Having observed (well deserved) criticism of both Snap and Flatpak during the years, Flatpak seems to emerge as the most sensible solution, continuously addressing and improving on the pain points and security challenges.
I have been using Fedora 34/35 the last year or so, and Flatpaks are well integrated and mostly just works without any performance hit. Being able to adjust permissions per app (with Flatseal) has also been a great experience.
I have little experience with Snap, but the few times I have had to deal with it on Ubuntu-based distros, it has left a bad impression from a user perspective.
It’s not even remotely close. Snaps take longer to load, still sometimes have theme issues, you have to manually install Snap on almost all non-Snap distributions, you’ll be littered with garbage mountpoints, you’ll have a useless snap folder in your home directory, you can’t add external repositories of any kind, and you get no ability to stop updates easy without going into duct tape solutions.
Snap wants to be a desktop, and server, system. Not with a 10 foot pole - Docker is literally 100x better. Not on my Desktop - Flatpak is superior there.
Solution to what? Personally I think ALL of such package managers exists only for a reason: satisfy commercial software needs, in disguise to being developed for free by a community instead of being neglected and pushed to the place they deserve, witch is /dev/null.
The future of package management is NixOS/Guix System, the future of isolation are cgroups (see FireJail, BubbleWrap). The rest is absurd like full-stack virtualization on x86 to make VMWare profit, HW OEMs profit, consulting profits etc and people who should not, because of ignorance, running infra built by someone else a brick at a time, or the way to create disaster waiting to happen...
I see exactly ZERO good cases for snap, flatpak, appimage etc... ZERO, really.
It's the nature of creating a currated experience: saying "No" to a lot of things.
Chrome/Google did the same thing.
Snap clearly has a philosophy. And a lot of people clearly disagree with that philosophy.
Thankfully, instead of "advertised from google.com", Snap has less ability to push itself on users, and users have more ability to choose it... or not.
I warned them half a decade ago on a super-long thread (on that forum, it’s called “External repositories”) that having Canonical in charge of everything, having no support for external repositories, and no ability to disable updates was going to be the death of Snap. They would not listen at all to me or anyone on that discussion. It was nothing but double-down.
Well… what, five years later, here we are. They are still trucking on although the Linux community at large has turned against them, yet they remain in their echo chamber of a forum and don’t see it, convinced it will all work out or some crap.
I have been a huge fan of Ubuntu for a long time. But the way they push snap is really making me question this choice. The more I learn about snap the less I like it.
The snap thing makes me want to switch distro (for work) from ubuntu. Unfortunately we have some benefits from using ubuntu as the common platform for less divergence from each other
I personally use ubuntu and have used snap enough to get thoroughly burned and annoyed by it. Slow starts, no auto-update controls with bad defaults corrupting running programs, spammed mount points... (edit: see comment below for some limited controls to reduce the frequency of auto-updates)
But, unless I'm missing something about latest or future releases, isn't it still optional? Can't you use apt instead and uninstall snapd altogether?
I'd agree that needing to uninstall instead of opt-in is an annoyance, and that user-hostile actions tend to be a slippery slope..
If you're a programmer I'd say Arch or Debian then configure as per your needs. As long as you don't do things blindly it will be very stable and blazing fast.
Try one of the variants like Pop_OS! they use flatpaks as a replacement for snaps and it works well. I've moved all my ubuntu systems over to it without any issues. The KDE version is nearly as nice as the stock version (looks-wise) if you're a KDE person, which I am.
If you give people tools to enforce their own policies, you have an adaptable system.
If you create a set of policies that users can choose from, you have limited your usefulness to just those cases that fit in those policies that you have implemented.
If you choose a single policy for everyone, only people who are willing to use that policy will use your system.
These patterns repeat across operating systems, services and applications.
I love Ubuntu, it's been my daily driver for over a decade now but if they continue with going against the community on this nonsense this will be a strong indication for people like me that an era has come to an end and it's time to move on.
It used to be a community focused distro. This bs feels outright user-hostile.
Can someone explain why I'd use snap or flatpak over the distros repo or manual install for something not in the repo or unavailable via adding a repo? Apart from auto-managed updates.
Snap and flatpak are massive compared to "traditional" packages.
