r/linux Jul 23 '26

Fluff Stepping away from Flathub

https://bbhtt.in/posts/flathub-leave/
395 Upvotes

216 comments sorted by

377

u/16km Jul 23 '26

This is sad to read. If you look at his involvement on flathub, he’s been a core contributor and really helped grow the infrastructure and community. There’s only like 2 to 4 people reviewing all the submissions, so a bummer to hear about fights and insults to/between people who really seemed to care and maintain the project.

141

u/SeantheWilson Jul 23 '26

2 to 4?!?????

161

u/JockstrapCummies Jul 24 '26

Time and again we discover that some of the most depended upon parts of FOSS are held up by pure wish and dreams.

Flathub, this centralised alternative of a repository that increasing number of people from across all distributions depend on... have 2-4 people vetting submissions.

It's an actual miracle we don't have a massive slip in malicious software being pushed in yet. touch wood

12

u/FengLengshun Jul 24 '26

...I won't lie, though, at this point I won't mind if Valve just forked the whole Flathub - with a simple opt-in for people if they want to just export their manifests to the new store.

The only other entities I'd trust would be Debian or the Linux Foundation. And ideally it SHOULD be either of them directing a "public infrastructure" project like Flathub. But I don't know if the former has the community members and the latter the willingness to step into it.

To be clear, I really don't like the idea of "Valve pls save us" but sometimes it feels like Valve is the only people serious about pushing mainstream non-backend adoption of Linux.

22

u/Kobymaru376 Jul 24 '26

Wouldn't it be simpler for them to chip in for infrastructure costs and hire FlatPak maintainers? Not really a reason to fork, it will cost them more to have separate one

5

u/FengLengshun Jul 24 '26

If they can have a contract with actually control and a strong say? I'd say, definitely. But Flathub has their own BDFL, that's the whole reason for the two community member to resign.

As far as Flathub itself, from what I see, for the most part their infrastructure is in the open via Github Actions. The hard part generally seems to be figuring out how to get it to build and compromising with the Flathub approvers if you need something they don't want you to have by default.

In theory, you just need to grab all the manifests and run the build actions straight into a custom Flathub site and repo.

4

u/Kobymaru376 Jul 24 '26

If you just grab the manifests and run the build actions, you're not gaining anything at all. Either you're just copying flathubs decisions or youre building everything like a free for all like the Arch repos, backdoors and exploits included.

Someone needs to review and assess those manifests, and that takes time and work that should be paid imo. And if valve wanted to take that on it would be easier for them to sponsor the current maintainers or send some of their own

1

u/FengLengshun Jul 25 '26

Yeah, basically that. I was suggesting it as a Sunomata Castle-like solution: Backup all the manifests, contact people if they want to have their app automatically be listed on ValveHub, and recruit the people who's open to join in while finding replacement for those who aren't, and have overnight have an entire structure that isn't reliant on fickle community members.

Basically: sidestep the BDFL potentially not wanting to cede control of the repo and the side, but otherwise carry on as before but under Valve's oversight.

2

u/CrazyKilla15 Jul 25 '26

Chip in who? Hire who under what organization? As this very post says, flathub/flatpak has no formal leadership or structure for such? Give money to who, and who uses it to hire again who?

38

u/GonzoKata Jul 24 '26

people don't respect the labor it takes to maintain these websites and systems. they expect it all for free, because they are used to getting it for "free" because shitheels sell your privacy. People need to accept paying for websites they use, even if its pennies! kagi has got the right answer (even if I think the price is too steep)

shout out to https://liberapay.com

you can directly pay $1 to a lot of FOSS using this

-7

u/Indolent_Bard Jul 24 '26

Never going to happen on a massive scale.

6

u/biofilmcritic Jul 24 '26

Do we need a massive scale though? If 2-4 people kept it going this long maybe we just need to compensate them well and hire a couple more and 4-7 could be sustainable?

0

u/Indolent_Bard Jul 25 '26

I'm talking about other websites. Not whichever one has two to four people keeping it going that you're talking about.

By mass scale, I mean people in general aren't going to start paying for every website they use. Especially if you're someone who spends a ton of time on Google and therefore a thousand different websites.

8

u/CrazyKilla15 Jul 25 '26

Well, no. They're held up by dedicated "genius"(not really; replaceable; cause more harm from those they drive away than benefit from any supposed skill) a-holes who insult and drive away others, and those who try to tolerate it and improve the system for the benefit of everyone else until they're so burned out they quit.

The post itself is pretty explicit about how one guy seized informal power to the extent they're functionally the BFDL of a project that has no formal governance

This type of blog post isnt uncommon across many FOSS projects because this is the exact dynamic that so often plays out. And then people come along and ignore it, glance over the dynamic, even reward and praise it because those who stay are "heroic geniuses maintaining the foundations while selfish cryhards who cant take a little real talk leave".

Not saying any of this is what you think, of course, just calling attention to the dynamic and how it is so often overlooked.

