Post AyHExnFCzSuN6THTLk by jackwilliambell@rustedneuron.com
(DIR) More posts by jackwilliambell@rustedneuron.com
(DIR) Post #AyHDvU4jBoWF7OiIym by divVerent@social.vivaldi.net
2025-09-16T21:54:51Z
0 likes, 0 repeats
@jackwilliambell You can have my apt-get and apk if you pry them from my cold dead hands!
(DIR) Post #AyHE082uWOBqFA4v8C by jackwilliambell@rustedneuron.com
2025-09-16T21:55:44Z
0 likes, 0 repeats
@divVerent There's a *big* reason I prefer flatpaks – especially in conjunction with flatseal. Can you guess why?
(DIR) Post #AyHEbaVZf6oHETLbBQ by divVerent@social.vivaldi.net
2025-09-16T22:02:34Z
0 likes, 0 repeats
@jackwilliambell Because you then can have all the libraries nicely duplicated 42 times on the system?
(DIR) Post #AyHExnFCzSuN6THTLk by jackwilliambell@rustedneuron.com
2025-09-16T22:03:42Z
0 likes, 0 repeats
@divVerent Ah, but not necessarily the SAME versions of those libraries! Close, but still not the right answer.
(DIR) Post #AyHF6zndgB8KeJm19U by divVerent@social.vivaldi.net
2025-09-16T22:08:14Z
0 likes, 0 repeats
@jackwilliambell No seriously, I find things like flatpak to be massive security holes as often dependencies are not kept up to date by the maintainer (myself included, I can only update my stuff about once every 3 weeks).Having said that, my stuff doesn't talk to the internet or have any elevated privileges, so any of those are purely theoretical.But I strongly prefer single copies of libraries and kept up to date by competent maintainers. Debian and Alpine can (mostly) provide that service, and Flatpak definitely can't.And the sandbox can't protect against everything.
(DIR) Post #AyHFT3jhiwpNEGSBwe by divVerent@social.vivaldi.net
2025-09-16T22:12:13Z
0 likes, 0 repeats
@jackwilliambell (I should add: I like _system package managers_, but only one per system. _Extra package managers_ that maintain user-wide or system-wide copies of stuff that go _against_ the system package manager, like mpm, are pure evil.If it has to be one like that, the package store should be local to the respective project (like Go's package manager does). It definitely shouldn't require manually mucking around with a "virtualenv" to get literally anything useful done because of conflicts against system packages or other packages in the same user. Right, Python?
(DIR) Post #AyHFtgRMRg9MnTZM4O by jackwilliambell@rustedneuron.com
2025-09-16T22:17:00Z
0 likes, 0 repeats
@divVerent I find them ALL to be security holes. Often unfixable ones.And I'll take a leaky sandbox people pay attention to over no sandbox at all.
(DIR) Post #AyHFwmJX3zyFsnNoWW by divVerent@social.vivaldi.net
2025-09-16T22:17:36Z
0 likes, 0 repeats
@jackwilliambell And yet apt is better than no package manager. Just try _keeping up_ with manually ./configure && make && make install everything.
(DIR) Post #AyHG6YtHpGe59AlvO4 by jackwilliambell@rustedneuron.com
2025-09-16T22:19:21Z
0 likes, 0 repeats
@divVerent Oh, I use apt. Not saying I don't. But I try not to install anything that isn't a system utility with it. Meanwhile there's no way in hell I'm installing an Electron app without some kind of protection.
(DIR) Post #AyHGCw2UfniEg77M4u by divVerent@social.vivaldi.net
2025-09-16T22:20:31Z
0 likes, 0 repeats
@jackwilliambell I definitely can get behind "apt for the system, flatpak for applications".But "applications" here means desktop applications, not tools that need to be accessible for arbitrary purposes from shell scripts (as flatpak can support those _only_ if the FS is fully open, at which point there's no benefit anymore).
(DIR) Post #AyHGL6RTsYM9G8hSHA by jackwilliambell@rustedneuron.com
2025-09-16T22:21:59Z
0 likes, 0 repeats
@divVerent Not gonna argue for venv or it's variants. Hell, I don't even like pip.But I still use Python. I just avoid external dependencies if I can.
(DIR) Post #AyHGYpcZDTsD8xQpCi by divVerent@social.vivaldi.net
2025-09-16T22:24:29Z
0 likes, 0 repeats
@jackwilliambell Well, "implicit venv like behavior" (like Go modules, Rust cargo, Haskell cabal) is kinda OK with me.But don't put stuff in a global place. Yes, this even includes Perl's CPAN, although the CPAN kinda gets away with it because nobody does new libraries in Perl anymore so there's no real version hell on CPAN (also, the few people who do stiff submit Perl modules actually think about backwards compatibility).Unlike CPAN though, pip is pure hell - not because of how the package manager works, but because of how incompetent Python developers often appear to be. Not all of them, but there's definitely a significant difference in culture. Probably "move fast and break things" development style.