New Debian project leader talks open source careers, PPAs and more

http://www.linux.com/news/software/applications/829303-new-debian-project-leader-talks-open-source-careers-ppas-and-more

by Enindu • 11 years ago

79 42 11 years ago

linux.com

tcdent• 11 years ago

Is employment via Open Source contribution really as widespread as he suggests?

Any examples of (smaller than a distro) projects with known paid contributors?

LukeShu• 11 years ago

I know that one of the libsass developers is paid to work on it.

EmanueleAina3• 11 years ago

Qt, LibreOffice, OpenStack, Linux itself, WebKit, GStreamer, Wayland just to name a few have both paid and freetime contributions (often from the same people too).

Neil works for Collabora, we contribute to quite a few projects in our paid time. ;)

rectang• 11 years ago

Numerous Apache projects are developed primarily by paid contributors.

warp• 11 years ago

GNU MediaGoblin, MusicBrainz

yarrel• 11 years ago

PPAs are an antipattern.

One of Debian's (many) advantages vs. Ubuntu is that there isn't an ecosystem of poorly maintained but easily found packages around the core.

Lending Debian's reputation to such an ecosystem will not improve Debians' standing or user experience.

AceJohnny22• 11 years ago

As a Debian user for 15 years, I don't understand the hostility against PPAs.

As a user, they provide me with a convenient and somewhat-traceable source of supported packages for my release. For example, at work we're stuck on Ubuntu 12.04 which has git 1.7.9, but there's a stable PPA that can give me a more up-to-date git which has better pull options and defaults. Easier, more trustworthy, and more reliable than compiling and packaging my own!

Alternatively, I'm learning OCaml on Debian unstable, and the OPAM package manager was stuck at 1.1.0 for months after 1.2.0 came out, and to add insult to injury the Debian version was broken because of a silent incompatibility with a dependency.

I realize that by using a PPA I'm going out of Ubuntu's (or eventually Debian's) well-tended garden of tested packages (and honestly, "well-tended" is a very relative term) and potentially exposing myself to risky sources, but that's my choice.

I'm afraid this opposition to PPAs boils down to conservative dogmatism bred from decades of no good option for user package existing. There have been issues, yes, but don't throw out the baby with the bathwater.

amyjess2• 11 years ago

Agreed. One of the things I love about Arch and Gentoo is that if a package isn't in one of the official repos, it can be found in the AUR or an overlay, respectively.

chimeracoder• 11 years ago

One of Debian's (many) advantages vs. Ubuntu is that there isn't an ecosystem of poorly maintained but easily found packages around the core.

Context: I'm a full-time Debian user.

I firmly believe that the future is not around packaging as we've been conceiving of it for the last decade or so, but around packaging in the form of containers[0]. As a Debian user, I'd be really happy to see Debian keep an eye towards containerization as a a first-class citizen of the distribution, the way apt(itude) and dpkg are now.

PPAs can either fit into this model or work against it, depending on how you look at it. They can either enable the creation of containers by virtue of being more flexible and more easily used inside container builds, or they can serve as a crutch for low-quality packaging standards. So, I'd be excited for PPAs in Debian, but I'd like to see them adopted as a tool to facilitate first-class containerization in Debian, rather than the way they are used in Ubuntu more as a place to hold unsupported or less-supported packages.

[0] Not necessarily Docker or even Docker-like containers, but containers nonetheless.

dharma12• 11 years ago

what do you think of https://developer.ubuntu.com/en/snappy/tutorials/build-snaps...

vezzy-fnord• 11 years ago

packaging in the form of containers

I don't really see that. Containers have mostly ingrained themselves into application deployment, but the trends in GNU/Linux packaging seem to be heading toward compressed bundles (combined with some form of access control like AppArmor or POSIX caps to get some form of sandboxing and resource isolation). At least that's what Ubuntu Snappy seems to be. This is similar to Klik, Autopackage, 0install, OS X bundles and even the Windows way of stuffing your DLLs into a single directory namespace (though with a common format and infrastructure).

Nix and Guix are in leagues of their own that have nothing to do with containers specifically.

Everyone else is sticking to the same conventional system package managers and I don't see that changing. The systemd developers are proposing their own odd scheme based on btrfs volumes that is still in its very early stages.

vacri3• 11 years ago

Having used Docker mostly as a packaging format for the past 6 months at my day job, I think it's a terrible format for packaging. I'm about to strip it out and go back to .debs.