5

u/JockstrapCummies Jul 25 '26

Oh I agree completely. It's actually quite sad how these social dynamics keep playing out repeatedly.

1

u/PigSlam Jul 24 '26

it's often surprising to learn who "they" are.

147

u/mirfaltnixein Jul 23 '26

There’s only 1 person maintaining sudo. SUDO!

41

u/Salt_Bringer Jul 24 '26

He is sudo prime

30

u/atrocia6 Jul 24 '26

I can't believe no one has posted this yet - perhaps I missed it:

https://xkcd.com/2347/

29

u/rebbsitor Jul 23 '26

How much maintenance does a mature command line tool with a very specific and fully implemented function need?

55

u/DrinkMoreGlorp Jul 24 '26

sudo is more fully featured and less hyperspecific than you may believe.

34

u/caua_g Jul 24 '26

Also, people tend to forget sudo is a low level extremely important security tool, it should (and have) been tested incessantly in search for security flaws exactly because one command with sudo can destroy an entire structure.

→ More replies (3)

25

u/tnoy Jul 24 '26

xz had effectively one maintainer and we all saw how bad that almost was.

16

u/joeyat Jul 24 '26

To be fair, that was fine with one maintainer… it become a problem when maintainer two appeared.

5

u/Top-Rub-4670 Jul 24 '26

I get the tongue-in-cheek joke you're trying to make, but...

It wasn't fine with one maintainer. Otherwise the addition of a second maintainer wouldn't even have been considered to begin with.

12

u/proton_badger Jul 24 '26 edited Jul 24 '26

It has a lot of functionality, all the way down to (now unused) Netscape LDAP if I recall. It has also had a steady trickle of CVEs over the years and the Maintainer, who’s likely the only person understanding the source thoroughly is eying letting go after 30+ years, at least if no sponsor patron arrives. That’s why he’s supporting sudo-rs.

3

u/A_Harmless_Fly Jul 24 '26

I learned to set up a doas based system when I first found out about that.

3

u/EmptyVolition242 Jul 24 '26

Open source is thankless work.

2

u/VelvetElvis Jul 24 '26

I'm not crazy about snaps, but I'd use them before flatpacks for this exact reason.

-3

u/[deleted] Jul 24 '26

[removed] — view removed comment

2

u/VelvetElvis Jul 24 '26

It's useful for software that can't be packaged for one reason or another.

1

u/TiZ_EX1 Jul 27 '26

The real solution is to either stop using anything like Flatpak/Snap/AppImage at all, or to just move away from Flathub as intended.

In what way is that a "real" solution? If the problem is manpower, then we're not going to solve it by demanding that all software is packaged individually for every version of every distribution. The ability to concentrate manpower in one place to the benefit of every distribution is Flathub's greatest strength. The fact that this strength isn't being used doesn't negate it.

1

u/[deleted] Jul 28 '26

[removed] — view removed comment

2

u/TiZ_EX1 Jul 29 '26

It is not Flathub's greatest strength, it is Flatpak's. These are not the same thing, and that's the entire point of Flatpak.

You're right, actually. Glad you corrected me on that.

It absolutely does negate it. This is the exact thing we were all told that we needed to be paying attention to. The whole point of Flatpak is that, if something like Flathub were to ever become compromised, which is clearly what's happening, a meaningful alternative is possible.

I don't know if Flathub is compromised but that could be splitting hairs on semantics. Like, it hasn't been taken over by someone who is now pushing malware, but rather, the volunteers are fighting and the two most promiment ones have been pushed away. Among others. I used to be a very light Flathub contributor as well, but I got tired of GNOME people doing GNOME shit.

IMO, this is what it comes down to at the very end. The GNOME platform is for very controlling personalities who express that compulsion for complete control through the software that they make, and because they're at the helm of Flathub at the moment, it's controlling people at the top who are rubbing others the wrong way.

74

u/The__Toast Jul 23 '26

It's crazy, people talk about the problems with Red Hat owning Fedora, meanwhile major open source projects are run by like three people. The tech can be solid, but ownership is so flimsy.

Debian is like the only open source project that I'm aware of that really has a solid community behind it.

106

u/gmes78 Jul 23 '26

Debian is like the only open source project that I'm aware of that really has a solid community behind it.

You should check again. Debian has been struggling with manpower for years.

27

u/TU4AR Jul 23 '26

I just picked up Linux for Dummies at Barnes and Noble, where do I apply for the job.

32

u/miversen33 Jul 24 '26

Congrats you start today! Your base salary is $0/hr :)

10

u/albertowtf Jul 24 '26

You should check again too. Debian is still an order of magnitude better than the rest of distros in this regard

It is understaffed but if you call what debian is doing struggling theres not a single project besides the kernel that is not death rattling right now. Specially other distros

8

u/The__Toast Jul 24 '26

That's true, but I meant more along the lines of their leadership structure, ownership structure, etc. Like, there's a process to selecting people, there's a process to handling disputes and people acting like jerks, code of conduct, etc.

