• 1 Post
  • 61 Comments
Joined 11 months ago
cake
Cake day: June 4th, 2024

help-circle






  • “One male returned back into the house. The other male jumped two fences as he was fleeing. When officers located him on the other side of the fence, he appeared to have suffered an injury to his leg,” the police continued. “Officers rendered aid, and he was transported to Grady Hospital, where he was pronounced deceased.”

    Just seems really sketchy. He injures his leg fleeing, the police rendered aid, but he still died presumably on the way to the hospital? Sure hope they release some actual details about this.




  • I don’t develop distributed applications, but Im not understanding how it simplifies dependency management. Isn’t it just shifting the work into the app bundle? Stuff still has to be updated or replaced all the time, right?

    That’s correct. This simplifies the dependency management system because not every distribution ships with every version of every package, so when software requires a version of a package that the distro dosesn’t ship with or have in its repositories, the end user has to either build the package from source, or find some other way to run their software. Flatpaks developers will define the versions of dependencies that are required for an application to run and that exact version is pulled in when the flatpak is installed. This makes the issue of every distro not having every version of every package moot.

    Don’t maintainers have to release new bundles if they contain dependencies with vulnerabilities?

    They don’t have to, no. But they absolutely should.

    Is it because developers are often using dependencies that are ahead of release versions?

    Sometimes, yes. Or the software is using a dependency that is so old that it’s no longer included in a distro’s package repositories.

    Also, how is it so much better than images for your applications on Docker Hub?

    I would say they’re suited to different purposes.

    Docker shines when availability is a concern and replication is desired. It’s fantastic for running a swarm of applications spread across multiple machines automatically managing their lifecycles based on load. In general though, I wouldn’t use Docker containers to run graphical applications. Most images are not suited for this by default, and would require you install a bunch of additional packages before you could consider running any graphical apps. Solutions to run graphical applications in Docker do exist (see x11docker), but it doesn’t really seem like a common practice.

    Flatpaks are designed to integrate into an existing desktops that already have a graphical environment running. Some flatpaks include the packages required for hardware acceleration (Steam, OBS) which can eliminate the need for those packages to be available via your distro’s package manager.

    What this means is that a distro like Alpine Linux that doesn’t have an nvidia package in its repos can still run Steam because the Steam flatpak includes the nvidia driver if you have an nvidia GPU installed.

    Never say never, I guess, but nothing about flatpak really appeals to my instincts. I really just want to know if it’s something I should adopt, or if I can continue to blissfully ignore.

    ¯_(ツ)_/¯ It’s a tool. Use it when it’s useful, or don’t.


  • They have individual people maintaining over a thousand flatpacks.

    I don’t believe this to be the case with Flathub, only the Fedora repo. I’m asking about the wider flatpak ecosystem, not the fedora-specific repo or how it’s setup.

    Additionally, if you go to install the real flatpack, Fedora pushes you to use their poorly-maintained unofficial one instead.

    I’d agree that seems like a needless hoop at the very least, but my concern is more to do with the growing trend to shit on Flatpaks as an ecosystem, not just this particular instance of Fedora head-assery.

    I think it’s decent software and has really solid use-cases, far from unreliable shit at least in my own anecdotal experience. But my experience is limited, which was why I asked the OP to elaborate on actual flaws they see with the Flatpak ecosystem.









  • In my work organization, we don’t allow pushes from users that have not signed their commits. We also frequently make use of git blame along with git verify-commit. For this reason, we have most new developers at any level create a GPG key and add it to their GitHub profile shortly after they join or organization. We’re a medium-sized FinTech organization though, so it’s very important we keep track of who is touching what.

    That said, I can’t see it being all that important to an individual unless they’re very security-focused. For me personally, I have multiple yubikeys and one is meant specifically for SSH authentication and GPG operations including signing commits. Since I use NixOS and home-manager, I use the programs.git module to setup automatic signing and key selection. I really haven’t touched it at all in years now. It was very “set it and forget it” for me.