LWN: Comments on "Some challenges for GNOME online accounts"

Some challenges for GNOME online accounts

zarrro — Sat, 09 Mar 2019 11:54:05 +0000

I actually use my Own cloud via GOA on my Fedora machine, and it works quite well.
I find the Gnome approach of mounting OC, instead of syncing a local directory, works much better for my usage.

Unneeded applications

andyc — Fri, 08 Mar 2019 18:38:33 +0000

> – Maps
> – Weather

> They are kind of apps that you run once, say "ok pretty", but never run for the
> second time.

I do use Weather occasionally., however I quite often fire up Maps to just lookup some place.

> GNOME Clocks is borderline usable

I do find this very useful (and have used similar tools in the past) and have a number of timezones set up in it.

Of course there are reasons why I'd rather use the apps than some website.

Some challenges for GNOME online accounts

ThinkRob — Sat, 02 Mar 2019 08:19:50 +0000

> So there's no way we can ever stop random applications from using the GNOME key and pretending to be us, right? It just works because nobody has decided to abuse it yet?

True...

...but isn't that pretty much true of any app/OS/software?

Like yeah, your closed-source whatever may not be quite as easy as OSS -- but if there's sufficient motivation someone *will* extract keys/secrets/tokens from your software and use them for unintended and/or nefarious things.

I remember how within days of the iPhone (the original one) having it's first couple FW updates released the jailbreak people had extracted out the Yahoo APIs and were (ab)using them for all sorts of stuff. (Ex: that funky UDP-based push e-mail was kinda neat on non-iPhone devices.)

I guess the main saving grace for GNOME is this: what would extracting a key get you? The ability to do a distributed brute force on some login system? You can already usually do that just pretending to be a browser or any one of a zillion other apps and launching from some PaaS/VM host with a ton of IPs. GNOME doesn't have any special privileges that would make that sort of attack easier.

I'm genuinely curious as to why the key disclosure is a problem -- aside, of course, from the risk of griefers trying to get GNOME banned just for the hell of it.

Some challenges for GNOME online accounts

nim-nim — Tue, 19 Feb 2019 06:12:12 +0000

It's not a means problem. It's 100% a project culture problem.

Owncloud built a useful server-to-end-user solution and got funding.
Matrix build a useful connected solution and got funding and a FOSDEM keynote.
Collabora is webifying Libreoffice and is getting funding.

What do they have in common? They all address the kind of non-unixy end user GNOME would like to attract. They all focus on helping users getting things done instead of pretty app demonstrators that are useless in the real life and where half the functionality is disabled for no reason anyone can understand. (who uses GNOME Web in real life?)

GNOME could have chosen to support any one of them, or take the FreedomBox and run with it, or do its own server-side thing, instead it chose things like GOA that would never give it any ability independent from what proprietary cloud owner were ready to concede at any given time.

Some challenges for GNOME online accounts

dvdeug — Mon, 18 Feb 2019 23:12:08 +0000

Did you work on systems that made server-side computing more accessible to the average user? It's easy to criticize in retrospect, but much harder to anticipate and put the work in.

For one big example of the problem, compare GitHub to GitLab. I'm going to assume they're at feature parity, but I haven't really looked at GitLab. Because setting up my own GitLab on my own computers wouldn't make it available outside my apartment, and setting it up on a cloud service would take a bunch of time, for little value, and I'd lose all the connections GitHub gives me, the ease of access and notice from other people. There are other GitHub-like websites, but GitHub is good enough feature-wise and all the others lack those connections. Since it is a server I don't run or control, the money has got to be coming from somewhere, be it ads (like Google) or proprietary extra-cost add-ons (like GitHub).

I'm pretty sure that the *nix network-centric heritage was not simply going to lead to Android gold; the ideas and models are quite different. Could GNOME and KDE have done better? Surely; but I'm not seeing where they could have amazingly side-stepped Google. Servers aren't free, and that's the hard part of this.

Some challenges for GNOME online accounts

nim-nim — Mon, 18 Feb 2019 14:06:01 +0000

And why is that so? Because Free Software Desktop projects wanted nothing to do with server-side computing, spent years removing any trace of the *nix network-centric heritage from their software, and then, when end-user systems started getting an always on network connexion just like the unix workstations of old, jumped on proprietary cloud services as a magic solution to avoid working with free software server people.

And now computing is becoming network-centric. And proprietary cloud services only care about their own desktop frontends. Tough luck. It is easier for Microsoft, to pivot into being a Linux cloud provider, than for free software Desktop projects to admit their windows 95 target is DOA, that Android would not exist without the Google cloud, and that they need to work on what happen on the other side of the network link.

Some challenges for GNOME online accounts

flussence — Sun, 17 Feb 2019 19:08:59 +0000

To paraphrase an infamously tone-deaf statement from 2010…

“I guess you have to decide if you are a GNOME desktop, an Ubuntu desktop, a OneDrive desktop, a Yahoo desktop, or a Google desktop unfortunately.”

