Hacker Newsnew | past | comments | ask | show | jobs | submit | sdeziel's commentslogin

`snap refresh --hold` will hold updates indefinitely

https://snapcraft.io/docs/keeping-snaps-up-to-date#heading--...


I suspect the thing people find offensive is that this is not the default


If the reason of snapping is that their preference isn't the default, life must be quite tough for them.

If there's an option, live with it and change it.

I can't see what's so destructive about snaps. It's probably another echo chamber when people find a common target to yell at.


> I can't see what's so destructive about snaps

The implementation is shit.

Things take 10 times as long to start.

There are annoying 'Turn off firefox so snap can update it' messages. Nothing happens when you stop firefox, you'll just get the same message a few hours later.

Shutdown is going to take ages for some reason because it's waiting for snap to do something.

I don't give two shits about whatever snap is trying to do, but having to wait 10 minutes for my workstation to be useful whenever I want to reboot is not what I'm about.


Professionally, the company I'm at ditched ubuntu in our CI builds because of snaps.

The packaging is very limiting, and I don't want to have to fight against the system to get a version of software installed that works.

I personally used to run MicroK8s (snap based). I finally gave up about 6 months ago. Were snaps the root cause? Eh... no, the root cause was dqlite synchronization problems that I was tired of dealing with, but snaps made the whole process so much worse. They're hard to automate, they're hard to interact with using normal tooling. They just aren't part of the system in the same way, and while I understand there's value there (hell - I'm running containers and microk8s for a reason) there's also pain. K8s was an okish trade on that front: I felt a lot of pain and gained a lot of value.

Snaps seem to be falling into the worst possible spot: I'm feeling a lot of pain and the product is usually not any better at all (and sometimes much worse).

HA Microk8s with snaps and nvidia-container-toolkit (The GPU addon) just isn't all that stable (I would consistently get hard lockups on some hardware). That same hardware running Arch and k3s is chugging away beautifully.

So maybe it is an echo chamber - but the echoes I keep hearing are system admins saying this is making life harder and they don't understand the upside, and Canonical pushing forward anyways.

---

So maybe there's light at the end of the tunnel somewhere for snaps. Maybe the grand vision will eventually come and folks will be fine with it. But my suspicion is that Ubuntu is being replaced at most orgs before then.

Steam is throwing weight behind Arch (LOTS of new linux users coming in here). Alpine is a strong contender in containers. Nix is interesting.

Both Flatpak and AppImage seem to achieve the "easy user installs" part without all the pain of snaps, and they're neutral on whether I use them or not.

Basically - if snaps were so good (even if they're only good in some cases) I would expect a conversation about snaps similar to that of SystemD - Strong arguments on both sides, real advocacy from the community for the product, even if it's painful to adopt, or doesn't meet all user needs.

Instead snaps are just "meh" all around. There's a steady stream of folks leaving, and no real advocates outside of Canonical. At most - you have neutral folks like yourself who just don't mind snaps.

To me - that's a bad sign. I bailed. It wasn't worth betting my personal projects on. I've been pretty happy with the decision too.


Well, it depends. I liked upstart, I liked Unity (I still use them as long as I can!) and I didn't dislike Mir, although it never came to anything. But I don't thing snaps are good, at least for me. But what bothers me the most about snaps is not what I consider to be technical deficiencies or annoyances, but the fact that it's becoming the only way to install some software packages in Ubuntu, with no other alternative than leaving Ubuntu for good.


It seems like it was only introduced in December, so I can see why they haven't made it the default. It would be rather surprising to have run a Snap package for the past six years and then suddenly have it stop updating.


That's at least a comfort that they finally implemented that, I haven't used Snap in the past year, so I missed that.


You've been able to specifically schedule refresh times and interval's for awhile now. We did it monthly at a specific time and then set a calendar event with a couple notifications to keep track of it. IMO the "I can't turn off the updates" concern is overblown. If you aren't patching your systems ever you have problems anyways.


Overblown? Tell that to people that were hit with production outages. The whole idea of automatic updates for software running critical workloads is so stupid that I lost all respect for Canonical as a vendor.


The problem with auto updates for daemons and services is that the maintainer cannot possibly account for all the different ways their software is used to be able to guarantee that the new version doesn’t break some critical service. It’s akin to a team outsourcing their CI/CD pipeline to some 3rd party who have no idea they exist!


Nice article! However some numbers are a bit off:

The IPv4 overhead is normally 20 bytes but can reach 60 bytes with many options. For TCP, it's between 20 and 60 bytes as well.

Just ran a quick tcpdump on Linux and curl's TCP connection uses 32 bytes TCP headers (12 bytes of options).


> AES128 is weird too since 128-bit key ciphers are kind of deprecated unless your target is a fridge magnet.

Why is AES128 preferred over AES256 by browsers then?

https://www.ssllabs.com/ssltest/viewClient.html?name=Chrome&... https://www.ssllabs.com/ssltest/viewClient.html?name=Firefox...


Technically it's slower, but absolutely meaninglessly so in the context of browsers.


> Why can't I select text on that page?

Enabling "reader mode" in Firefox did the trick.


> Why can't I select text on that page?

F12 => document.designMode = "on" worked aswell


From the article: "This drops all ICMP packets. ICMP is only used to ping a host to find out if it’s still alive."

Please stop this non-sense, there are too many ICMP blackholes already.


if you are running IPv6, disabling ICMP is a very bad idea because it disables MTU path discovery.

don't be lazy, don't drop ICMP and just do proper filtering.


Same for ipv4.


https://caniuse.com itself only supports TLS 1.0. They know about it https://github.com/Fyrd/caniuse/issues/4198


One can always go to about:config and set security.pki.distrust_ca_policy to "2" to distrust Symantec TLS certificates. Reference: https://blog.mozilla.org/security/2018/07/30/update-on-the-d...


They are distrusted i. Nightly


1.1.1.1 uses anycast so it's effectively being served by any of Cloudflare's point of presences (152 data centers around the world).


3. Don't let your DB engine execute random executable like wget/dd (Apparmor/SELinux)

4. Don't let your DB host make outbound connections (iptables/ip6tables)


> Don't let your DB host make outbound connections

Which can also be prevented with SELinux


> * enforcing SSH key authentication

That cannot be enforced by the server because the key decryption occurs client-side. An alternative is to use Two Factor Authentication.


I think you mean the server can't enforce ssh key encryption/passphrase protection (next point down)?

And 2 or even 3 factor should maybe be on the list (key+pw, key+totp, key+pw+totp).

For keys, it's in theory possible to ease management with using ssh certificates and a CA - anyone know of a convenient way to manage totp secrets across multiple servers and users?


Yeah, I quoted the wrong line.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: