A post in Free Software magazine today makes the claim that software installation in GNU/Linux is broken. The author lists a number of problems with package management as a way to install software then posits that system and application software should be treated as entirely separate entities – thus we can use the success of package managers (and in the end even a ports tree like Kongoni has is still a type of package manager) for system software, while gaining greater ease with the application software users install all the time.
His proposal is to look at the MacOSX approach but the fundamental point is same-old, lets make GNU/Linux more windows-like.
What he claims to want from software installation for applications is in fact, already there – very few programs will have difficulty being installed by a user, in his home directory. The catch is that binaries are almost never built that way, because it’s inefficient – so that’s usually limited to manual source compiles – and indeed, it’s a (tiny bit) more difficult.
Frankly though – what he sees as the features of a good desktop application installation system… would be an absolute disaster.
It’s ironic, just yesterday I was reading a blogpost about GNU/Linux’s continues resilience against malware which mostly rehashed the known facts of a better design with better separation of user and admin privileges – but in the comments somebody made a point that immediately struck a massive chord with me. I had never thought about it before, but as I read it, the logic hit me: this made perfect sense. It fitted all the observed data perfectly.
GNU/Linux users almost never download and run programs from the internet. We almost never trade programs on disks with people. We install from the repo’s, it’s just easier and faster on our system – and this means, before we install the program it’s been checked – it’s coming from a source we actually can and do trust.
A major aspect of malware spreading – social engineering is entirely removed because we use repositories to install software. Do we really want to turn GNU/Linux applications into the unreliable, untrustworthy mess that is Windows software ?
Even if you remove their unclean deinstalls and registry muck-ups – the reality is that the basic premise of “download from some site and install some little app all the time” is fundamentally broken, it creates a massive and easily exploitable gap for getting users to install malware.
One of the worst I’ve seen is a site that does a very good job of emulating a respectable looking provider of anti-malware software, out to get credit cards when you buy, and install their own spyware on your box…
GNU/Linux is entirely immune to that because all our software comes from a repository, where it gets added to by developers who are technically proficient and know the system really well, who know the software they add well – they have to because they build those packages from source and that means studying the build systems at least to an extent.
Sure junk could creep into a repo – but the odds are very small. Systems like klick has tried to create ease of single-place package installs and failed because it has no real way of resolving dependencies and it’s highly desktop dependent. Even if you ignore those problems… well you’re still dealing with a single repository source of click recipes, so it’s still safe and secure – but I don’t see most third-party vendors using click to ship anytime soon, they aren’t even playing nice with repository maintainers for big distros !
Rox-desktop has an app-folder approach that only works with rox, but does offer pretty much what the author seems to want… but nobody uses it. The reality is there are many different package managers out there and despite many claims this is a good thing, they all have strengths and weaknesses. They allow distributions to be good at some things they would otherwise not be good at, and other distributions to fill in those gaps.
It wouldn’t be too hard to combine a rox-style appfolder with a .desktop file to make a desktop-neutral app-folder tech… but it’s usefulness would in fact be very limited. Users don’t want their data-space (home folders) cluttered with applications – even Windows users know that. It’s hard enough to find your files now, what would adding all your application files among them add as a hundred or more extra directories do ?
Well besides obviously turning GNU/Linux into a quagmire of virii and other malware as ugly as windows and twice as rotten (because we don’t use antivirus software) ? Nothing. Nothing that’s actually good for us as a community anyway.
The only reason people seem to think that being able to quickly download and install software from anywhere is a good thing (as opposed to a disaster we have been wonderfully lucky enough to avoid) – is because they are used to this idea from the Windows world. They think it’s good as an easy way to get third-party software, but what they don’t say is… well that thirdparty software would already be in the repo’s- unless they license doesn’t allow it.
Let me spell it out: the only people who have difficulty or problems with GNU/Linux’s package management idea, or the proliferation of package managers out there: are the developers of non-free software.
They want to join our party, but refuse to play by our rules. Well – whose fault is it then if they keep losing the games ? More often than not, this is not even a reality, they are making excuses not to support free platforms, and taking a convenient one, forgetting that if they made free software – it wouldn’t exist.
They wouldn’t need to care how to package for distro’s X, Y, Z – why not ? Because that’s windows-thinking, where vendors package the software. Just put the software out there, it’s my job to package it for kongoni, and the MOTU’s jobs to package it for Ubuntu etc. etc. hey guess what, this means the people packaging the software are actually experts on the OS platform they are packaging it for – as opposed to merely knowing their own program.
You can get software installs that integrate cleanly, don’t break things, don’t get infected with malware by accident…
Basically, I think the advantages of a package manager approach to software greatly outweighs the advantages of any other approach I know off, and more crucially than that: most of those so called advantages are in fact disasters.
Ease-of-use is a good thing, but I don’t think quickly-download-and-install software is easier to use.
Expecting every user to be able to spot a real software company from a fraud, a good program from a bad one… and judge it entirely by themselves… that’s not a good way to make it easy to keep your system fast, secure and stable. Package managers have their downsides, (but the only practical point he raises that could be improved is difficulty with running multiple versions of an app, which is a pure power-user feature anyway) – but they are relatively small in fact… the alternatives take the responsibility of ensuring the integrity of software away from people who are trained to do it, and puts that burden on ordinary users.
This was Microsoft’s biggest single mistake – the main reason for the continued plague of spam, botnets and spyware on the internet. Please, let us not make the same mistake.
Update: It occurred to me after publishing that I should add this. If repository based installation is so bad, why is it being copied and emulated as an idea ? The iphone’s app-store is a prime example, although proprietory and pay-for-play, it’s a repository of safe software, for users to install from. In every other aspect, it’s identical to how GNU/Linux installs software on your computer.