Snap is terrible in every sense, so you should never use it in my opinion.
As for Flatpak, I'd say use it if you need a more up-to-date version of a piece of desktop software than is in your distro's repository or desktop software that isn't in your distro's repository at all.
For example, I use the Firefox flatpak on Fedora to have the most up-to-date version (98.0.2) since the current version of Firefox on Fedora (98.0.0) was giving me some issues like crashing when downloading something and choppy gifs.
I also use it for some proprietary software like Spotify and a game called Vintage Story. Adjusting their sandbox permissions with Flatseal is useful in this case.
The big one being - when you install just an application, you don't want it to accidentally pull in the wrong dependency and destroy the rest of your system. This is a big problem when you use ppas or .debs directly from the app developer and accidentally update say libc or gtk. Another example: an application you use brings in a python-xyz package that conflicts with the same package you installed with pip install.
Also updating the system shouldn't accidentally break the application you use either. On rolling release distros this can be a pain. You'd typically want the application that the application developer tested properly (as opposed to relying on your package manager's "testing"). The packagers can introduce bugs while repackaging an application for X distro. My Cura was broken for so long on Arch linux that i gave up and started using their AppImages instead.
Depending on your distro, you also have to deal with headaches like XYZ software is only available on Ubuntu 20.04. Tough luck that you are running 18.04 on your laptops. (last week i had to deal with this problem with clang)
In addition to being self contained with all the dependencies, these solutions offer some level of sandboxing too.
On Arch, AUR usually does a nice job of packaging binary only applications, so i rarely need to use flatpack/snap/appimages but on other distros that can be a pain.
- Cross-distro packaging (no need to provide N package formats - this one runs on all distros)
- Faster update cycle for each app, if the package is maintained by the original developers
- Sandboxing
- Better compatibility all around, as the package runs the same on all distros (as opposed to some too-old or too-new module breaking something on X distro)
- Some other goodies, like checking new releases of the source on Github etc
Flatpak's drawbacks:
- Modules are not shared, which can result in somewhat larger packages and potential vulnerabilities
- Many packages are community-maintained by people who are not necessarily experts in the Linux ecosystem. Distro-provided packages usually have tighter requirements
Personally, I use Flatpaks for the sandbox. I restrict all apps very heavily.
Snaps are an attempt to move away from the distro managed software concept to the windows/android like vendor managed software paradigm. It removes the intermediate distro layer between third party vendors and users. It can also improve security in theory, but there are a lot of caveats to that currently.
In my experience "manual install for something not in the repo" applies to a whole lot of software, especially if "latest version isn't in the repo" counts, and also usually means "compile it from source yourself". Frankly I think that's a pretty ridiculous ask, and the fact that Linux Desktop hasn't had a good story for installing software outside of the repo has been one of the main factors keeping me from liking it over the past 2 decades.
There have been a lot of 'universal package' standards over the years, and honestly Flatpak isn't the best one, but it is the one that the community finally seems willing to adopt to a degree that actually makes it worthwhile. Snap, however, is the worst of these formats, and by a wide margin, that I can recall ever existing. It's amazingly bad and extremely user-hostile.
In theory one gets better security. Distribution or manual apps can access and modify everything the user can do. Flatpack and Snap tries to address that with a security model similar to mobile apps.
In practice for many apps the security protection is non-existent or very limited for compatibility reasons. So for now the benefits is indeed mostly a store model and auto updates.
If one really needs to run an untrusted app a VM is probably the only practical way. It is also possible to run apps in various containers, but truly secure setup is rather nontrivial with those.
Over manual install - snap/flatpak is typically way faster and easier to install and configure. Installing Nextcloud manually if you’re not familiar with the process is an hour or more of setting up all the essential and optional dependencies. It’s a few seconds of snap install nextcloud.
Over distro repos - no dependency version hell.
I don’t really love snap/flatpak (too much “magic”, hard to tweak installs) but I see why they get used.
Basically because a lot of open source software isn't packaged for each distro. Take Joplin for example: not in the repos and not packaged into a nice .deb file. Distributed as an AppImage.
- they are always up to date and therefore statistically more likely to have security holes fixed
- that are (to an extent) sandboxed by default and give you a lot of control over that.
