Flatpak Is Not the Future
&quot;Software has gotten so much slower and more bloated that operating systems no longer run acceptably on spinning rust.&quot;<p>I&#x27;d argue they never did. Hard drives have always been slow and when they were the primary means of storage on the PC, people were always trying to find ways to speed things up. Now it takes seconds to boot rather than minutes.<p>&quot;Laptop manufacturers are switching to smaller flash drives to improve performance while preserving margins. Budget laptops circa 2015 shipped with 256 GB or larger mechanical drives. Now in 2021 they ship with 120 GB flash. &quot;<p>This is outdated information. I just checked Lenovo&#x27;s store and while they do have a super low end machine at $200 with 64Gb of EMMC, their real budget model laptops start with a 256Gb SSD. The standard ThinkPad we order this year for users had a 1Tb SSD. Is it budget? No. But building towards the lowest common denominator is rarely worthwhile without good reason.<p>&quot;Chromebooks are even smaller as they push everything onto cloud storage. Smartphones are starting to run full-fledged Linux distributions. The Raspberry Pi 4 and 400 use an SD card as root device and have such fantastic performance that we’re on the verge of a revolution in low-cost computing. &quot;<p>Chromebooks and RPi&#x27;s are not PCs. Yes, some enthusiasts use them that way but that is a niche and done by people who know what they are doing. They can easily enough avoid flatpacks.<p>Linux is a big place and its versatility allows for designing distros around multiple use cases. Flatpack and Snaps are meant to make software distribution easier. Constraints such as storage are not a primary concern for most users. Most machines have enough. Their mere existence does not mean other methods of deploying software aren&#x27;t available so if storage is a constraint, then simply don&#x27;t use them.<p>A lot of the arguments against Flatpack and Snap seem to be based around &quot;it&#x27;s not good for my usecase&quot; ok. Then don&#x27;t use it.<p>&quot;Each app with a new runtime adds another hundred megs or more of RAM usage. This adds up fast. Most computers don’t have enough RAM to run all their apps with alternate runtimes. The Raspberry Pi 400 has only 4 GB of RAM. Low-end Chromebooks have only 2 GB. Budget laptops tend to have 8 GB, mostly thanks to the bloat of Windows 10, but these app packaging solutions are catching up to it.&quot;<p>My case in point. Still referencing niche machines. Most RPi&#x27;s are used for a dedicated purpose. 99% of Chromebooks never exist Google&#x27;s ecosystem for it. And their concept for what qualifies as a lot of memory is, I think, out of touch. 8GB is the base for an x86 PC. Not a Chromebook but a real PC. Many have 16 gigs and its not uncommon to see up to 32 in laptops and even more in workstations.<p>&quot;Why shouldn’t storage shrink anyway? Software should be getting more efficient, not less.&quot;<p>My knee jerk response is &quot;why?&quot;. My more thoughtful one is that efficiency can be measured in many ways. Resource usage becomes inefficient when the user determines it is. And everyone has a different idea of where that lies. Nobody is multitasking more than a couple of applications at any one time on a PC. Servers are different but Servers aren&#x27;t an intended use case for Flatpack and Snaps. If I can run the software I want at acceptable performance then its resource consumption is efficient enough. But you know what Flatpacks are more efficient with? Time. I don&#x27;t have to deal with dependencies. I just tell it to install and it works. Given how awful the application management experience is in Linux traditionally, I am willing to take the downsides for that massive upside.<p>&quot;Such an app can drop a malware executable anywhere in your home folder and add a line to your ~&#x2F;.profile or a desktop entry to ~&#x2F;.config&#x2F;autostart&#x2F; to have it auto-started on your next login. Not only will it run outside of any container, it will even persist after the app is uninstalled.&quot;<p>I think he has a point with security. Permissions can be vague and misleading. And they do have a supply chain attack vulnerability. But that&#x27;s true of any software you get from the repository, store etc. If the official Fedora&#x27;s official Flatpacks can have malware then so can their official Repo.<p>His section about identifies clashes is not an inherent problem with Flatpack but rather a procedural problem with Fedora and Flathub. I think its weird he brought it up when he started the article saying he wouldn&#x27;t include easily solvable issues. Yet here we are.<p>&quot;You would think that these packaging mechanisms would embrace simplicity if they want to attract software developers. In fact they are doing the opposite. &quot;<p>This is the efficiency problem again. Define simplicity. What is simple in one area is complex in another. The fact is nothing as complex as software on a computer can be simple everywhere. If it were it would be useless. So the question is not how to make it simple. It is where are you placing your complexity. Traditional package management places the complexity on the user while keeping the software simple. Flatpacks place the simplicity on the UX while making the software complex. None is inherently superior. Its all about design goals.<p>&quot;All of these app packaging systems require that the user have some service installed on their PC before any packages can be installed.&quot;<p>And? All software has dependencies and a lot requires some kind of run time. Does he also consider all Java software problematic because they require a JVM first? What about all web based applications requiring a compliant browser? This is a non issue in context of how everything else works in the 21st century.<p>&quot;A major goal of most of these technologies is to support an “app store” experience: Docker Hub, Flathub, the Steam Store, Snapcraft, and AppImageHub (but not AppImageHub?) These technologies are all designed around this model because the owners want a cut of sales revenue or fees for enterprise distribution. (Flathub only says they don’t process payments at present. It’s coming.)&quot;<p>Conceptually there is no difference between an app store and repository. They are the same thing. App stores are just repos that are more user friendly.<p>&quot;This is very far from the traditional Windows experience of just downloading an installer, clicking Next a few times, and having your app installed with complete desktop integration. This is true freedom. There are no requirements, no other steps, no hoops to jump through to install an app. This is why the Windows Store and to some extent even the macOS App Store are failing. They can’t compete with the freedom their own platforms provide.&quot;<p>I didn&#x27;t expect him to advocate for the windows model. And I actually agree. Windows handles application management the best. However a lot of the criticisms he gives Flatpack would apply to windows too though. You are guaranteed to end up with multiple copies of certain dependencies because Microsoft&#x27;s answer to dependency hell was to let developers ship their dependencies with their product and not have to care what everyone else had. This is extremely space inefficient and can make for ugly under the hood management but it works very well. The author misses that in his article because he just measures the size of an installer, often Windows software ships not as one file but as many and the install.exe merely orchestrates the process. Again, its all about where you place your complexity. In Windows world the complexity is rarely encountered. Apps get to bring their baggage with them and decide where it all goes. This means program files can get ugly and inconsistent and you may have to learn the behavior or individual software but it usually works the first time.<p>&quot;The Current State of Backwards Compatibility&quot;<p>I have news for you. Linux&#x27;s biggest problem here isn&#x27;t that new revisions break compatibility. Its that old versions can become unavailable. The repo model of software distribution lends itself to &quot;link rot&quot; Load up an older version of Ubuntu and it cant talk to the repos anymore. The servers are gone. And since until recently almost all software was distributed this way and managed by a package manager you effectively can&#x27;t get software working in old Linux. Software preservation becomes monumental if not impossible. With older windows versions, if I have the install media whatever form it may take then I can install and use the software because it shipped with all of its dependencies included. No nebulous server required. DRM notwithstanding of course.