Single-sign-on vs siloed access

smcv — Sat, 16 Feb 2019 20:00:33 +0000

> isn't one of the problem with the single-sign-on that the user needs to provide permissions for the full set of capabilities of all apps?

That's why GOA isn't intended to be used in apps outside GNOME itself (although that wasn't always communicated very well in the past, and there's no technical mechanism to stop unsandboxed third-party apps from using it).

Unneeded applications

mcatanzaro — Fri, 15 Feb 2019 19:37:29 +0000

The Clocks and Weather apps are sort of useful insofar that they're required to be present for GNOME to be able to display world clocks and weather underneath its calendar. It's useful content to have in that space, and we need some UI somewhere for configuring it. But yeah, the applications themselves have clearly not been successful. I'd say that's mainly due to lack of resources, though.

Honestly that's a broad trend across all of GNOME. We have some high-quality applications, but for the most part quality is lacking compared to that of the desktop itself.

Some challenges for GNOME online accounts

rahulsundaram — Fri, 15 Feb 2019 18:22:33 +0000

> System administrators and programmers who can effectively use open-source software (that is: understand the source, should the need to do so arise) are not interested in flatpak application distributions.

Not true. These are overtly general remarks and easily disproven by even a few personal experiences. Even within a small sample of 6 sysadmins in my team, the vast majority of them are quite interested in Flatpaks. One runs several for random games. Two of them are experimenting with using Flatpak + Fedora Silverblue and so on. If you step back and look at container style app deployments, such interests would extend to a lot more people.

Some challenges for GNOME online accounts

daniels — Fri, 15 Feb 2019 17:42:28 +0000

System administrators and programmers who can effectively use open-source software (that is: understand the source, should the need to do so arise) are not interested in flatpak application distributions.
(I'll leave my thoughts on Devs who point-and-click mystery containers and assume someone upstream knows what they're doing unsaid.)

As a system administrator and programmer who can effectively use open-source software, including understanding the source and/or just writing it in the first place - I am interested in Flatpak application distribution, and have had a huge benefit from Docker-like container systems as well. As have many, many, others who developed those technologies in the first place, develop with those technologies, and also consume the results.

If you don't like them, fine, but there's no reason to be condescending about it.

Single-sign-on vs siloed access

Flameeyes — Fri, 15 Feb 2019 15:01:57 +0000

I haven't really looked into GOA for years, but isn't one of the problem with the single-sign-on that the user needs to provide permissions for the full set of capabilities of all apps?

That doesn't sound like a particularly positive feature to me, even without Flatpak: why would my email client use the same permission as a document browse? What if I want two different apps to have access to a cloud storage but for different folders, that never should be mixed together?

Unneeded applications

hadess — Fri, 15 Feb 2019 10:15:30 +0000

> why does GNOME spend resources on applications neither users nor developers want?

GNOME is a volunteer project, it doesn't have a GNOME management pulling people from a project and force them to work on another. People work on what they want.

> They are kind of apps that you run once, say "ok pretty", but never run for the second time.

Filing issues against them for what features you think are missing would be useful.

> GNOME Documents started with a good premise, but turned out to be limited, read-only view of docs.google.com. Where's the value in that?

Google Docs could be edited in GNOME Documents.

Unneeded applications

zdzichu — Fri, 15 Feb 2019 08:28:52 +0000

This little thing:

> It has suffered, though, from a lack of both users and developers

That's somewhat different, but quite valid point – why does GNOME spend resources on applications neither users nor developers want?
And the selection of GNOME applications is lacking in reason. Recently I saw that GNOME ships with small apps lacking a use case:

– Maps
– Weather

They are kind of apps that you run once, say "ok pretty", but never run for the second time. When I need a map, I'd rather go to maps.google.com and get the best experience, instead of running the Maps app. I see no point in Weather app at all. GNOME Clocks is borderline usable when you have coworkers in different timezones, but https://www.timeanddate.com/worldclock/meeting.html is again more usable and accessible.

GNOME Documents started with a good premise, but turned out to be limited, read-only view of docs.google.com. Where's the value in that?

Some challenges for GNOME online accounts

drag — Fri, 15 Feb 2019 02:12:05 +0000

I don't think that this is a accurate assessment of the computing landscape.

There are more programmers and developers and all that stuff then there ever was before. They are doing more sophisticated, more interesting, and more useful stuff on a larger scale then ever before. And it's not all high level stuff. There is more going on in digital electronics then ever before and it's much more accessible and being used by individuals and small businesses then ever before. We have more options, more tools, more document, easier access to in-depth information, larger community, more diverse community. Cheaper, better, faster.

It's just that the desktop doesn't have anywhere close to the same level of utility that it did 10-15 years ago. The world has moved on to bigger and better things. If you were in any business and you told everybody you think that it would be a great idea to write a new desktop app in C or C++ they would probably want to see some serious justification for that decision before they would take you seriously. It's kinda lunatic approach to doing things nowadays unless you are writing some 3D game or something like CAD software.