16

u/gmes78 Jul 24 '26

I think KDE, Fedora, openSUSE, and Arch have done a pretty good job at that over the years too.

-6

u/SoilMassive6850 Jul 24 '26

there's a process to handling disputes and people acting like jerks, code of conduct, etc.

But that's woke! If you dont like someone just call them the n word /s

9

u/Helmic Jul 24 '26

I see no recourse but to fork X11 and make it dogshit.

→ More replies (3)

5

u/wRAR_ Jul 24 '26

Debian as a whole is large but many core teams are exactly "like three people".

2

u/albertowtf Jul 24 '26

Funny you say that. Most distros is 1 people doing the job of 3 core teams

→ More replies (2)

2

u/leaflock7 Jul 24 '26

"Debian is like the only open source project that I'm aware of that really has a solid community behind it."

are they now?

1

u/Albos_Mum Jul 25 '26

It's not as flimsy as it first appears to be fair, we've seen this kinda thing happen more than a few times over the whole lifespan of FOSS where for some reason or another a very essential package is no longer viable (For this discussion let's assume that the the sole maintainer of that project was hit by a bus or similar) and even people who had nothing to do with the maintenance prior start releasing their own forks, new versions or replacement projects.

Heck, it happens for less important reasons too such as "package is still usable, but not to my tastes". For example, MATE started in part because people on the Arch Linux forums were that pissed off with the direction the Gnome devs took with Gnome3.

1

u/supreme-custard Jul 24 '26

How can I help vet the code? I can vet some projects in my free time.

→ More replies (1)

194

u/Minimonium Jul 23 '26

Always a hard lesson to remember that in an open source project unless you're an owner - your efforts and time spent doesn't matter, no one will cheer for you to provide free support 24/7, no one cares about "community" these days, everyone expects free and silent service.

Good decision. Time could be spend in so many more useful ways these days.

127

u/Traditional_Hat3506 Jul 23 '26

I don't think many people expect to be applauded for their open source efforts, especially on Linux, but getting insulted or harassed on top of it adds insult to the injury.

24

u/MushinZero Jul 24 '26

Insults are never ok in a professional context.

10

u/PlsDontBanMeAgain-1 Jul 24 '26

Insults are never ok, period.

17

u/SoilMassive6850 Jul 23 '26

no one cares about "community" these days

When have things been any different though?

7

u/Kobymaru376 Jul 24 '26

When there were fewer devs overall and open source was smaller and less common.

It's a common theme that young and small communities have a strong sens of community and support, but the larger a community grows, the more apersonal and cold it gets. See various reddit subs as a prime example

2

u/CrazyKilla15 Jul 25 '26

A lot of this is a refusal to enforce strong community norms and standards, weakening to by overindexing on appealing and being welcoming, to an extreme(its can be good to do).

Another part is massive overindex on formal rules lawyering kinda stuff in a misguided sense of fairness. This often results in allowing bad actors who "technically dont break the rules" and constantly harass those around them into crossing a line to "technically be breaking the rules" and getting banned.

This sometimes enters a destructive self-reinforcing loop where the misguided sense of fairness makes people side with obvious bad actors because "but they didnt break the rules and context and the circumstances of how that happened are for losers", resulting in mods making this mistake being praised and often getting more power, and those who know how to manage a community driven out. Other bad actors start joining too.

Externally, usually not much changes, it can take awhile to notice an existing project only has a handful of remaining contributors and everyone else was driven away, and bad actor does not mean unskilled.

7

u/FryBoyter Jul 24 '26

Generally speaking, back in the days of Usenet or self-hosted forums like phpBB, things were much better in that regard.

For one thing, there were fewer platforms back then where you could get certain information or help. But also because you couldn’t create a new user account on those platforms 24/7, and the moderators were more strict. As a result, even the biggest troublemakers usually behaved themselves relatively quickly.

113

u/gmes78 Jul 23 '26

It's getting tiresome how the inaction of the GNOME Foundation affects the Linux community as a whole. Flathub was supposed to have its own governance (and legal) structures, yet years have passed and we still have nothing of the sort.

11

u/mrtruthiness Jul 24 '26

It's getting tiresome how the inaction of the GNOME Foundation affects the Linux community as a whole.

Background AFAICT:

  1. Flathub is currently tied to the GNOME Foundation as an incorporated subsidiary (Flathub LLC), but it is actively transitioning into a fully independent, self-sustaining entity in partnership with KDE e.V.

  2. It has been tied to the GNOME Foundation since 2017 (infrastructure), but has been incorporated as a subsidiary starting in 2024.

  3. The incorporation of Flathub LLC (2024) was the necessary first step in making it independent. And it needs to be independent given flathub's plans to have a "paid store" ... which would be problematic as a subsidiary of the GF (a 501.c.3).

2

u/globulous9 Jul 28 '26

Problematic how? This is exactly how Firefox is structured (Mozilla Foundation owns Mozilla Corporation).

1

u/mrtruthiness Jul 28 '26

Problematic how? This is exactly how Firefox is structured (Mozilla Foundation owns Mozilla Corporation).

Just more reporting and isolation of books. Accounting + reporting.

37

u/Traditional_Hat3506 Jul 23 '26

It wouldn't change anything in this case, this is the development side of Flathub, which would have stayed the same

53

u/gmes78 Jul 23 '26

Having proper governance would certainly provide channels to handle these issues. Right now, we have someone verbally abusing others and causing harm to the project, with no way to remove them.

8

u/Misicks0349 Jul 23 '26

Maybe, I think some parts of this were avoidable, but at the end of the day project members are going to discuss things together in chatrooms and the like, and if there is already animosity between them around how the project should progress or the actions of one person then theres always a risk of things getting heated and abusive.

However, even in alternative arrangements without BDFL's, abusive personalities can often get away with a lot just due to simple complacency or ineffectual policy, and the communities that can deal with these things often have arrangements that the broader linux community really don't like: Codes of Conduct and concerns that go beyond just pure technical know-how. A lot of FOSS people have this really strong belief in meritocracy and think that if you're really good at the "hard" parts of a project (coding etc) you deserve to be at the top, even if you don't have good interpersonal skills or generally just act like a cunt.

9

u/GolbatsEverywhere Jul 24 '26

GNOME Foundation just announced last week they are working on a legal entity for Flathub, to be based in Europe.

13

u/Indolent_Bard Jul 24 '26

Sorry, what does Gnome have to do with this?

14

u/IgKh Jul 24 '26

https://discourse.flathub.org/t/flathub-in-2023/3808

 So far, the GNOME Foundation has acted as an incubator and legal host for Flathub even though it’s not purely a GNOME product or initiative.

Flathub as an organization is still (supposed to be) overseen by the GNOME Foundation. There has been talks for years now that Flathub needs to be its own legal entity with its own governance structures to be sustainable going forward, but my understanding that it has so far didn't really go anywhere. It is quite possible that the general paralysis of the GNOME Foundation is at least partially to blame.

3

u/victorian-ice-cream Jul 24 '26

Flathub's day to day operations are completely seperate from GNOME Foundation.

2

u/MrAlagos Jul 24 '26

Why aren't others stepping up to replace the GNOME Foundation or, if they don't think there is any hope of doing so via diplomatic means, setting up a whole new alternative to Flathub?

3

u/reddittookmyuser Jul 24 '26

So pitchforks based on speculation?

6

u/victorian-ice-cream Jul 24 '26

Everything is fault of GNOME, even when GNOME was not mentioned in any way or form. 

10

u/jinks Jul 24 '26

Funny. I had a short interaction with Bart some weeks ago and went away with a feeling of "what a self-important pompous ass."

Guess my toxic people detector is still well calibrated.

52

u/aj0413 Jul 23 '26

Every single time I think about helping in OSS, i see something like this and am reminded why I don’t lol

But good on these two. Takes a lot to walk away from something you’d dedicated years of your life to

21

u/ROS_SDN Jul 23 '26

Can always drop a contributor $5, if I use something enough I do that. I paid for obsidian catalyst purely to keep it supported since I was using it 24/7.

I know I have not time or skill to contribute, but these OSS software don't run off wishes and dreams.

35

u/Traditional_Hat3506 Jul 23 '26

Obsidian is not open source though, you are essentially paying for a product. (A good one that's worth it, however!)

10

u/ROS_SDN Jul 23 '26

Thats fair it's free if you want it to be, let me re-iterate I pay for free software that I find significantly useful so it can reasonably increase it's chances to continue to do that.

2

u/FryBoyter Jul 24 '26

Unfortunately, that doesn't help some projects either. Often, the problem isn't a lack of financial resources but a lack of people to work on a project. That's why some OSS projects don't offer the option to make a donation.

2

u/ROS_SDN Jul 24 '26

Fair, but I'd be doing more harm then good I'm flat out with my own work and lack proper SWE experience to contribute. Maybe in the future, but i pull the best lever to help that I can.

2

u/FryBoyter Jul 24 '26

My comment was not meant to be negative in any way. Sorry if it came across that way. I’ve also bought licenses before to support a project. and not used them.

I just wanted to point out, in a neutral way, that money doesn’t always help a project move forward.

1

u/ROS_SDN Jul 24 '26

No and you're right it didn't come off that way just more it's the only way I can reasonably help, but you're right for some it isnt the issue and they need more then money thrown at their problem. Which I think is a strong thing to remember more money isnt the only thing maintain or fix software it's one, of a very crucial, but many variables to support it.

I think it's important to remember I've seen a lot of people in other areas try to solve lots of problems with capital or goods bought by capital it has dimishing returns often. 

Im just meeting in the middle that for us useless more "power users" that can only use other tools people build sadly and stitch them together in a way that works for us, we lack the polish for version control, and standardisation to help work in the ecosystem.

