I am very diligent about applying updates as soon as I'm able and generally read the changelogs of the updates I'm applying in Ubuntu's Software Updater.
One thing I will not do is willingly allow somebody else a way to deploy and execute code on my computer without my say so (which snap is).
After reading the whole thread at https://forum.snapcraft.io/t/disabling-automatic-refresh-for... and seeing Gustavo Niemeyer's arrogance (we know better than you when you should be applying updates) I will be voting with my feet and will be installing Pop!_OS instead of Ubuntu, and if snapd is present I will remove it.
The stated goal of Niemeyer, to have users use updated software, would have been fulfilled in my case if I had a way to see what updates would be applied beforehand, instead of the updates being force-installed.
Lengthy dialog with Niemeyer in the forum thread seems to have been a waste of time for all the people who participated trying to convince him to allow disabling of force-installed updates so I suggest you do the same as me and vote with your feet!
> Snap applications auto-update and that’s fine if Ubuntu wants to keep systems secure. But it can’t even be turned off manually.
OMG. Is this real? This is the exact reason I use Linux instead of Windows 10 or macOS. I am not a grandma who can't stay up to date on tech news. At the least there should be a toggle for power users. But no, you can only defer it. Am I the only one who doesn't like it when your already slow internet slows down even further? It feels like hell when you are working.
I am not upgrading to this. I have been using Arch Linux as my personal OS. Maybe I should look into Debian for my VMs.
And just read this thread[1]. Is this how they treat their users? Even Reddit is better then this.
We work at remote sites on cell connections. Part of the reason we moved to Ubuntu from Windows was the ability to control data usage, which is expensive. Automatic updates quickly become a significant slice of the bill when random decisions like these get pushed on users. Ubuntu was supposed to help prevent us from needing to chase this.
I agree entirely. Unavoidable updates were one of the key factors in my choice to avoid Windows 10 for business-critical computing. I standardized on Ubuntu instead, but this could be a deal-breaker for me.
I hope Canonical fixes this immediately. I'm not eager to spend time re-researching to market for a suitable OS.
> GNOME Calculator was put on the ISO as a snap to help us test the whole “seeding snaps” process, not because it was a fast-moving, CVE-prone applications. Chromium, Firefox and LibreOffice fall more into that category.
Ok so the whole snap thing comes down to updating browsers. Is this for real? I want the web, not the browser to change daily, or to consume more bandwidth than my www usage :)
Point taken on the shoddy behaviour, but if you'd like to try it out there's this helpful post on disabling snap[1] shared here[2] when I installed 20.04. Quick and painless!
I just upgraded to 20.04, and minutes later my machine is on its knees OOMing and unable to process remote connections. Apparently there is now yet another new file system indexer to play whack-a-mole with like updatedb in the old days except this one is hooked into systemd and harder to stop. Search for "tracker-extract disable" if you want the full details.
>This is the exact reason I use Linux instead of Windows 10 or macOS
Not sure about win10, but macOS won't autoupdate apps if you turned it off.
If the app is not from an app store - it's up to the devs to have option to (auto) update. Most apps allow you to turn autoupdate off (in fact I can't think of single one without this option)
We have already installed two new Debian 10.3 VMs instead if Ubuntu. It's quite a breath of fresh air compared to Ubuntu >16.04 which I had to fight all the time to do things my way. Still runnng 18.04 on the dev boxes though.
Yeah, lol, looks like I'm no longer an Ubuntu user. Now I have to figure out how to force-disable this for server software and corporate Linux desktop users. Jesus.
I wonder how this affects offshoot distros like kubuntu?
I'm currently on Debian with KDE, but I think I might need to move to a rolling release distro due to some issues with SMB/CIFS (that have already been fixed in newest builds of KDE) that probably won't be fixed in Debian until the next release.
Maybe I should start looking at distros in general-- but Ubuntu is definitely out of the picture.
snaps are intended for non-power-users that don't want to deal with dependencies. Those users want things to mostly work without worrying about murky downsides. Auto-updating is exactly the right behavior.