The current love of containers is a fad - they have their uses, but it is the new hammer for which every problem has been redefined as a nail. Docker solves some problems, but packaging isn't one of them - and it brings lots of it's own issues along for the ride as well.

Admittedly, I haven't played around with other forms of containers more than a 'hello world', but my experience of container-as-packaging has been woeful so far.

xai3luGi2• 11 years ago

I'd prefer regular Debian packaging plus containerisation via systemd-nspawn or just the various systemd security features that use the same Linux namespacing features as Docker.

http://0pointer.net/public/systemd-nluug-2014.pdf http://ftp.nluug.nl/video/nluug/2014-11-20_nj14/zaal-2/5_Len...

EmanueleAina3• 11 years ago

The plan for Debian PPAs is for them to be quite different than the ones from Ubuntu, they will be available only for those that already have upload privileges. They will be a sort of compartimentalized experimental, with no different builders network and no need for a reupload to push to unstable/testing.

AceJohnny22• 11 years ago

In which case, I don't understand what problem they're solving.

We already have Experimental.

FooBarWidget• 11 years ago

You realize that if a package isn't in the repository (or is in the repo, but not the right version), the alternative is that the user compiles it from source, right? Now the user has all sorts of software scattered over his system, with no way to manage, update and uninstall them. How is that situation any better than using PPAs?

fletchowns• 11 years ago

Use checkinstall? It's somewhere between installing from source and installing from a package.

https://help.ubuntu.com/community/CheckInstall

4ydx2• 11 years ago

Install to your own custom path? /opt ... /local ... /myfolder ... etc. Add the path to your user's $PATH. If you are familiar with linux this isn't really much harder to do. If it is a library that you are then compiling against it does get a bit more difficult, of course, but it is only a good thing to become familiar with these things. If you are ok with "polluting" your path, you can install each new binary + libs to its own custom path. You simply delete the folder in the future when you no longer need it anymore.

davexunit• 11 years ago

Allowing users to easily extend the available packages is not an anti-pattern, it's practical software freedom!

dman2• 11 years ago

The good part about PPA's are that they can be ignored completely. After being bitten once or twice, I have stuck to not installing anything that isnt in the core ubuntu repositories.

jnbiche• 11 years ago

In my 6+ years of using Ubuntu and derivatives, and frequently installing PPAs, I've never had a problem or been bitten. And I've only exercised a little bit of caution.

On the other hand, I ran into massive headaches when I used to try to pin apt repositories. No more of that for me.

PPAs are the main reason I use Ubuntu distros now instead of Debian.

Touche• 11 years ago

I don't know how you can subsist on Ubuntus severely outdated packages.

tacone• 11 years ago

The lack of PPA has hold the industry back for years. Outdated Apaches, outdated Mysqls, outdated PHPs. In a word, distro mantainers became gateway keepers, and bad ones, since they don't have the unlimited resources required to keep everything to date.

While there definitely are cases when you want somebody to pick the versions for you, nowadays the industry is moving just to fast for keep most people satisfied.

Of course there will be poor PPA's. Poor Github repositories also exists, bad NPM packages exist, bad Maven packages exist, but that does not stop people to search for the right ones and take charge of their own future.

radoslawc2• 11 years ago

From: https://help.ubuntu.com/community/PPA "Security

PPAs have not undergone the same process of validation as regular ubuntu packages. End users install PPAs at their own risk. Although each key is cryptographically signed, in order to confirm an uploader, keys are not matched to specific individuals, except via their "launchpad" accounts.

Subsequently, installing a PPA should be considered to be a low-security alternative as compared to the main repository, but marginally higher security than simply installing software at random from the internet. As part of adding a PPA, you trust the developer to not only install packages, but also to allow them to provide ongoing updates."

This pretty much sums it all. It's not matter of hostility towards PPA or trying to keep things oldskool. With all effort towards signed, verified packages, reproductible builds etc. adding functionality like PPA is for me nothing more as installing "shareware" windows apps from random sites. Building packages by yourself is not that hard especially with fpm or checkinstall.

ploxiln• 11 years ago

You might gain some trust in a team which maintains a particular PPA. You import their key manually, and the key is not auto-updated or anything.

Installing shareware windows apps from "random sites" seems riskier, they're not signed by a single uploader's key which you import just once.

radoslawc2• 11 years ago

You're right. I've trolled a little. But still, this brings security issues with it.

New Debian project leader talks open source careers, PPAs and more

Related Stories