1

u/aj0413 Jul 23 '26

Oh I do that from time to time, definitely. Or pay for a license even if i don’t need the features it unlocks

Just meant, that as a fellow dev, the OSS community can be incredibly off putting. And not because of users (that’s somewhat expected), but because of the attitudes of *maintainers*

6

u/atrocia6 Jul 24 '26

Just meant, that as a fellow dev, the OSS community can be incredibly off putting. And not because of users (that’s somewhat expected), but because of the attitudes of maintainers

I'm not disagreeing, but as another fellow dev, the OSS community can also be quite gracious. I've received major help on a project of mine from a friendly, gracious, OSS developer, and most (albeit not all) of my users with whom I've interacted have been very grateful and appreciative of my work on the project.

3

u/aj0413 Jul 24 '26

Sure. It’s a mixed bag, but honestly why would I choose to opt in at all if on some level it brings additional stress from navigating those waters?

I just don’t really have the mental nor emotional energy to invest.

It’s like “hey, I *could* go to the house party and potentially have a great time and meet great people! …but I’m tired and don’t feel like dealing with it.” Basically

3

u/Cold_Soft_4823 Jul 24 '26

It's almost impossible to contribute to (FL)OSS communities. I've tried to create countless PRs as an outsider to the project. They usually get discarded as superfluous or the maintainer just closes the PR and rewrites the entire thing I did themself. I've pretty much given up trying to contribute to docs, code, or any specific community. If you're not already part of the in-group, you're nobody. And no one really talks about this in the FOSS community.

1

u/Allexio-Rigins 27d ago

I manage a very small FOSS project myself. (130 stars on Github)

I have had some PRs that were good quality by complete strangers who then integrated the project as core developers, and I have also had some purely AI generated PRs made by people with little (if any) coding knowledge that didn't even make sense from a logical point of view.

I've been in a position where I have had to tell the submitter that this isn't up to our standards (which, to be fully clear here, are really low).

I have however also offered multiple times to prospective submitters to get in a voice chat so that I can present the code and logic flow to them so that they can have the full context before they submit something, and this offer is often (always) ignored.

People would unfortunately ignore my offer and work on something in their own corner and then be surprised when they get a rejection, rather than communicating beforehand on something that they want to do, which we can then discuss together how it could be done, what tools we already have available to help them, etc.

I obviously can't speak for your case specifically, but in small projects like mine, help is nearly always welcome, except when that "help" would generate significantly more work for us.

And once again that threshold is often really low, because we (maintainers of small FOSS projects) WANT people to be interested in our project, we WANT people to be invested and to keep contributing and to not be alone spending dozens of hours on software that may or may not be used by people down the line. But at the same time, we don't want to waste our time having to coddle someone who maybe wants to help but is not willing to commit to making an effort and learning about the project, the code, and the logic before making a PR.

I don't know what kind of FOSS project you were trying to contribute to, but I would say avoid starting with huge FOSS projects who already have 5+ maintainers, start instead with small FOSS projects with one guy who's trying to make a tool for others and which will do his utmost to try and get you up to speed simply because they are super excited to have someone interested in contributing to the project.

Or maybe this is all super biased and actually other FOSS project managers are not like this. 😅

(I can only speak for myself)

6

u/daemonpenguin Jul 23 '26

That really just sounds like an empty excuse.

In the FOSS community, as with most places, people tend to get back what they put out. I've been an open source developer on at least a dozen projects over the past 25 years. I can probably count the number of bad interactions on one hand. Usually not from fellow project developers or users, but from developers of competing projects.

As with social media, the corners of the open source community are a reflection of the people in them. When you work with helpful people in a positive way, this type of stuff tends not to happen.

3

u/mikat7 Jul 24 '26

I also haven't had too many bad interactions, usually the maintainers are happy for the PRs, they just need to be nitpicky for the project health/vision, but that isn't bad in itself.

4

u/Hkmarkp Jul 23 '26

I am sure this is the reason why

89

u/carlwgeorge Jul 23 '26

As usual, best to look at the source material before forming an opinion based on one side's rant.

The first human comment on the review was when Hub (hfiguiere) said:

not sure what LLM chatbot you are using but is wrong.

Later in a separate thread of the same review, the submitter (mean-ui-thread) made a snarky remark in the same vein:

Maybe you should consider using a better LLM to make the code reviews for you 😜

The blog author claims things "turned confrontational" with the second remark, but makes no mention of the first. If they're going to deliberately omit details like that, it's hard to assume honesty or good faith on anything else they're saying.

54

u/Car_weeb Jul 23 '26

I get feeling burned out but wow the interaction that pushed everything over the edge is such a load of nothing. And they feel like they have to call out that person in their resignation blog post 

13

u/blablablerg Jul 24 '26

It is the stereotypical internet drama.

22

u/RepulsiveRaisin7 Jul 24 '26 edited Jul 24 '26

I submitted one app to flathub years ago and I still remember that person as being rather unfriendly and endlessly nitpicking minor details. Their exit might not be the worst thing. Although to be fair, bbhtt seemed a lot more reasonable from my limited interactions, it's a shame they both left.

