports, and a rather large distcache. Yeah, sometimes a port expires. Yeah, sometimes you can't get something to build on FreeBSD even after trying.

Well, with Red Hat and Fedora messing up the very idea of what's upstream, what's downstream, their spat with OBS Studio is frankly popcorn material to FreeBSD users. 🍿

So, after reading this post, what's your take, people?
 
Funny, I just came from Phoronix to here, and then see this post. Frankly, this is just another example of warning to the BSD community of what happens when you let Not Invented Here ideology creep in, and allow personality and politics to rule. It is a plague affecting Linux distros and the Open Source community at large. You don't have to limit yourself to Phonornix, other tech news sites are filled with recent articles about long time maintainers stepping down from projects over "toxic community" or "politics." It seems every so often, someone gets an idea (probably their Master's thesis project) on how they could do things "better" then get a cadre of loyal followers to browbeat the community into completely replacing a good but flawed system with yet another very flawed system. We have to be on guard here against this.

It is one of the things historically I have appreciated about FeeBSD. Does the software have problems? Fix it if possible. Replace only when absolutely necessary. A good idea is a good idea, regardless of where it comes from. I like doing things differently from you, but that's cool - I respect your right to do software the way you like, and won't try to force you into my way.
 
Reading the Phoronix article I fail to see what this has to do with Flatpack as such. It's just a Fedora person breaking a piece of software when an unbroken version of the same software is available. But upstream and downstream both use Flatpack.

Hey at least it's not Snap.
 
astyle said:
but it really seems like any other Open Source project could fall victim to this kind of spat.
Click to expand...
I don't see any problem with that, because this is the unofficial OBS Studio Flatpak. By the way, Flatpak will never be integrated into the FreeBSD ecosystem. So, that's the problem with Linux.
 
My point was about project maintenance... I do see that FreeBSD community can be pretty level-headed about sticking to a design that works, having a sensible policy on what to do if something doesn't work, and how to handle the fallout...

I've been trying to compile SageMath for awhile, and running into dificulties... but as I worked on that, I could see that the maintainer did put in the effort to make it work, but did not complain, and instead let the project expire rather than do any finger-pointing. Technically, it's probably possible to get SageMath back into FreeBSD. But it takes patience and willingness to troubleshoot and to acknowledge personal limitations.

Nobody's Gandhi, but being level-headed about things will get one further than trying to shove duties onto somebody else.
 
astyle said:
My point was about project maintenance...
Click to expand...

Unless I miss something the whole fuzz is about the Fedora maintainer for the OBS "port" doing a shitty job. That's double bad since he would have been free to do a one-shot copy of OBS' own flatpack sources.

I wonder whether they also have a rpm for OBS and whether it shares the same brokenness.
 
fmc000 said:
My take: one of the reasons I left Linux for FreeBSD is that I absolutely despise Flatpaks.
Click to expand...
Why do you despise Flatpaks?
I have read that each flatpak is isolated from the host running in a sandbox.
Is a flatpak in general not more secure compared to a "normal" package build for one OS?
 
LillieNB said:
Why do you despise Flatpaks?
I have read that each flatpak is isolated from the host running in a sandbox.
Is a flatpak in general not more secure compared to a "normal" package build for one OS?
Click to expand...

Well, that also disables some functionality such as picking up globally installed plugins, e.g. for audio effects and instruments.

And of course it is a waste of space since all the shared libs are no longer shared. This also affects RAM usage since you don't share libs in RAM anymore.
 
cracauer@ said:
Well, that also disables some functionality such as picking up globally installed plugins, e.g. for audio effects and instruments.

And of course it is a waste of space since all the shared libs are no longer shared. This also affects RAM usage since you don't share libs in RAM anymore.
Click to expand...
The shared libs part has always bothered me.
In the beginning, everything was statically linked, using lots of extra memory and storage space.
Then we went to shared libs, taking advantage of "sharing".
Now we have Snaps, Flats, Apps, which wind up being "containers having everything a single executable needs", so "statically linked images plus some more the sandboxing"

So you have an executable containing everything it needs reducing dependencies and perhaps an increase in security.

But at what cost?
 
mer said:
The shared libs part has always bothered me.
In the beginning, everything was statically linked, using lots of extra memory and storage space.
Then we went to shared libs, taking advantage of "sharing".
Now we have Snaps, Flats, Apps, which wind up being "containers having everything a single executable needs", so "statically linked images plus some more the sandboxing"

So you have an executable containing everything it needs reducing dependencies and perhaps an increase in security.

But at what cost?
Click to expand...

Flatpack can at least share libraries between packs that happen to use the same ones in the same version (but not with the host system). Although at the cost of even more complexity.
 
LillieNB said:
Why do you despise Flatpaks?
I have read that each flatpak is isolated from the host running in a sandbox.
Is a flatpak in general not more secure compared to a "normal" package build for one OS?
Click to expand...
Moot point IMHO. You may have malicious Flatpaks that are sandboxed and therefore they cannot access your home directory by default but they can trick you and obtain access to your crypto wallet and wipe it out. Already happened.

In short, your system is as secure as you make it.
 
LillieNB said:
Why do you despise Flatpaks?
I have read that each flatpak is isolated from the host running in a sandbox.
Is a flatpak in general not more secure compared to a "normal" package build for one OS?
Click to expand...
cracauer@ said:
And of course it is a waste of space since all the shared libs are no longer shared. This also affects RAM usage since you don't share libs in RAM anymore.
Click to expand...
And now consider that every single app now needs its own copy of libs that are normally in the system... especially if the lib versions are incompatible? or on the off chance if lib versions are actually compatible? For me, that's a deal breaker with Flatpaks, Snaps, AppImage, and whatnot. I'd rather compile from sources and optimize from that angle.
 
I don't like the fact that everything is supposed to be contained, which means you are keeping multiple copies of libs as mentioned above, but then you seem to be bringing in random stuff like a load of nvidia flatpak dependencies as well! It's just messy in my eyes. I have always just stuck to the native package format of any OS, maybe I am just getting old and don't like change ;)
 
Crivens said:
People will start to release stuff as VMware images, so we all can share.
Click to expand...
I was considering making a VirtualBox appliance with SageMath... but it's my personal itch to make it run on FreeBSD. After all, FreeBSD makes it rather easy to compile ports with EVERYTHING turned on. I just don't want to do a Linux appliance and end up with a $500 calculator that somebody will probably release on bittorrent soon.
 
LillieNB said:
Why do you despise Flatpaks?
I have read that each flatpak is isolated from the host running in a sandbox.
Is a flatpak in general not more secure compared to a "normal" package build for one OS?
Click to expand...
Flatpaks try to solve the packaging problem of having to ship to dozens of Linux distros. They weren't designed with security in mind and may be worse in this aspect for at least 2 reasons:
1. They require kernel features like unprivileged user namespaces that have had security issues in the past. Now web browsers require it so we gotta live with it anyway.
2. Flatpaks aren't updated that often and lots of flatpaks in Flathub are unofficial.

I prefer distro packages when available because they at least have some security scrutiny.

For some large GUI applications Flatpaks make sense. I use containers a lot for other stuff.

I don't get why Ubuntu tries to push Snaps when everybody ships .deb packages for their distro. Flatpaks benefit mostly distros will less users.
 
You must log in or register to reply here.
Back
Top