If this is of concern to you, why are you using snaps? And why Ubuntu? What's the value-add over Debian?
So I run Kubuntu on my work laptop (X1 Carbon) and just upgraded to 20.04 last weekend. I had a vague idea there were different competing standards for "linux apps that work across distribution" but didn't know people had such a problem with snap. It just seemed like a useful tool for installing proprietary stuff that wouldn't normally be packaged by the distribution. I just checked and the snaps I have that aren't from canonical are: datagrip, slack, discord, and spotify. I haven't noticed any slow app boot times and I think it's great that it's so easy to install third party software. Is snap somehow user-hostile?
There are some downsides (footprint, forced updates, speed, etc.), though depending on what you're installing those may not be deal-breakers. I'm using plain Ubuntu 20.04 and I tend to install stuff via apt and not snap in general (but I am fine with installing non-essential things via snap). The software store has a subtle toggle in the upper right for choosing to install a package as a snap or via apt when both are available.
Maybe I'm in the minority but I like Snaps. I wish all software would auto-update silently in the background -- when's the last time you even thought about upgrading Chrome?
The author of this article claims it's too difficult to find Flatpak apps and that the Ubuntu software center prioritizes Snaps over .deb. Are platforms never allowed to migrate to a new standard? Why is it Canonical's fault that authors of individual applications have yet to migrate Snaps?
If we all agree that on the whole auto-updating software is generally better and more secure than manually updated software, why not single out the applications that haven't migrated instead of blaming the whole standard?
Maybe I'm just naive and not doing advanced super user stuff these Snap haters are doing but from a distance to me this resembles the systemd vs init controversy. One which, IMHO, Linux super users seemed unusually attached to an older standard for not always clear reasons. Snaps offer real benefits: maybe instead of complaining that 'this sucks' users could offer constructive criticism about how to improve the new standard.
We tried to make an internal IoT device using Ubuntu Core and snaps because the capabilities of it were very promising. We started a PoC and about halfway through we hit a major roadblock. Our enterprise network does certificate substitution, and Ubuntu Core absolutely does not allow you to install your own certificates globally, so our devices would never receive updates. We tried EVERY hack we could think up, short of making our own core snap. We talked to Canonical about it, and they didn't seem interested in our fixing our complaints without a massive amount of money, so our PoC died, and we dropped Ubuntu entirely because of it.
A colleague of mine was also looking at Ubuntu Core for an IoT project recently, but Ubuntu wanted $15k/y to run a private, branded Snap store - erm.. no.
If they really want snaps to succeed, there should be an open source snap store protocol, and 3rd parties should be allowed to run their own stores, just like you can add 3rd part apt repos, for example.
We decided on Photon OS, BTW. It's tiny, and perfect for use as a Docker host.
Just to be sure, installing the CA from that MITM box didn't work? Because that should be the generally recommended solution and I can't see why snap would have a hardcoded CA list separate from the system. If that didn't work, it's indeed a bug, but a rather weird one; definitely worth posting to the bug tracker.
I really dislike the way snaps create disk partitions. When I run $ df I want to see what I defined during OS installation, not a dozen nasty snap mounts. An application misusing fundamental system features like this feels like a violation of some UNIX principle.
Very much agreed, the fact that nobody at Ubuntu noticed that the extra mount points is a best annoying is kinda impressive.
I’m not blaming Ubuntu, nor Snaps for this issue, but we had a new server come online and our monitoring noticed that two or three partition was already at 100% usage. Those where snap mount point.
Snap has an issue on certain Linux distributions (including Fedora and Arch) in which many applications render tofu characters (□□□□□) instead of text.
Canonical needs to invest in compatibility if it wants Snap to be adopted in distributions other than Ubuntu. Flatpak doesn't have this issue, and unlike Snap, its server implementation is decentralized, free, and open source.
If you're looking for an alternative to Ubuntu but want to stick with a Debian-based distribution, I'll continue to recommend Debian testing.
It's a rolling release, so you don't have to stop what you're doing every 6 months - 3 years to install a huge update that changes the way everything works. It's more stable than the name would suggest, as long as you follow a few reasonable best-practices [1].
Software available on Debian testing is pretty up-to-date... If you're previously tried Debian stable but were put off by ancient packages, you won't see this in testing. Keep in mind that Debian testing (not stable) is upstream for Ubuntu's releases, so Debian testing's packages will be about as new as Ubuntu's packages on release day (but they're updated continuously, so they stay fresh).
I have personal systems running Debian testing or unstable that have been running continuously for 5-10 years without issues. They don't look or feel any different than systems I set up a few months ago.
> Auto-updating of snaps can only be deferred at best, until at some point, like Windows, it auto-updates anyway. Even on metered connections, snaps auto-update anyway after some time.
This attitude is obnoxious. Yes, not everybody is on a metered connection or running a mission-critical system, but some are, and it is hardly unreasonable to accommodate them.
And Microsoft didn't have a choice. Given an option regular users will never update their computers, perhaps partly due to fear of what they don't understand, fear of change, or maybe due to past bad update experiences. I witness this in my mom with technology all the time. Every time there's a popup she mini-panics, and she has trained herself to click close every time she sees something she doesn't understand.
Google started the trend of silently updating Chrome and everyone including Microsoft followed after, except upgrading an OS is nothing like updating a browser.
For most parts, I think auto update is necessary for tech illiterates, especially now that everybody's jumping on the Agile bandwagon, including Windows. There needs to be a way to ensure new versions reach their users given everyone's just churning out barely working software these days.
Honestly I don't have a problem with that. But if they don't give power user the option to opt out, this is just disrespectful
Good to see that I am not alone at being upset about the current snap vs. deb vs. flatpak Ubuntu situation. I always considered a unified package management system as a huge plus.
Ubuntu is doing more harm than good to desktop linux at this point in time.
Continuing to push Xorg over Wayland.
Removing support for flatpak (cross-distro way of using sandboxed apps)
Horrible PPA system that works much worse in practice than the AUR or other ports systems.
No daemonless docker (podman)
Lots of people try Ubuntu since it is the "most popular" version of Linux, realize it isn't great and think desktop Linux is in bad shape. The reality is Canonical doesn't seem to have good ideas and refuses to incorporate the good ideas from other distros.
So theres one huge issue with Snap no one in my circles is talking about - i dont want my server changing without me controlling it! This seems like a) Someone could get an update in without my knowledge and it'll get pushed to me without my consent b) if the code changes, i want to control that, if a package changes, i also want to control that....its my server, i want to control it all! On a desktop, maybe I could handle this, but for a server, its absolutely a no go. wtf are they thinking?
A good time to ask I suppose: Is Devuan stable and does it carry security updates and package repositories equivalent to normal Debian? If so I'll probably switch myself.
I filed a bug a few years back asking why Snap refused to allow any repositories outside of Canonical's and had no open-source server implementation. That blew up.
To disallow control of the updates by the users is probably well-intended as some kind of a trade-off, but what if I don't want a new feature that is coming in the next version? What if I already know it's broken in my system configuration -- I hope for a fix for 60 days, and then what? What if the fix never comes? Does my system stop working?
What if I'm a business relying on that specific version? Do I just say "oh well" and close shop?
And what about airgapped systems?
I understand there's the "security", but then, on the other hand:
1. If snapd gets forked because of this, the snap ecosystem becomes fragmented and Canonical loses control of part of their baby.
2. If snapd stays as-is, and Canonical keeps preventing user control of the update cadence, then people will just run away from using snaps once the magical auto-updates create any high-profile problem. Lxd is a snap as well, so containers will be in the crosshairs.
All in all it feels like a silly decision if you ask me.
Ubuntu 20.04 forced me to switch to Fedora Server on my home server. Pretty happy so far. I have significantly fresher package versions and most of the software tools I use offer a RPM package. I think I will wait for snap to mature, before giving it another go.