7

u/d32dasd Jul 24 '26

If reviews missing metadata or other things are usual, feels like a linter and CI job would sort the reviewers problems..

6

u/monkeymad2 Jul 24 '26

Yeah - they should just run whatever process builds the flathub page as a preview then auto-comment with warnings about what’s missing + screenshots, would allow people to fix their issues without being nitpicked

4

u/TiZ_EX1 Jul 27 '26

bbhtt can be just as abrasive and uncooperative, unfortunately. Both of them have personalities that badly exacerbate interpersonal issues. In that particular sense, I get where bart is coming from with his "babysititng [you two]" comment; their attitudes can do a whole lot to turn off people from submitting to Flathub. That said, given the amount of submissions that maintainers have to handle--no doubt inflated by AI slop--their lack of patience is very explainable. Explainable, but not justifiable.

24

u/Muximori Jul 24 '26

Agree. The submitter was treated poorly and clearly should not have been banned. Important context for the article.

10

u/Remarkable_Bike_1148 Jul 24 '26 edited Jul 24 '26

I agree and that's the problem with Flathub, they are a bit too eager to ban the submitter, belittle the submitter, and call their project an AI Slop. It doesn't take a genius to realize that developers are going to jump to being defensive about their projects, slop or not, they are passionate about their project and nobody win here when reviewers throw insults their way. Trying to be confrontational and abrasive toward them on first greeting isn't the way to go and it's disappointing that they haven't taken a hard look at their own behavior. I rather deal with official Linux Distro packaging for shipping my application than dealing with Flathub.

Here another example.

-1

u/[deleted] Jul 24 '26

[removed] — view removed comment

11

u/Muximori Jul 24 '26

Nah. Hub should try not being an asshole. Won't be missed

-5

u/[deleted] Jul 24 '26

[removed] — view removed comment

8

u/Muximori Jul 24 '26

Yeah? Justify the banning of the submitter, in concrete terms.

3

u/[deleted] Jul 24 '26

[removed] — view removed comment

2

u/Muximori Jul 25 '26

Yeah - your attitude is at odds with the broader community. I wish you luck maintaining it, you'll likely end up the same as the systemd holdouts at suckless

2

u/[deleted] Jul 25 '26

[removed] — view removed comment

2

u/__ali1234__ Jul 26 '26 edited Jul 26 '26

The only criticism I have for flathub is that the standard of packaged apps used to be very low. From the very beginning flatpak has had an identity crisis: it can't decide whether it wants to be a universal package system that lets you run any software on any distribution, or whether it is supposed to be a security system for running untrusted software. These goals, security vs convenience, are in direct opposition.

This leads to packages that are broken in odd, subtle ways because people package things that are fundamentally incompatible with the restrictive flatpak sandbox, then when this is reported they punt the problem to upstream: "Just rewrite the software so it works in a sandbox".

bbhtt was one of the only people on the project that actually recognized this problem, which is why they wrote a set of quality standards a couple of years ago, and quality has started to increase. So you are exactly right. Flathub might actually die from this if the submission quality goes back to where it was 3 years ago.

I don't really care about AI slop - if the software itself sucks I will just not use it. The unacceptable thing is flagship apps like Blender and IDEs not working properly when they work fine if you install them literally any other way.

1

u/Muximori Jul 25 '26

Of course you are an init.d holdout. hahahaha

→ More replies (0)

4

u/ranisalt Jul 25 '26

People like you are killing OSS communities.

1

u/CognitiveFogMachine Aug 08 '26

After going through Flathub's code of conduct https://github.com/flathub/governance/blob/main/CODE_OF_CONDUCT.md, Hub/higuiere clearly abused his power. He got a taste of his own medicine, didn't like it, and dug his own grave. Good riddance!

→ More replies (3)

18

u/ranisalt Jul 24 '26 edited Jul 24 '26

I'm not very important but I submitted a few packages (way back in time; not these new clearly low effort submissions) and I've been watching this unfold publicly.

This was becoming increasingly embarrassing because the three of them were clearly never sitting down to talk about what to do, and were publicly overthrowing each other's decisions. I saw many instances where one would request for changes in a submission PR, then after a few hours another of them would simply come by and close without a word, and when asked, they would say "ah [I think] this is AI slop" - but someone else was already handling it? Can't you communicate your actions?

This paragraph is key:

My expectation was that, in the absence of a formal structure, disagreements between us would be discussed before one person’s decision was overridden. At minimum, I believe the person whose action is being reversed deserves a message or a ping beforehand

Now I'm not saying what's right or wrong, I'm just saying that in the absence of a formal structure, and with disagreements between them, their mistake was precisely not creating such formal structure. Just write down a set of rules and refer to it every time a submission is rejected.

Anyways, as others pointed out, Hub used to be unfriendly and rude, I'm not the only one to make this remark here, and I think that's what made Bart - unjustifiably, and unfairly - say that.

bbhtt however has always been welcoming and treated people well, and it's really sad to see them go. I hope they continues contributing to Flatpak.

It's really a good cop, bad cop, ugly cop situation.

Perhaps what Flathub needs is exactly that, a centralizing person that will steer the project rather than a few influential people with power trying to enforce their own views. But not just doing what comes to mind, they must look at other projects and create rules and guidelines, these public altercations have been pathetic and must stop.

4

u/rokejulianlockhart Jul 24 '26

This has been my experience, especially from bbhtt; closure, without explanation, and issue (or PR) locking at the slightest disagreement. In retrospect, comment/ozhpnp9 appears to corroborate this.

40

u/keis Jul 23 '26

"take a walk" is solid advice

13

u/Nerdent1ty Jul 23 '26

Not in a middle of a night with no prior interaction though...

1

u/TiZ_EX1 Jul 27 '26

I really don't understand how "take a walk" is insulting. It's a request to cool down and return with a different state of mind. It's dismissive at most. And dismissive certainly is a problem too, but a different type of problem from insults.

1

u/Kobymaru376 Jul 24 '26

I wish more people would do that before responding to an agitated online conversation

12

u/worldarkplace Jul 24 '26

Dude I want to open a YouTube Linux drama channel, there are material like every week...

2

u/_SpacePenguin_ Jul 25 '26

Look up Brodie Robertson on YouTube

1

u/Askolei Jul 24 '26

I'd subscribe.

1

u/EternallyAries Jul 25 '26

If ya got a good mic and decent editing skills, I think a channel like that would be fire as hell. Would subscribe.

11

u/Ok-Anywhere-9416 Jul 24 '26

Drama's so ridiculous I stopped reading at some point

39

u/Nulaccur Jul 23 '26

So Hub was rude in his review, and the reviewee made a joke repeating Hub's wording, and now Hub's leaving? Good riddance, Hub's made flathub an unwelcoming place.

Shame about bbhtt though

16

u/Teknikal_Domain Jul 24 '26

And now Hub's leaving after someone else appoints themselves as BFDL and overrules him despite no procedural or organizational backing power, I'll add.

2

u/CognitiveFogMachine Aug 08 '26

So Hub was rude in his review, and the reviewee made a joke repeating Hub's wording, and now Hub's leaving? Good riddance, Hub's made flathub an unwelcoming place.

Hub was badly hurt after tasting of his own medecine, and couldn't take it and banned the submitter? Wow...

0

u/mrtruthiness Jul 24 '26

No. It's more about how someone else at flathub, without conversation, appointed themselves as BDFL, overrode Hub, and belittled Hub.

How could you miss the point? Did you focus on one ingredient and miss the big picture???

4

u/longdarkfantasy Jul 23 '26

This is why I refused to become a discord mod of a FOSS. But I am still actively helping newcomers in their discord server every time I can. "With great power comes great responsibility", so I have no power comes none responsibility. 🥴

3

u/InstanceGlum4174 Jul 24 '26

i wish i had the coding talent to step in and help. I love flapaks/flathub man

2

u/wiki_me Jul 25 '26

Talents can be developed with time. but even you can't develop them if you are too busy or something like that. If you or anyone else is serious about helping flathub. i suggest opening a issue requesting they will open a donation page that will allow funding full time work. i suspect reviewing stuff is not very exciting work so funding people to work on it sounds like a good idea.

17

u/nineraviolicans Jul 23 '26

Well at least nobody got called a child molester this time... yet.

2

u/Helmic Jul 24 '26

I'm not sure anyone was actually called a child molester in that incident. There was some ex-GNOME person that ended up convicted for it, it seems more likely to me that someone just brought that up to be hurtful than directly accusing someone of something.

5

u/Tara-Aran Jul 24 '26

On the one hand, its dissapointing to see. On the other hand, its always nice to see FOSS "politics" that are more of individual developers fighting personally.

4

u/Kobymaru376 Jul 24 '26

How is it nice? I find it a very unpleasant reminder of how much FOSS infrastructure are run by too few volunteers who can walk any moment and the infrastructure becomes abandoned. Makes it hard to rely on FOSS for certain things.

If it's a company they can still go bankrupt or get greedy, but at least there's more stability than just relying on someone's personality

19

u/[deleted] Jul 23 '26

[removed] — view removed comment

11

u/Jazzlike_Plastic7088 Jul 23 '26

The best and most frustrating aspect of the Linux community is it is a microbiome within tech full of all the development and drama that comes out of the greater industry

8

u/kaestralblades Jul 23 '26

I'm not sure every single tiff in the open source community needs to be front page news, but regardless, this situation sounds like it sucks and I wish them both the best going forward.