- for developers it's much easier than maintaining hundreds of fixes for different distro peculiarities. Therefore (for the user) they are able to spend more time on the app itself rather than compatibility
I'd be curious to hear a good explanation as well from someone who knows more about this than me. My feeling (and feelings/suspicions are all I've really got) is that there are 2 factors driving it - maintaining repos is mundane work, and containers are fashionable again.
It is better on a "keep it updated by the developer" grounds and that's all I need. I liek to have the latest with things like spotify, libreoffice, qbittorrent, etc. I like the sandboxing. Sure it ain't everybody's cup of tea, but you can't discount other people's opinion as "wrong". They're just opinions. I know other people value the aspects of .deb/.rpm only based system, and I have weighed the pros and cons personally. Don't expect that we haven't looked into it for ourselves by default.
Wow. This thread isn't controversial at all. I haven't found a single comment making a case for Snap. It seems to be universally disliked - at least by this crowd.
It's disliked by the same Linux purists who complain constantly about systemd. Bit odd how the same community hates Canonical considering how it's now the only FOSS commercial entity considering Red Hat was bought by IBM. The community treats them worse than Microsoft for no good reasons. If you don't like snap, fine, use flatpak, apt, AppImages. Nobody is forcing you on ubuntu systems, but they spend their effort and time whining here.
I like snaps, I use them for everything I can.
- They are better confined than flatpaks, and come with a permission based model. Hence why there are some rougher edges. I appreciate the increased security.
- I appreciate the ability that when I remove a snap, the entire thing is removed with no littering.
- They are significantly easier to distribute on ubuntu than dealing with ppas or launchpad.
- They are a one-stop shop for finding the software I care about. I don't need to hit the command line, or add another repo.
- They save time and money because devs only need to support 1 base.
- I can install software on ubuntu without giving root privileges in a self-contained fashion.
Some common complains:
- The store isn't open sourced. Well yes, that is because they wasted time from the same whiny people over launchpad. Nobody else runs and supports launchpad. Hence nobody else would frankly bother running the snap store.
- People can't run their own store. Well yes, that is because Canonical learned from a decade ago with the security nightmare that is PPAs. Yea, it is a bad idea giving devs root access to 100k worth of machines to run arbitrary scripts.
Also really bad UX.
-It's slow to startup with theming issues. Well the situation has improved 100x since a few years ago, and also I run an ssd, 32gb of RAM and a 3600, I don't really care for a few seconds in launch time.
We use microk8s on our dev clusters and its really great when an automatic upgrade goes sideways. Also using channels didn't help since even a minor upgrade managed to break our setup once.
The last half year or so went ok, but not being able to stop automatic upgrades is ridiculous. In general I like opinionated software, but sometimes it goes to far.
Canonical currently has their head in the sand for how Linux users at large see it.
If you try to talk about how Linux distributions don’t like it, they’ll just say, “but Snap is available on all the distributions” or some crap cop-out.
I had a long forum thread about all the issues people are complaining about half a decade ago. They wouldn’t budge, and still won’t budge.
Snap developers have refused to rename $HOME/snap to be less visible for nearly as long, they have and are shipping very broken software, all while using update methods that corrupted people's data unannounced until very recently (the update mechanism made data directories non-writable unless you enable some experimental option).
They very much do not care about the end-user with Snap, only how to appear attractive to potential customers.
> The snap daemon (snapd) requires a user’s home directory ($HOME) to be located under /home on the local filesystem. This requirement cannot currently be changed.
It's a pretty wild switch of power from the usual distro packaging where the packager is a neutral middle ground between the application's and the user's interests, often swinging to the side of being the user advocate.
Of course, compared with other platforms and auto updates, it is clear why app developers prefer and expect to be in charge of updates.
This is its most egregious sin, IMHO. Imagine low level system software with such a high opinion of itself that it thinks it deserves a front and center place in your home directory for you to look at every single day.
We don't have ~/ssh or ~/dconf do we? We've had the XDG spec for decades now - this selfish decision makes me so irrationally angry that it's the one reason I'd switch to Fedora to avoid snaps.
That's what I thought, until the other day I realised something I had installed was via snap. I'm afraid the only solution requires stop using Ubuntu :(
The only thing still keeping me on Ubuntu is the font rendering that somehow looks so much better than any other distro, otherwise I would've already switched to another distro because of snap.