For largely this reason, I've just switched to Manjaro after over two decades (ouch!) of using Debian and Ubuntu. I'm very happy with it!
Package installs are unbelievably fast. But mostly, the AUR repository of user contributed packaging scripts is awesome! Although I'm a bit worried about installing packages from random internet people, they are generally short and very easy to check for unwanted *ware. Haven't been disappointed yet!
Yeah a lot of the software you see in the store is legacy software that seems to be stuck on an older version. Also many of the items are lacking a screenshot and a comprehensive description of what the software does. I find myself using the store to discover software and then go to the software's official website (usually on Github) and install it the oldskool way by doing:
I was asked by a friend to get Netflix working on his Lubuntu 20.04 Linux laptop. He was running Chromium which comes without Widevine, and the extension wasn't available in the Chrome Web Store, but it can be enabled by simply making libwidevine.so available in Chromium's library path. But how to add a file to the sandboxed lib/ directory of a Snap? You can't without rebuilding the entire Snap as your own custom product, and then it's no longer a standard package from the repo so you lose the blessings of package updates! Maybe there's a better way, but I sure could not find one.
I had to ditch Chromium and unfortunately resort to Chrome directly provided by Google, with all of its privacy problems.
[+] [-] shock|5 years ago|reply
One thing I will not do is willingly allow somebody else a way to deploy and execute code on my computer without my say so (which snap is).
After reading the whole thread at https://forum.snapcraft.io/t/disabling-automatic-refresh-for... and seeing Gustavo Niemeyer's arrogance (we know better than you when you should be applying updates) I will be voting with my feet and will be installing Pop!_OS instead of Ubuntu, and if snapd is present I will remove it.
The stated goal of Niemeyer, to have users use updated software, would have been fulfilled in my case if I had a way to see what updates would be applied beforehand, instead of the updates being force-installed.
Lengthy dialog with Niemeyer in the forum thread seems to have been a waste of time for all the people who participated trying to convince him to allow disabling of force-installed updates so I suggest you do the same as me and vote with your feet!
[+] [-] nromiun|5 years ago|reply
OMG. Is this real? This is the exact reason I use Linux instead of Windows 10 or macOS. I am not a grandma who can't stay up to date on tech news. At the least there should be a toggle for power users. But no, you can only defer it. Am I the only one who doesn't like it when your already slow internet slows down even further? It feels like hell when you are working.
I am not upgrading to this. I have been using Arch Linux as my personal OS. Maybe I should look into Debian for my VMs.
And just read this thread[1]. Is this how they treat their users? Even Reddit is better then this.
1. https://discourse.ubuntu.com/t/is-ubuntu-software-going-to-b...
[+] [-] ultrarunner|5 years ago|reply
[+] [-] DoofusOfDeath|5 years ago|reply
I hope Canonical fixes this immediately. I'm not eager to spend time re-researching to market for a suitable OS.
[+] [-] tannhaeuser|5 years ago|reply
> GNOME Calculator was put on the ISO as a snap to help us test the whole “seeding snaps” process, not because it was a fast-moving, CVE-prone applications. Chromium, Firefox and LibreOffice fall more into that category.
Ok so the whole snap thing comes down to updating browsers. Is this for real? I want the web, not the browser to change daily, or to consume more bandwidth than my www usage :)
[+] [-] ironmagma|5 years ago|reply
[+] [-] neetfreek|5 years ago|reply
1. https://www.kevin-custer.com/blog/disabling-snaps-in-ubuntu-...
2. https://news.ycombinator.com/item?id=22972661
*Edited
[+] [-] foobarian|5 years ago|reply
[+] [-] koheripbal|5 years ago|reply
Because if so, I'm sticking with 18.04.
[+] [-] konart|5 years ago|reply
Not sure about win10, but macOS won't autoupdate apps if you turned it off.
