Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Well, now we have flatpak and snap to work around the "broken" software distribution models of most distros...

That said, if you ship an application that depends on system libraries then you're just setting yourself up for problems. There's really no excuse to not do things properly!



And before them we had GNUStep Application Bundles, ROX Filer AppDirs, and Klik (now AppImage). Flatpak and Snap do have some "advantages" over those from a Linux Desktop Community perspective though: They're incredibly over-engineered and they're the same idea implemented twice.

> That said, if you ship an application that depends on system libraries then you're just setting yourself up for problems.

Only on Linux, which is kinda my point. Other platforms are actually, you know, platforms.


Linux implements several platforms. The issue is that the API is stable at the _source_ level, not the binary level. I guess the ideal for Linux would be for these games to be open source, but of course that will not (should not?) happen for obvious reasons.


The obvious solution is, distribute the source code and build on end user's environment.

Distributing the source code doesn't necessarily mean free software. Since those free software haters(idiots if you ask me), has no problem distributing game assets and compiled binary to the user, why is the source code exception?

If you are idiot enough to want the source code to be secret, just minify and uglify the source code. Uglified source code is as readable as compiled binary.


I've never heard of these. Can you give more info?


Flatpak and Snap are new package formats, which allow bundling software with all the libraries that it needs.

Advantage is that developers can package exactly those versions of the libraries that they tested with and know to be working.

Disadvantage is that if there's a security problem or bug in one of those libraries, you're dependent on the developer to release a new version of the Flatpak or Snap package.

Another disadvantage is that libraries can't be shared between applications, which increases hard drive and RAM usage.

A second important aspect of Flatpak and Snap packages, which is however not relevant to the discussion, is that the execution of the packaged applications is done in a sandboxed environment.


Are they exactly as portable as a statically linked binary, or more? (I vaguely recall static binaries still depending on kernel versions, or something like that)


There's different levels of static linking.

0) Application links to shared .so files in /usr/lib like libpcre.so. This is ordinary dynamic linking.

1) Application statically links all normal libraries like zlib and pcre, but still dynamically links to runtime systems like libc.so. I'll call this ordinary static linking. You can't "patch" a vulnerability in zlib without recompiling and redistributing, but on the other hand a zlib upgrade can't break your app either.

2) Application literally statically links everything (e.g. using musl instead of glibc). At this point the only dependency is the kernel you're running on. You need:

* obviously the kernel and architecture have to match. Can't run a 64-bit program on a 32-bit system without recompilation. Can't run a program compiled for linux on bsd.

* the kernel has to support whatever syscalls your application is using. If you're not using any fancy new functionality, you can get away with running on truly ancient kernels (e.g. 2.x linux)

* the kernel ABI must not break in the future. E.g. if linux changed the order of parameters to the open(2) call, that would be a breaking ABI change. Kernel devs are extremely careful to not do this, so I wouldn't worry about it.

The new packaging formats like Flatpak are based on containers. Your app thinks that it's using the "system" libpcre.so, but in actuality it's just being served the libpcre.so inside the container's filesystem (linked by the ld inside the container's filesystem, using the glibc inside the container's filesystem, and so on). So basically the same high level pro/cons as #2 above, but easier for users and developers.


I'm not super familiar with Flatpak and Snap, but I don't think so. They each require a runtime and use special fixed directories.

AppImage requires no runtime (or more accurately, it is part of the package) and is almost as portable as a statically linked binary, largely because it is (practically) a statically linked binary.

> I vaguely recall static binaries still depending on kernel versions, or something like that

This has to do with glibc. If you don't use glibc you don't really have to worry about it.


tl;dr: Both are running applications with the exact versions of dependencies inside a separated environment (read as mount namespaces, there could be mounted directories from main file hierarchy).




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: