this post was submitted on 20 Sep 2024
196 points (90.8% liked)
linuxmemes
20703 readers
2504 users here now
I use Arch btw
Sister communities:
- LemmyMemes: Memes
- LemmyShitpost: Anything and everything goes.
- RISA: Star Trek memes and shitposts
Community rules
- Follow the site-wide rules and code of conduct
- Be civil
- Post Linux-related content
- No recent reposts
Please report posts and comments that break these rules!
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
No, Debian doesn't take your
apt install ...command and install a snap behind your back...I don't understand how a transitional package that installs the snap (which is documented in the package description) is any different from a transitional package that replaces, say,
ffmpegwithlibav.Well, that's your problem for not understanding the massive difference, not mine.
If you don't want to explain, you're perfectly welcome to not explain. But saying what amounts to "if you don't know I'm not telling you", especially when you weren't specifically asked, is a pretty unkind addition to the conversation.
One selects a different package, same source repo.
The other completely changes the installation, invisibly to the user, potentially introducing vulnerabilities.
Such as what they did with Docker, which I found less than hilarious when I had to clean up after someone entirely because of this idiocy.
The differences seem quite clear.
In both cases, the packages are owned by the same people? (Fun fact: mozilla actually owns both the Firefox snap and the firefox package in the Ubuntu repos.) I'm non sure how that "potentially introduces vulnerabilities" any more than "having a package which has dependencies" does.
I'm not sure what you're referring to with Docker. Canonical provides both the
docker.iopackage in apt and thedockersnap. Personally I use the snap on my machine because I need to be able to easily switch versions for my development work.Because the separate installation means you can actually end up with both an apt installed and a snap installed.
My comment about docker was a specific example of such a case, where vulnerabilities were introduced. It was actually a commonly used attack a few years ago to burn up other CPU and GPU to generate crypto.
Yes, canonical provides both. Guess what? They screwed up, and introduced several vulnerabilities, and you ended up with both a snap and apt installed docker.
The fact that they are both packaged by Canonical is both irrelevant and a perfect example of the problem.
This is something that can happen any time you have multiple package managers or even multiple repositories in the same package manager. Google's official Chrome apt repo has debs for
google-chrome-stable,google-chrome-betaandgoogle-chrome-unstable, quite intentionally.Can you provide a link to a source about that? I can't find anything about it.
If you installed both the
docker.iopackage from apt and thedockersnap, yes you wound up with both. Just as if you install bothgoogle-chrome-stableandchromiumyou'll end up with two packages of (almost) the same browser.Then I'm gonna ask that you elaborate what specific problem you're trying to explain here, because these seem pretty contradictory.