If the app is not from an app store - it's up to the devs to have option to (auto) update. Most apps allow you to turn autoupdate off (in fact I can't think of single one without this option)
[+] [-] petre|5 years ago|reply
[+] [-] 0xbadcafebee|5 years ago|reply
[+] [-] Firehawke|5 years ago|reply
I'm currently on Debian with KDE, but I think I might need to move to a rolling release distro due to some issues with SMB/CIFS (that have already been fixed in newest builds of KDE) that probably won't be fixed in Debian until the next release.
Maybe I should start looking at distros in general-- but Ubuntu is definitely out of the picture.
[+] [-] limeblack|5 years ago|reply
Backwards compatibility is a positive as long as it's secure. This makes me hesitatant to what is going on. Auto updates good, no blocking not sure.
[+] [-] dima55|5 years ago|reply
If this is of concern to you, why are you using snaps? And why Ubuntu? What's the value-add over Debian?
[+] [-] stevepike|5 years ago|reply
[+] [-] blacksmith_tb|5 years ago|reply
[+] [-] excalibur|5 years ago|reply
Yes, but more importantly it's insecure. The ease of typo-squatting is a real problem.
[+] [-] koheripbal|5 years ago|reply
[+] [-] ordinaryperson|5 years ago|reply
The author of this article claims it's too difficult to find Flatpak apps and that the Ubuntu software center prioritizes Snaps over .deb. Are platforms never allowed to migrate to a new standard? Why is it Canonical's fault that authors of individual applications have yet to migrate Snaps?
If we all agree that on the whole auto-updating software is generally better and more secure than manually updated software, why not single out the applications that haven't migrated instead of blaming the whole standard?
Maybe I'm just naive and not doing advanced super user stuff these Snap haters are doing but from a distance to me this resembles the systemd vs init controversy. One which, IMHO, Linux super users seemed unusually attached to an older standard for not always clear reasons. Snaps offer real benefits: maybe instead of complaining that 'this sucks' users could offer constructive criticism about how to improve the new standard.
Just my opinion tho.
[+] [-] beckler|5 years ago|reply
[+] [-] adrianN|5 years ago|reply
[+] [-] GordonS|5 years ago|reply
If they really want snaps to succeed, there should be an open source snap store protocol, and 3rd parties should be allowed to run their own stores, just like you can add 3rd part apt repos, for example.
We decided on Photon OS, BTW. It's tiny, and perfect for use as a Docker host.
[+] [-] eikenberry|5 years ago|reply
Why is asking for money wrong? You want the feature, why shouldn't you pay for it.
[+] [-] lucb1e|5 years ago|reply
Just to be sure, installing the CA from that MITM box didn't work? Because that should be the generally recommended solution and I can't see why snap would have a hardcoded CA list separate from the system. If that didn't work, it's indeed a bug, but a rather weird one; definitely worth posting to the bug tracker.
[+] [-] comboy|5 years ago|reply
[+] [-] tom_devref|5 years ago|reply
[+] [-] mrweasel|5 years ago|reply
I’m not blaming Ubuntu, nor Snaps for this issue, but we had a new server come online and our monitoring noticed that two or three partition was already at 100% usage. Those where snap mount point.
[+] [-] jlgaddis|5 years ago|reply
[+] [-] pelario|5 years ago|reply
[+] [-] noisy_boy|5 years ago|reply
alias df='df -x"squashfs" -x"tmpfs"'
[+] [-] zbuf|5 years ago|reply
[+] [-] commoner|5 years ago|reply
https://forum.snapcraft.io/t/snapped-app-not-loading-fonts-o...
Canonical needs to invest in compatibility if it wants Snap to be adopted in distributions other than Ubuntu. Flatpak doesn't have this issue, and unlike Snap, its server implementation is decentralized, free, and open source.
[+] [-] ohazi|5 years ago|reply
It's a rolling release, so you don't have to stop what you're doing every 6 months - 3 years to install a huge update that changes the way everything works. It's more stable than the name would suggest, as long as you follow a few reasonable best-practices [1].