I feel like I've never seen anybody actually like snap.
One of a number of reasons Ubuntu does not even meet the minimum requirements to tender for a cut of the millions the University I work for invests in Linux systems (research workstations (often packed with NVIDIA GPUs), clients to control specialist equipment, HPC, regular desktops/laptops/servers, network/lustre/backup storage etc).
Please correct me if I am wrong, but you can simply snap install with a --channel, which could be a specific version. This way it is not auto updating, since it's on that specific channel/version.
AFAIK, selecting a channel doesn't prevent automatic updates, it just limits them to a subset of versions. It doesn't in any way prevent a new version from being published to that channel and automatically installed.
No. No they're not OK. Sometimes I am forced to live on eye-wateringly expensive bandwidth (because dodgy rural DSL and trees falling) and I'd go broke letting things autoupdate during those times.
> The issue that makes us resist the idea of simply disabling updates altogether is that very often that will mean never update rather than update at someone’s discretion, and then we’re getting back to some of the problems that got us here in the first place.
I see they're honestly trying to ease life for technically illiterate users (or, put it another way, to chase Apple's "just works" experience). But ignoring the needs of professional users (who are influencers) is a sure way to divert all users.
Counter point for general software: some people don't upgrade software for _years_, due to which vendors have two problems -
1. Open security vulnerabilities
2. Necessity to maintain backward compatible infra
To offset this, two channels of releases can be maintained - one for security fixes, another for general features etc.
But again here, we run into problems where maintenance of two channels isn't economical, and you end up testing security fixes on various versions.
How can these be addressed if upgrades are not forced, are there standard processes followed that provide the best compromise for both vendors and end users?
Where Microsoft leads with its bad ideas Linux distros will follow blindly. The sad thing is those who decried a Microsoft for their evilness of doing things like this are the same ones that have turned right around and started defending it in the name of "users are stupid so give them less freedom".
rsolva|3 years ago
I have been using Fedora 34/35 the last year or so, and Flatpaks are well integrated and mostly just works without any performance hit. Being able to adjust permissions per app (with Flatseal) has also been a great experience.
I have little experience with Snap, but the few times I have had to deal with it on Ubuntu-based distros, it has left a bad impression from a user perspective.
gjsman-1000|3 years ago
Snap wants to be a desktop, and server, system. Not with a 10 foot pole - Docker is literally 100x better. Not on my Desktop - Flatpak is superior there.
throwaway984393|3 years ago
kkfx|3 years ago
The future of package management is NixOS/Guix System, the future of isolation are cgroups (see FireJail, BubbleWrap). The rest is absurd like full-stack virtualization on x86 to make VMWare profit, HW OEMs profit, consulting profits etc and people who should not, because of ignorance, running infra built by someone else a brick at a time, or the way to create disaster waiting to happen...
I see exactly ZERO good cases for snap, flatpak, appimage etc... ZERO, really.
gaius_baltar|3 years ago
indymike|3 years ago
This is why people hate snaps. They don't fit user workflows, make extra work and even cause show stopping problems.
Snaps could be great but the team really needs to listen. For me I'm removing snaps from my configs before I get surprised.
(edit: mobile autocomplete typos)
ethbr0|3 years ago
Chrome/Google did the same thing.
Snap clearly has a philosophy. And a lot of people clearly disagree with that philosophy.
Thankfully, instead of "advertised from google.com", Snap has less ability to push itself on users, and users have more ability to choose it... or not.
unknown|3 years ago
[deleted]
gjsman-1000|3 years ago
Well… what, five years later, here we are. They are still trucking on although the Linux community at large has turned against them, yet they remain in their echo chamber of a forum and don’t see it, convinced it will all work out or some crap.
tjoff|3 years ago
Almost feels like malware on every level. Can't comprehend why they are pushing it so hard.
Ubuntu is on borrowed time.
oofbey|3 years ago
kzrdude|3 years ago
brianshaler|3 years ago
But, unless I'm missing something about latest or future releases, isn't it still optional? Can't you use apt instead and uninstall snapd altogether?
I'd agree that needing to uninstall instead of opt-in is an annoyance, and that user-hostile actions tend to be a slippery slope..
bamboozled|3 years ago
selfhifive|3 years ago
canadaduane|3 years ago
stjohnswarts|3 years ago
amelius|3 years ago
jjgreen|3 years ago
dsr_|3 years ago
If you create a set of policies that users can choose from, you have limited your usefulness to just those cases that fit in those policies that you have implemented.
If you choose a single policy for everyone, only people who are willing to use that policy will use your system.
These patterns repeat across operating systems, services and applications.
bitcharmer|3 years ago
It used to be a community focused distro. This bs feels outright user-hostile.
rubyist5eva|3 years ago
account-5|3 years ago
Snap and flatpak are massive compared to "traditional" packages.
nvrspyx|3 years ago
As for Flatpak, I'd say use it if you need a more up-to-date version of a piece of desktop software than is in your distro's repository or desktop software that isn't in your distro's repository at all.
For example, I use the Firefox flatpak on Fedora to have the most up-to-date version (98.0.2) since the current version of Firefox on Fedora (98.0.0) was giving me some issues like crashing when downloading something and choppy gifs.
I also use it for some proprietary software like Spotify and a game called Vintage Story. Adjusting their sandbox permissions with Flatseal is useful in this case.
saidinesh5|3 years ago
Also updating the system shouldn't accidentally break the application you use either. On rolling release distros this can be a pain. You'd typically want the application that the application developer tested properly (as opposed to relying on your package manager's "testing"). The packagers can introduce bugs while repackaging an application for X distro. My Cura was broken for so long on Arch linux that i gave up and started using their AppImages instead.
Depending on your distro, you also have to deal with headaches like XYZ software is only available on Ubuntu 20.04. Tough luck that you are running 18.04 on your laptops. (last week i had to deal with this problem with clang)
In addition to being self contained with all the dependencies, these solutions offer some level of sandboxing too.
On Arch, AUR usually does a nice job of packaging binary only applications, so i rarely need to use flatpack/snap/appimages but on other distros that can be a pain.
emerongi|3 years ago
- Cross-distro packaging (no need to provide N package formats - this one runs on all distros)
- Faster update cycle for each app, if the package is maintained by the original developers
- Sandboxing
- Better compatibility all around, as the package runs the same on all distros (as opposed to some too-old or too-new module breaking something on X distro)
- Some other goodies, like checking new releases of the source on Github etc
Flatpak's drawbacks:
- Modules are not shared, which can result in somewhat larger packages and potential vulnerabilities
- Many packages are community-maintained by people who are not necessarily experts in the Linux ecosystem. Distro-provided packages usually have tighter requirements
Personally, I use Flatpaks for the sandbox. I restrict all apps very heavily.
bubblethink|3 years ago
cbmuser|3 years ago
I use it for Spotify, Zoom, Slack among others.
Installing and updating Flatpak apps for proprietary software works very well.
AnIdiotOnTheNet|3 years ago
There have been a lot of 'universal package' standards over the years, and honestly Flatpak isn't the best one, but it is the one that the community finally seems willing to adopt to a degree that actually makes it worthwhile. Snap, however, is the worst of these formats, and by a wide margin, that I can recall ever existing. It's amazingly bad and extremely user-hostile.
_0w8t|3 years ago
In practice for many apps the security protection is non-existent or very limited for compatibility reasons. So for now the benefits is indeed mostly a store model and auto updates.
If one really needs to run an untrusted app a VM is probably the only practical way. It is also possible to run apps in various containers, but truly secure setup is rather nontrivial with those.
542458|3 years ago
Over distro repos - no dependency version hell.
I don’t really love snap/flatpak (too much “magic”, hard to tweak installs) but I see why they get used.
raffraffraff|3 years ago
stjohnswarts|3 years ago
- they are always up to date and therefore statistically more likely to have security holes fixed
- that are (to an extent) sandboxed by default and give you a lot of control over that.
- for developers it's much easier than maintaining hundreds of fixes for different distro peculiarities. Therefore (for the user) they are able to spend more time on the app itself rather than compatibility
hotpotamus|3 years ago
Brian_K_White|3 years ago
https://ludocode.com/blog/flatpak-is-not-the-future
Maybe it is better than snap, but it's not good and its not better than a traditional package, on either philosophical or technical grounds.
stjohnswarts|3 years ago
gpspake|3 years ago
kd913|3 years ago
I like snaps, I use them for everything I can.
