I’m admittedly yelling at cloud a bit here, but I like package managers just fine. I don’t want to have to have a plurality of software management tools. However, I also don’t want to be caught off guard in the future if applications I rely on begin releasing exclusively with flatpak.

I don’t develop distributed applications, but Im not understanding how it simplifies dependency management. Isn’t it just shifting the work into the app bundle? Stuff still has to be updated or replaced all the time, right?

Don’t maintainers have to release new bundles if they contain dependencies with vulnerabilities?

Is it because developers are often using dependencies that are ahead of release versions?

Also, how is it so much better than images for your applications on Docker Hub?

Never say never, I guess, but nothing about flatpak really appeals to my instincts. I really just want to know if it’s something I should adopt, or if I can continue to blissfully ignore.

  • kixik@lemmy.ml
    0·
    10 days ago

    FLOSS used to include the ability to build software. Perhaps that’s not important anymore but now a days some developers don’t attend problems with their build recipes because they only consider what they release through binaries, whether on flatpak or whatever other binary repository they like. At least I dislike that, it’s ok to me some or most users would prefer to grab a bloated binary rather than building anything, but that doesn’t mean forgetting about those actually wanting to build from source, or wanting to use shared libraries and software from their distros, actually that’s a requirement for free/libre software repositories. Not sure if the tendency is to move the gnu+linux users into app stores like the ones on windows, now ubuntu snaps, android play store and the like. Sure there’s more security with sandboxing, but nothing one can’t get with firejail, and if wanting MAC as well then firejail + apparmor for example.

    At any rate, just my little rant. And if you’re wondering, I use AUR on Artix, and I really hope I won’t have a need for a flatpak stuff.

  • flatbield@beehaw.orgEnglish
    0·
    11 days ago

    I mostly do. 99.9% of the software I use is a Debian package. Well on Debian anyway. I do have one AppImage.

  • mexicancartel@lemmy.dbzer0.comEnglish
    0·
    9 days ago

    If there is nothing appealing on flatpak, then sure. But for me it was really appealing and I still ignored it because you need to download big files at the beggining. But later on i started using it for steam and all because that thing is better staying as user-installed files in some form of permission sandbox

  • toastal@lemmy.ml
    0·
    9 days ago

    Just use Nix. It can run all the packages on whatever platform. It has the largest repository of software & are some of the most up-to-date.

  • Name@programming.dev
    0·
    10 days ago

    So far I have also completely ignored them. From what I understand they technically allow you to install old versions of software, potentially having multiple at the same time. This could come in a clutch when working with stuff like Godot or Blender where constantly upgrading to the latest version would cause issues on bigger projects. This is the only thing I can see myself using them for, at least in the near future.

  • Caveman@lemmy.world
    0·
    9 days ago

    Maybe but probably not. People that develop applications can save a major headache by choosing flatpaks so the ecosystem will gravitate towards it.

    At some point new applications that didn’t launch a Linux version will do so but only on flatpak and older applications will start moving towards flatpaks since it’s less dev time.

    It looks to me as inevitable that the best versions of an app will be a flatpak but if you’re on Ubuntu based system you can probably get by for very long without them.

  • pathief@lemmy.world
    0·
    10 days ago

    This is what’s so great about Linux, you can use whatever the hell you want.

    Flatpaks provide some cool security functionalities like revoking network access to a specific application. Maybe you care about this, maybe you don’t.

    My personal policy is to always install from the repos. Occasionally something is only available in flathub, which is fine for me. I really understand how hard is maintaining something for every single package manager and diatributions and totally respect the devs using a format that just works everywhere. If I were to release a new Linux app, I would totally use flatpak.

    • LeFantome@programming.dev
      0·
      10 days ago

      Same boat. As a user, I greatly prefer everything to come from the repos. However, as a distributor, Flatpak makes so much more sense.

      The only Flatpak I have installed is pgAdmin. I looked at the build on Flathub with the idea of porting the package myself but got scared off. It was a maze of Python dependencies running in Electron. That seems like exactly the kind of thing that may be better off in its own sandbox.

    • Baldur Nil@programming.dev
      0·
      9 days ago

      I really understand how hard is maintaining something for every single package manager and distributions

      But for apps distributed in your system’s package manager, it’s not the devs that are distributing them in every package manager. It’s the distribution itself that goes to each repository, checks and tests the dependencies they need and creates the package for the distribution, along with a compiled binary.

      When they aren’t offered in the distro’s package manager (or the version is outdated because the distro isn’t rolling release) things become more complicated indeed, and sometimes you can’t even do it because the dependencies are older than the ones you require.

  • paequ2@lemmy.todayEnglish
    0·
    11 days ago

    I like package managers just fine. I don’t want to have to have a plurality of software management tools.

    Same. I grumble when I have to install things through the AUR. I’d prefer if it was in the official repos.

    can continue to blissfully ignore

    That’s what I’ve been doing. I haven’t run into a situation where I’ve needed to mess with Flatpak. 🤷 Curious to hear other folk’s experiences though.

    Also for your consideration, Flatpak seems to be mainly used for desktop GUI apps. You’ll still need your regular package manager to install CLIs. So… if you wanna keep your software management tools to a minimum…

      • paequ2@lemmy.todayEnglish
        0·
        11 days ago

        yay simplifies the AUR installation

        Simple to me means not having to install some random extra tool and just using pacman like normal. That’s why I grumble.

        • sorter_plainview@lemmy.today
          0·
          11 days ago

          Haa understood. In that perspective yes it is not simple. I would also be happy if pacman had better support for AUR.