Software available on Debian testing is pretty up-to-date... If you're previously tried Debian stable but were put off by ancient packages, you won't see this in testing. Keep in mind that Debian testing (not stable) is upstream for Ubuntu's releases, so Debian testing's packages will be about as new as Ubuntu's packages on release day (but they're updated continuously, so they stay fresh).
I have personal systems running Debian testing or unstable that have been running continuously for 5-10 years without issues. They don't look or feel any different than systems I set up a few months ago.
[1] https://news.ycombinator.com/item?id=23044878
[+] [-] dopeboy|5 years ago|reply
Can someone verify this? As someone who will eventually upgrade to 20.04, this is concerning.
[+] [-] greendave|5 years ago|reply
This attitude is obnoxious. Yes, not everybody is on a metered connection or running a mission-critical system, but some are, and it is hardly unreasonable to accommodate them.
[+] [-] harrygeez|5 years ago|reply
And Microsoft didn't have a choice. Given an option regular users will never update their computers, perhaps partly due to fear of what they don't understand, fear of change, or maybe due to past bad update experiences. I witness this in my mom with technology all the time. Every time there's a popup she mini-panics, and she has trained herself to click close every time she sees something she doesn't understand.
Google started the trend of silently updating Chrome and everyone including Microsoft followed after, except upgrading an OS is nothing like updating a browser.
For most parts, I think auto update is necessary for tech illiterates, especially now that everybody's jumping on the Agile bandwagon, including Windows. There needs to be a way to ensure new versions reach their users given everyone's just churning out barely working software these days.
Honestly I don't have a problem with that. But if they don't give power user the option to opt out, this is just disrespectful
[+] [-] chrisma0|5 years ago|reply
[+] [-] bgorman|5 years ago|reply
Continuing to push Xorg over Wayland. Removing support for flatpak (cross-distro way of using sandboxed apps) Horrible PPA system that works much worse in practice than the AUR or other ports systems. No daemonless docker (podman)
Lots of people try Ubuntu since it is the "most popular" version of Linux, realize it isn't great and think desktop Linux is in bad shape. The reality is Canonical doesn't seem to have good ideas and refuses to incorporate the good ideas from other distros.
[+] [-] verelo|5 years ago|reply
[+] [-] hedora|5 years ago|reply
I switched to a .deb, and it was instantaneous. Then I switched back to devuan and have been happy since.
[+] [-] jandrese|5 years ago|reply
[+] [-] aritmo|5 years ago|reply
[+] [-] m0xte|5 years ago|reply
[+] [-] gjsman-1000|5 years ago|reply
https://www.omgubuntu.co.uk/2017/08/bug-report-asks-why-snap...
[+] [-] jnurmine|5 years ago|reply
What if I'm a business relying on that specific version? Do I just say "oh well" and close shop?
And what about airgapped systems?
I understand there's the "security", but then, on the other hand:
1. If snapd gets forked because of this, the snap ecosystem becomes fragmented and Canonical loses control of part of their baby.
2. If snapd stays as-is, and Canonical keeps preventing user control of the update cadence, then people will just run away from using snaps once the magical auto-updates create any high-profile problem. Lxd is a snap as well, so containers will be in the crosshairs.
All in all it feels like a silly decision if you ask me.
[+] [-] securityfreak|5 years ago|reply
[+] [-] vanviegen|5 years ago|reply
Package installs are unbelievably fast. But mostly, the AUR repository of user contributed packaging scripts is awesome! Although I'm a bit worried about installing packages from random internet people, they are generally short and very easy to check for unwanted *ware. Haven't been disappointed yet!
[+] [-] diablo1|5 years ago|reply
Yeah a lot of the software you see in the store is legacy software that seems to be stuck on an older version. Also many of the items are lacking a screenshot and a comprehensive description of what the software does. I find myself using the store to discover software and then go to the software's official website (usually on Github) and install it the oldskool way by doing:
[+] [-] daneel_w|5 years ago|reply
I had to ditch Chromium and unfortunately resort to Chrome directly provided by Google, with all of its privacy problems.