Linux Mint downloads (briefly) compromised [LWN.net]

Linux Mint downloads (briefly) compromised

Posted Feb 21, 2016 21:10 UTC (Sun) by flussence (guest, #85566)
In reply to: Linux Mint downloads (briefly) compromised by glaubitz
Parent article: Linux Mint downloads (briefly) compromised

>However, the problem is that there already is a package "mdm" in Debian which are "Utilities for single-host parallel shell scripting". Thus, on Mint, the original "mdm" package cannot be installed.

The root cause of that issue is that they've built their distro atop one that doesn't namespace packages sanely (or at all). Debian also has had the same dilemma internally with ack, chromium, dolphin, etc. but they choose to work around it by changing the name, sometimes the binary, of one of the two programs; the end result is that the one on the losing side of the deal ends up harder to find.

Everything else you've said is valid, but this one is squarely Debian's fault.

to post comments

Linux Mint downloads (briefly) compromised

Posted Feb 21, 2016 21:21 UTC (Sun) by glaubitz (subscriber, #96452) [Link] (1 responses)

> The root cause of that issue is that they've built their distro atop one that doesn't namespace packages sanely (or at all). Debian also has had the same dilemma internally with ack, chromium, dolphin, etc. but they choose to work around it by changing the name, sometimes the binary, of one of the two programs; the end result is that the one on the losing side of the deal ends up harder to find.

Well, yes, but is there any distribution out there which supports multiple namespaces? I'm not aware of any.

> Everything else you've said is valid, but this one is squarely Debian's fault.

I think that's arguable. You cannot blame Debian when Mint decides to re-use the name of existing packages and deliberately runs into such conflicts. I mean, yes, we have had conflicts in Debian with packages like "node" vs. "nodejs" and so on, but we actually resolved them and did not leave them as-is and let just the user run into them.

FWIW, one could as well blame the upstream projects for using conflicting names for their projects.

Adrian

Linux Mint downloads (briefly) compromised

Posted Feb 22, 2016 12:13 UTC (Mon) by ssokolow (guest, #94568) [Link]

The naming collisions in the filesystem are definitely tricky but, as far as package names go, Gentoo's 2.5-layer naming system helps a LOT. (eg. games-action/chromium and www-client/chromium)