          But I have a different perspective on this. I always look for the right or the best tool available to do something. So I’m not that hesitant to use another tool for AUR. I guess it’s a personal preference after all.

    • krakenfury@lemmy.sdf.orgOPEnglish
      0·
      11 days ago

      The AUR is a different kettle of fish entirely, though. I do see your point, but the AUR is solving a problem common to all distros; hosting a repository for applications that there isn’t willingness or capacity to host in the official binary repos.

      Installation, removal, dependency management, etc are all still handled by pacman. As others have pointed out there are great tools available to aid in AUR usability. My favorite is aurutils.

  • Limonene@lemmy.world
    0·
    11 days ago

    The risk of dependency vulnerabilities is real.

    Also, flatpak packages are not digitally signed, unlike apt and all other major Linux distro package managers.

  • Emma Liv@lemmy.caEnglish
    0·
    11 days ago

    Just as my two cents, as a user - I like flatpaks because I can have up to date versions of certain applications on a more stable Debian base. I also like that application configs all go in one spot (~/.var/app/com.Example.example), and having granular permissions management per application.

  • Mwa@lemm.eeEnglish
    0·
    10 days ago

    Personally it depends on distro and package manager.
    If your on arch yes you can in a easyish way some aur packages may require you to compile it.
    Other distros you can either compile the software from source or convert .deb to .rpm (for example) this is mediumish and takes time to do.

    • Baldur Nil@programming.dev
      0·
      9 days ago

      If the distro is rolling release, it can always support the latest software in theory, you’d just need to have the correct package formula, which is exactly what AUR offers.

      The problem with AUR is just that the author of the package is likely not the author of the software and not affiliated with the distro, so you should normally check what the script is doing.

  • Papamousse@beehaw.org
    0·
    10 days ago

    I’m using MX Linux AHS, it is Debian based, it is always up to date, like latest firefox a few hours after it’s out, kernel 6.12.17 as of today, etc.

    It has no systemd, no snap, no flatpak. It just uses the good old .deb and everything is working fine.

  • Sickday@kbin.earth
    0·
    11 days ago

    I don’t develop distributed applications, but Im not understanding how it simplifies dependency management. Isn’t it just shifting the work into the app bundle? Stuff still has to be updated or replaced all the time, right?

    That’s correct. This simplifies the dependency management system because not every distribution ships with every version of every package, so when software requires a version of a package that the distro dosesn’t ship with or have in its repositories, the end user has to either build the package from source, or find some other way to run their software. Flatpaks developers will define the versions of dependencies that are required for an application to run and that exact version is pulled in when the flatpak is installed. This makes the issue of every distro not having every version of every package moot.

    Don’t maintainers have to release new bundles if they contain dependencies with vulnerabilities?

    They don’t have to, no. But they absolutely should.

    Is it because developers are often using dependencies that are ahead of release versions?

    Sometimes, yes. Or the software is using a dependency that is so old that it’s no longer included in a distro’s package repositories.

    Also, how is it so much better than images for your applications on Docker Hub?

    I would say they’re suited to different purposes.

    Docker shines when availability is a concern and replication is desired. It’s fantastic for running a swarm of applications spread across multiple machines automatically managing their lifecycles based on load. In general though, I wouldn’t use Docker containers to run graphical applications. Most images are not suited for this by default, and would require you install a bunch of additional packages before you could consider running any graphical apps. Solutions to run graphical applications in Docker do exist (see x11docker), but it doesn’t really seem like a common practice.

    Flatpaks are designed to integrate into an existing desktops that already have a graphical environment running. Some flatpaks include the packages required for hardware acceleration (Steam, OBS) which can eliminate the need for those packages to be available via your distro’s package manager.

    What this means is that a distro like Alpine Linux that doesn’t have an nvidia package in its repos can still run Steam because the Steam flatpak includes the nvidia driver if you have an nvidia GPU installed.

    Never say never, I guess, but nothing about flatpak really appeals to my instincts. I really just want to know if it’s something I should adopt, or if I can continue to blissfully ignore.

    ¯_(ツ)_/¯ It’s a tool. Use it when it’s useful, or don’t.

    • krakenfury@lemmy.sdf.orgOPEnglish
      0·
      11 days ago

      Thanks for the detailed answer. I think I have a clearer picture of the problems it’s trying to solve and the solutions it’s delivering.

      It also now seems connected to immutable distros I’ve also heard about recently. So I guess the idea there that the OS is just a tiny core set of libraries that never have to change, then the applications have their dependencies bundled, instead of requiring them as system dependencies.

      I’m not convinced it’s something I want as a user, but more importantly not something I need.

      From a development perspective, it seems downright seductive, allowing almost total freedom of opinion.

      • Tobias Hunger@programming.dev
        0·
        10 days ago

        As a user I definitely want flatpaks and use them over distribution packages whereever possible. First I can sandbox the flatpak, but not the native package. Why would my browser need to be able to read my ssh keys?

        Secondly I just have seen too many distro packagers sabotaging packages in the most braindead ways possible. Debian removing almost all the random data during key generation because some static analysis tool did not like the code. To this day there are servers using one of the 32k keys debian could produce during that time (they are of course all brute forced by now). Fedora removing Codecs from a video encoder, dependencies that upstream knows are broken and listsmas such in its documentation being used anyway. Random patches being applied, or versions years out of date getting shipped…

    • warmaster@lemmy.world
      0·
      10 days ago

      The build instructions for all flatpaks are in one repo, you could build it yourself and maintain your own registry if you wanted.

  • Decker108@lemmy.ml
    0·
    11 days ago

    Sure you can! Just run alias flatpak=snap and you’ll be golden.

    (I’ll show myself out…)