As far as tablets and smart phones.. People are using computers for things other then 'computing'. Widespread proliferation of these devices just reflects that. After all the point of software is not software. The point of computers is not computers. It's that you can do useful things with these things to improve your life and make the world a better place. Having a interface that is convenient to have around when you need them is a improvement. The problem with them is that they become walled gardens and the corporations that control them attempt to use copyright and other IP laws to seize control of user's data and devices to control and monitor them. It's beyond critical that open source and secure alternatives exist for those people who seek them out.

Even in tablets and smartphones open source software is utterly dominate, although layered over with proprietary garbage. Android AOSP is a FLOSS operating system that isn't really alien or that different from a regular Linux distribution anymore and is increasingly compatible with any and all sofware people would care to run on any traditional Linux OS. The number of phones out there a year or older that is capable of running more vanilla Google-free Android is enormous. I am sure that it can be numbered in the millions world-wide. The opportunity is huge.

As far as flatpack goes.. There isn't anything mysterious about their contents. Not any more mysterious then what you have in a install CD or a Deb mirror. If you want to know what is going on all you have to do is look. The first thing I do when I look to use containers for anything is find out the docker file for them and see what is actually going into them. It's actually pretty easy to understand what is going on in most containers if you want.

Which reflects more on the fact that open source software is so completely and utterly dominate at this point that it's not even funny. You may poo-poo containers, but it's containers that are a large part of making this possible. It simply would never work if everybody had to depend on RPMs or Debian releases for their software... it's simply a ineffective approach for many things. (not everything).

I think the biggest problem we are going to see going forward with many important open source software projects is that after 20 or 30 years of continuous development they have reached such a high degree of sophistication that anybody possessing less then 10 years of working with these sorts of projects is not going to be able to make a meaningful contribution. It's a barrier of entry problem.

Some challenges for GNOME online accounts

jccleaver — Thu, 14 Feb 2019 22:14:23 +0000

This really is the key point.

There is a traditional audience for open source software and tooling. For computer users.

There is also an audience (a much bigger one) for turnkey solutions. For computer consumers.

Unlike, say 15 or 20 years ago, the mode/median needs of the population of computing hardware users is not interested in -- nor do they have a plausible route to -- programming and utilization of computers in a meaningful way for the open source community. 25 years ago, even closed systems had paths to scripting and user-control of the system: HyperCard springs to mind on the Mac, and AppleScript (a language derivative) and other macro systems provided an onramp to programmer/administrator-level control of a complex piece of hardware and software.

As consumer use of computing systems took off, from the workplace and prosumer environment and game-player or family system to the current era of *mass* smartphone consumption of internet-based walled gardens, the attempt by desktop environments to duplicate the mobile OS environment has doomed itself to failure in pursuit of an audience that doesn't exist.

Mass consumers who want to pick apps from a curated gallery are not interested in the complexities of local administration.
System administrators and programmers who can effectively use open-source software (that is: understand the source, should the need to do so arise) are not interested in flatpak application distributions.
(I'll leave my thoughts on Devs who point-and-click mystery containers and assume someone upstream knows what they're doing unsaid.)

GNOME should avoid impossible features such as these within its core design and allow for simplifications for embedded situations to sit on top of it. Anything else really doesn't seem a tenable position in the long run.

Some challenges for GNOME online accounts

dvdeug — Thu, 14 Feb 2019 21:43:20 +0000

Not supporting the tools that people actually use is going to result in pain and disappointed, frustrated users. Life is compromise, and ultimately you need to provide the tools that people want to use. When releasing products, you can't keep fighting yesterday's battles; you have to keep up with today's needs.

Taking applications and verifying them in some sort of way that you can trust them and prevent all harm is never. gonna. happen. Perfect is never. gonna. happen. Now let's talk about how we're going to provide a variety of programs in a way that minimizes the potential harm from those programs.

The actual, already existing audience for free, libre desktop applications is shrinking. I used Gnumeric in the past, but now I use Google Sheets for my minimal spreadsheeting needs. It's accessible where I need it to be. I go to Wolfram Alpha for many types of calculations I might have opened up bc for or wrote some code. Evolve or die.

Some challenges for GNOME online accounts

colo — Thu, 14 Feb 2019 19:38:16 +0000

I think it's about time, at least for the FOSS community's part that is working on "next generation" personal/desktop computing stuff, to face a few harsh realities. At a minimum, that is:

o) Tight integration with third-party, completely proprietary network services beyond anyone's own control and without any kind of evasive mobility in case of a change or discontinuation, that therefore may break at any time (which _could_ in theory be navigated around by a project depending on such a service, but what is at odds with accepted distribution lifecycles) is a bad idea that will eventually, yet unavoidably, end in pain and disappointed, frustrated users.

o) Having "untrusted" application bundles delivered in some app-store-esque kind of way execute in a magically unbreakable sandbox that prevents all harm is never. gonna. happen.

Once that finally sinks in, maybe the efforts can be re-focussed again to deliver programs, tools and features that are of use and value to the actual, already existing audience for free, libre desktop applications.