Garrett: There's more than one way to exploit the commons [LWN.net]

Garrett: There's more than one way to exploit the commons

Posted Apr 5, 2016 20:33 UTC (Tue) by MattJD (subscriber, #91390)
Parent article: Garrett: There's more than one way to exploit the commons

This is back to the ago old problem. For any software the user doesn't care about (but does what they need), the user never ever wants it to change. For any software that they do care about (whether that's a browser, email sever, PCB designer, compiler, etc) where they want the latest and greatest function, they want that (and only that) to change.

But of course that means there are nearly an infinite possible combinations, almost unique to the user, of what they want. We can't feasibly create a system allowing that without risking obsolete software sitting around creating issues. Neither centrally managed (distributions + package managers), nor containers (xdg-app) will solve this. Both provide their own workaround to help, but don't solve it.

What I think we really need is a way to manage change over time, and avoid large world changes. Basically a slow way to boil the frogs, so we don't notice as the system changes over time. If we found a way to do this efficiently, then we could have all the software constantly updating, so things like Debian stable aren't needed.

Of course, we don't live in this world, and thus I use Debian stable on several different server machines because I only need to deal with change every so often. I'm just as guilty at wanting my pet projects to update fast while everything else never ever changing. But that is where I'd like to see us move to.

to post comments

Garrett: There's more than one way to exploit the commons

Posted Apr 6, 2016 7:52 UTC (Wed) by NAR (subscriber, #1313) [Link]

almost unique to the user, of what they want. We can't feasibly create a system allowing that without risking obsolete software sitting around creating issues.

Maybe, just maybe the distributors should try to trust their users instead holding their hand. I mean - "scary security fault in xscreensaver, upgrade your VLC (amongst other software) to solve it!" while I could not care less on my home desktop about the security of xscreensaver. Could we get any more ridiculous?

Garrett: There's more than one way to exploit the commons

Posted Apr 6, 2016 8:28 UTC (Wed) by ms (subscriber, #41272) [Link] (3 responses)

> But of course that means there are nearly an infinite possible combinations, almost unique to the user, of what they want. We can't feasibly create a system allowing that without risking obsolete software sitting around creating issues.

Nix and nixos, are at least to me, pretty compelling evidence that different users can have whatever unique combination of software they want without impacting each other, or the system. Obviously, there are going to be some limitations - for example you're never likely to get a modern wordpress to work with postgresql 0.1, no matter what the package manager is. But I'd be slightly surprised if there are non-absurd selections of software that can't be achieved with nix.

Garrett: There's more than one way to exploit the commons

Posted Apr 6, 2016 15:10 UTC (Wed) by farnz (subscriber, #17727) [Link]

There are, in my mind, two basic distribution models:

We will do the hard bits of turning piles of source into executable code for you (such as dependency management). You are responsible for choosing sets of executable code that meet your requirements, including keeping track of security issues (we might, if you're lucky, tell you which of your installed executables have issues) - all the distro promises is source → executable conversions.
We will do the hard bits of keeping the software we offer in a usable state - we will handle security alerts, bugfixes, stability etc. You are responsible for choosing software that meets your needs and configuring it appropriately; we do everything else for you.

Debian's problem is that what it wants to offer is closer to model 2, but that what some users are expecting is closer to model 1. From the sound of things, NixOS is close to model 1 - but then that's not what some people want from a distro.

Garrett: There's more than one way to exploit the commons

Posted Apr 11, 2016 20:09 UTC (Mon) by aigarius (guest, #7329) [Link] (1 responses)

And then you get xscreensaver developer screaming at you because you reported a bug that was caused by trying to use the newest version of xscreensaver with a 6 month old version of libpam that does not have that one feature he started using in xscreensaver code last week.

Distributions are in the business of creating a set of working software versions and having a lot of people verify that this particular set does indeed work together (and report bugs if it does not).

Garrett: There's more than one way to exploit the commons

Posted Apr 12, 2016 8:54 UTC (Tue) by ms (subscriber, #41272) [Link]

> And then you get xscreensaver developer screaming at you because you reported a bug that was caused by trying to use the newest version of xscreensaver with a 6 month old version of libpam that does not have that one feature he started using in xscreensaver code last week.

So in theory this should be impossible - tools like Nix wouldn't allow that to be built, _provided_ it was some API change. However, you are obviously correct because APIs capture in their signatures only a tiny fraction of the semantics upon which one relies. It's completely possible (and likely very common) for semantics to change all the time yet the API stays the same. Unless you can prove it's an isomorphic change, it's probably safer to treat any change to any package as an incompatible change, even if the API stays the same. Either that, or you going to have to spend a long time either proving the required semantics haven't changed, or doing fuzz testing or similar to try and demonstrate the same. Ho hum.