@teto @lucy flatpak is a cope because distros are sticking to old versions of everything for no reason other than stupidity (since upstream never even supports old versions anymore).
frequently updated does not mean frequently broken if your packagers know what they’re doing (which evidently arch people do not), and stable does not mean free of problems.
@teto @lucy i’m running tumbleweed not arch. i can skip updates for 5 years if i want to and it won’t break; i’ve actually done that before. if i install something that needs a partial update it won’t break either (unlike arch). there’s not really any babysitting beyond what you get on any other distro.
@teto @lucy understandable and basically that’s the reason i run that distro. i don’t want to worry about either shit being too outdated or shit being broken by some update. i want to be able to update at my own schedule and be able to easily rollback in the event that it does break some niche thing i don’t feel like fixing before the maintainers do
@allison @lucy @teto my disk layout is kinda specialized on all of my machines…
anyway i think snapper behavior can be configured or at least disabled (never used it myself). i’m not using btrfs anywhere. most of my systems have something with encryption and LVM with XFS file systems
i never really needed rollback in practice but if you believe you might then the default setup is probably fine. another thing you can do is using tumbleweed-cli, which instead allows you to switch between snapshots of the main tumbleweed repository, but that seems like a worse approach.
@teto @lucy tbh i wouldn’t recommend leap to anyone, it simply doesn’t get the attention it needs because we don’t have enough people to maintain all those package versions
i guess if you’re just using it as a vehicle for flatpaks it might be okay though
i maintain ~2 dozen packages in tumbleweed and i see how many of them just stop building in the maintenance project repos even on the newest leap release because the dependencies are just too old and we’d have to patch the shit out of everything to keep things going. it’s just not a sustainable distro dev model anymore.
@teto @lucy they’re an unfortunate workaround for a problem we wouldn’t have were it not for either the popularity of stable distro releases, the popularity of software with no ABI/API stability, or the popularity of closed-source software
i will defend the existence of distribution packages because they’re an additional layer of scrutiny on the software stack as a defense against supply chain attacks that have hit every single software ecosystem that relies on a single package source, and, with the right tooling, result in a more coherent system that can be tested as a whole unit (as is done on openQA) as opposed to just individual packages.
an often-repeated argument in favor of FLOSS is the “many eyes” approach to security and bug hunting, but the more we rely on systems like flatpak and npm/cargo/gopkg etc., the further this moves into the realm of wishful thinking rather than practice
@teto @lucy i get your point on the user perspective. i just wanted to highlight a technical problem that also affects users because the way user convenience has been achieved here comes at a price
flatpak is comparable to npm and so on because the way it works exposes users to the same classes of vulnerabilities (such as supply chain attacks) while also making it impossible to tell what code is actually part of each package
you don’t ever want to bother users with security crap. but this approach is making it a lot harder to keep systems secure without inconveniencing users or introducing walled gardens.