- They are better confined than flatpaks, and come with a permission based model. Hence why there are some rougher edges. I appreciate the increased security.
- I appreciate the ability that when I remove a snap, the entire thing is removed with no littering.
- They are significantly easier to distribute on ubuntu than dealing with ppas or launchpad.
- They are a one-stop shop for finding the software I care about. I don't need to hit the command line, or add another repo.
- They save time and money because devs only need to support 1 base.
- I can install software on ubuntu without giving root privileges in a self-contained fashion.
Some common complains:
- The store isn't open sourced. Well yes, that is because they wasted time from the same whiny people over launchpad. Nobody else runs and supports launchpad. Hence nobody else would frankly bother running the snap store.
- People can't run their own store. Well yes, that is because Canonical learned from a decade ago with the security nightmare that is PPAs. Yea, it is a bad idea giving devs root access to 100k worth of machines to run arbitrary scripts. Also really bad UX.
-It's slow to startup with theming issues. Well the situation has improved 100x since a few years ago, and also I run an ssd, 32gb of RAM and a 3600, I don't really care for a few seconds in launch time.
apexalpha|3 years ago
[deleted]
jabiko|3 years ago
The last half year or so went ok, but not being able to stop automatic upgrades is ridiculous. In general I like opinionated software, but sometimes it goes to far.
gjsman-1000|3 years ago
If you try to talk about how Linux distributions don’t like it, they’ll just say, “but Snap is available on all the distributions” or some crap cop-out.
I had a long forum thread about all the issues people are complaining about half a decade ago. They wouldn’t budge, and still won’t budge.
Avamander|3 years ago
They very much do not care about the end-user with Snap, only how to appear attractive to potential customers.
nemetroid|3 years ago
https://snapcraft.io/docs/home-outside-home
> The snap daemon (snapd) requires a user’s home directory ($HOME) to be located under /home on the local filesystem. This requirement cannot currently be changed.
kzrdude|3 years ago
Of course, compared with other platforms and auto updates, it is clear why app developers prefer and expect to be in charge of updates.
acabal|3 years ago
We don't have ~/ssh or ~/dconf do we? We've had the XDG spec for decades now - this selfish decision makes me so irrationally angry that it's the one reason I'd switch to Fedora to avoid snaps.
unknown|3 years ago
[deleted]
anotherevan|3 years ago
I've tended to use every second LTS release, replacing with new (cloud) servers during the overlap in support periods. I use Ansible to configure.
Should I be considering Rocky or straight Debian instead? Something else?
matthews2|3 years ago
PaulHoule|3 years ago
reidrac|3 years ago
arunkant|3 years ago
ugjka|3 years ago
izoow|3 years ago
I feel like I've never seen anybody actually like snap.
xeromal|3 years ago
FpUser|3 years ago
henriquez|3 years ago
NGRhodes|3 years ago
stjohnswarts|3 years ago
https://github.com/flatpak/flatpak/issues/3078
nik736|3 years ago
loloquwowndueo|3 years ago
More about how snap channels work here. https://ubuntu.com/blog/controlling-snap-releases-with-chann...
vladvasiliu|3 years ago
teraflop|3 years ago
Thaxll|3 years ago
mikro2nd|3 years ago
user3939382|3 years ago
I’m sorry, who owns the machine here?
philliphaydon|3 years ago
danamit|3 years ago
ComodoHacker|3 years ago
ctxc|3 years ago
To offset this, two channels of releases can be maintained - one for security fixes, another for general features etc. But again here, we run into problems where maintenance of two channels isn't economical, and you end up testing security fixes on various versions.
How can these be addressed if upgrades are not forced, are there standard processes followed that provide the best compromise for both vendors and end users?
unknown|3 years ago
[deleted]
throwawaymanbot|3 years ago
[deleted]
lvs|3 years ago
[deleted]
elmerfud|3 years ago
stjohnswarts|3 years ago
unknown|3 years ago
[deleted]
unknown|3 years ago
[deleted]