I’m new to this community, so I fully acknowledge that this rant is likely based on a lack of knowledge or understanding about how the code operates. However, I was taking the alpha 2 browser for a test drive and noticed the following comment
that gave me pause:
"
Sorry! Breaker auto-updates are only supported on the production build for MacOS and Windows.
"
Religious wars aside, what could be the reason for natively supporting windows and mac at such in the alpha stage, or ever? I could see how the choice to do this might be so that development and access is as inclusive as possible to all people, but I’m sure many of you are well versed in how these are inherently closed and unsafe predatory systems. From a security perspective it logically inconsistent for those trying to foster the development of an open and “safe” network protocol. Nor are they safe from a long term development point of view, considering the fact that MacOS or Windows can decide on a whim to change the OS api and the SAFE tools might get broken. Looking through the git repo it seemed like most of the code was OS agnostic or has been developed on linux, so maybe adding native support hasn’t really been that much trouble and I am seeing this as a bigger problem then it really is?
The auto update feature isn’t necessary on Linux. The usual update procedure on linux is to use the repository of you distribution to update the system and all installed programs, i think that’s why auto update isn’t supported on linux.
they are using the web platform for apps as it is completely platform agnostic.
android isn’t closed (close as in closed source) {@seeAOSP}
While most Linux apps don’t auto-update, I would like to point out that a few (such as Write!) do auto-update (sort of- it prompts to download and install without other user actions), so it seems to be more a question of whether or not those behind the apps are willing to make the extra effort.
While I have exactly zero experience with Mac (I’ve never liked Apple), I know that Windows has never supported updating similar to the update centers on the biggest linux distros, which incentivizes building auto-updates into a lot of commonly-used applications (but not games, from my experience). Windows 10 S, from my understanding, is an attempt to fix this by forcing users to install through the Windows Store; while I personally believe this is a mistake, it should encourage more devs to put their apps in the Store to allow for similar update methods as what Linux (and BSD systems, I believe) have supported for many years.
The biggest issue for me in regards to Windows systems is the telemetry that is constantly sent back to Microsoft (I’m not sure, and wouldn’t be surprised, if Apple does the same thing). As far as I’m aware, there’s no real way to fully disable Windows’ telemetry, though that knowledge may also be significantly out of date, as I haven’t bothered to look anything up about it since Windows 10 was released.
Thanks for the clarification about the browser. It wasn’t clear from the initial documentation I’ve seen that the browser was third party rather than an integral part of the network function. Additional research on my part has improved my understanding of the SAFE network. Please pardon my ignorance. I’ve edited my original post in a shameless attempt to conceal how wrong my initial conclusions were.
SAFLN network (Secure Access for Linux Users) doesn"t have the same ring to it as SAFE network
I’ve tried Linux out a number of times over the years with no success & tons of frustration, and I’m fairly computer literate… imagine trying to get completely non techy people to switch to Linux to access the SAFE network. It would be a non-starter for most people.
I guess the initial gut reaction I had was that it’s hard to maintain anything “safe” on windows, and only less ridiculous on mac. Linux is still difficult to keep safe but at least most of the underlying software is open, minus binary blobs for ignorant hardware manufacturers. If the devs are able and ensure security when these platforms and/or other bad-actors are integrated in the network then that is awesome…
SAFE is a networking project moreso that an OS project at this point in time. Take a look here though, as other OS projects are interested in supporting SAFE
Just to clarify a bit further, we actually didn’t do any dev to get the current auto-updater functionality as you see it, (which we actually don’t have implemented).
We use electron-builder to package the application across platforms (as does beaker as some folks noted above ^), which has this functionality baked in. So we wouldn’t have to do much should mac/windows change their OS apis. (Electron builder has a huuuge community, and is supported by the electron dev team (which powers atom, as well as a bunch of other high profile apps), so any OS changes will likely receive a swift update to the builder.)
So we’ve a good base for when we might want auto-update functionality, but we’re not looking at that especially as yet.
As a Linux pro for over a decade: if you’re app auto-updates itself on Linux, your app is breaking the Linux security model. What you are advocating is that we make Linux follow the same broken security model that made Windows and Macs a security nightmare for decades. You may have noticed that they learned their lesson by the time they came out with SmartPhones and pushed us all to app stores, which are functionally similar to Linux repos.
If you actually care about keeping the Linux eco-system secure, focus on reaching the point where you can work well with repository maintainers to keep the repo up to date.
Hmm… Also good information to have; I’m still a (relative) novice when it comes to Linux, and I still have a fair amount to learn. I wasn’t necessarily trying to advocate for Linux auto-updating, however – I was mainly trying to state my own experience with apps that auto-update on Linux. I wasn’t really aware of the Linux security model before your post, unfortunately, though I much prefer the Linux method of handling updates over how Windows has historically updated its system (I hate that Windows, by default, tries to update itself without user permission, and is largely why I’ve been using Linux). You’re absolutely right, though; next time I’ll be more careful with my word choice in similar situations.
Keep that up and you’ll be the best kind of expert. I’m taking this reminder to prefer the “always a novice, but willing to share” approach.
Since you’re comfortable changing your mind on technical stuff, I’d be curious to know whether “being careful with word choice” is better or worse than “testing bold interpretations.” Welcome aboard! There’s a lot of good folks here.
That’s my intention! I like to think of myself as a life-long learner, which means I have to be willing to consider and admit when I’m wrong, regardless of what it’s about. It’s something I like to encourage in others, too – regardless of expertise.
That’s an excellent question, and one I’ll have to consider. I’d certainly be interested in discussing it with you, though it would have to be moved elsewhere so we don’t derail the topic.
As ptv says, one of the many benefits of running a Linux distro is that all software you get through the repos for a distro is that each and every package is vetted by the maintainers of that distro (this is especially true of core repositories, and enterprise level distros).
As soon as you start giving users the ability to install software willy-nilly all over the place from where-ever they get it, that benefit disappears pretty quickly. Unfortuantely many resort to that model of distribution since it isn’t always possible for some things to be included in a distributions standard repository (such as license issues, proprietary software).
But! We over Linux land do recognise this is a problem for end users, and this is why such things as snaps and flatpak exist now - users can download software from these repos without need for admin rights, and the software runs in a sandbox. If anything, thrid-party app developers should aim to package for the two main formats - rpm, deb - and also supply a flatpak (more widely used) instead of releasing random tarballs/install scripts/replying on make install.
This was sort of my line of thinking and why I was perplexed when I saw the auto-update feature. It wasn’t so much that I thought linux should be given priority for features like auto-update, but that a features like that shouldn’t be there and there is no reason to try and accommodate flawed closed source security models (or a closed OS).
Thanks for the link. I’m not so much a linux fanboy as just one that advocates open source. So FreeBSD, Cubes OS, Debian, Gentoo, etc… if they are open source then seems to fit fine with SAFE philosophy. Part of using any new technology is education, so while new users get introduced to SAFE it is an opportune time to also educate them about how closed source software and their closed OS typically do not respect their information/data. For example, why would someone want to waste resources and going through all the trouble of backing up their data to SAFE, if it is insecure and subject to malware on their own PC? While their desktop insecurity may or may not be a problem for the SAFE network, users may be left with a false sense of security… like novice onioneers…