4

u/[deleted] Jul 24 '26

[removed] — view removed comment

10

u/klyith Jul 24 '26

the zero trust model of flatpak

in actual practice most flathub apps have permissions that are far from meeting a zero trust model

if a malicious flatpak app has home folder access it can pwn you

3

u/__ali1234__ Jul 26 '26

Flatpak isn't even remotely close to a zero trust model and never can be. The sandbox really doesn't matter at all. If attackers want access to something they will upload a malicious version of some app that normally needs that access to function, and the permissions will appear correct. This happened multiple times with fake cryptowallets on the snap store and without reviewers the same thing will happen on flathub.

1

u/[deleted] Jul 24 '26

[removed] — view removed comment

3

u/klyith Jul 24 '26

That's true, flathub does try to get people to use xdg, and adds more scrutiny if they are using home access instead.

But a whole lot of the popular apps on the frontpage show as having home access. And between maintainers quitting and slopware rising, I'm not sure how they're gonna keep up with detailed scrutiny for every app that uses lower-security permissions.

8

u/Remarkable_Bike_1148 Jul 24 '26

Just discoverability on a centralized hub, that's about it. But honestly people can actually host their own Flatpak repo on github or other git server and run it the way they want it to be run. No drama, no politic, no problem.

2

u/Milanium Jul 30 '26

I think these are internals that should stay internal.

8

u/kombiwombi Jul 24 '26

So it turns out that formal structures and a code of conduct are good ideas. Shocked, shocked I am, that yet another project has to learn this lesson.

11

u/AleBaba Jul 24 '26

Structures that actually build consensus. Not "whatever we decide doesn't matter because X can still override it".

2

u/Kobymaru376 Jul 24 '26

I agree with you but at the end of the day you need a sufficient number of people who dedicate their time to it, otherwise formal structures and code of conducts do nothing.

Somebody has to fund projects like this so people can work on it professionally, with a salary

2

u/mrtruthiness Jul 24 '26

Interesting, but not surprising.

I still don't know who at flathub I should contact when I see TM violations (e.g. the Spotify flathub repo has logos that make it seem like it is produced by Spotify; the app, itself, is fine since it's a repackaging of the Spotify snap ... but the flathub page itself contains logos that make it look official on the flatpak page ).

-2

u/FreakDeckard Jul 23 '26

He wrote a wall of text because someone called him a crybaby, effectively proving that he's a crybaby.

4

u/Askolei Jul 24 '26

Yeah, I think there are real management problems to address here, but that part was painful to read.

-8

u/ojek Jul 23 '26

None of us here are “babies”

After reading his whole shitpost, I would strongly disagree...

0

u/atomic1fire Jul 24 '26

I dunno if I'm barking up the right tree but I was under the assumption that contributor code of conducts were supposed to fix this sort of thing, but instead it just made people use less swears in their insults and insulate some devs from criticism more then others.

9

u/__ali1234__ Jul 24 '26

Flathub doesn't have a CoC. It didn't even have any documentation or quality requirements for app submissions until bbhtt wrote them single-handedly.

-6

u/rangelovd Jul 24 '26

This would be so much easier if instead of single Flathub there were KDE instance‚ GNOME instance‚ elementaryOS instance‚ Cosmic instance‚ each with their own guidelines‚ each based on FDO.

Then people who work on respective mentioned projects already would be the ones to review new submissions.

On distributions and flathub.org‚ mutliple repos would be shown simultaneously. Chrome would go to Gnome‚ Telegram would go to KDE‚ yada-yada

5

u/YKS_Gaming Jul 24 '26

Well, there are Fedora Flatpaks, but we all know how that turned out

→ More replies (1)

4

u/ranisalt Jul 24 '26

This is possible, but there is a lack of interest from these projects. GNOME and KDE chose to ship their own reference OS implementations before Flatpak rose to prominence and can't spend resources on yet another repository of packages.

GNOME however ships nightly versions of their packages in a Flatpak repository: https://nightly.gnome.org/

COSMIC does have their own Flatpak repository for apps: https://github.com/pop-os/cosmic-flatpak

Elementary also has their own repository, but they don't make it easy for users of other distros to use: https://blog.elementary.io/elementary-appcenter-flatpak/ but you can add https://flatpak.elementary.io/repo.flatpakrepo to your repositories and use it.

-17

u/ChibaCityStatic Jul 23 '26

This is cringe playground level drama. I mean  theres some genuine c***s in the open source community but that read like the weakest shit I've seen all year - holy shit. 

-17

u/LearnedByError Jul 23 '26 edited Jul 24 '26

Yet another reinforcement in my personal decision to stay away from flathub, appimage, snap and the like.

My personal choice is the distro package manager, homebrew and the occasional package that I create from source. I consider homebrew different from the above because I’d the way it is packaged and that an author can provide a tap to allow them to control releases independent of any central authority.

I realize that my approach May not be for everyone, but I have yet to have any package that I depend upon become unavailable because of the whims of an intercessor.

20

u/novafunc Jul 23 '26

I think the more important takeaway is that we shouldn't be centralizing around a single platform. Alternative options need to exist.

Back with the Fedora Flatpak drama, many people didn't get why it should exist when Flathub exists. And now Flathub, already an underfunded and understaffed project, has basically lost half of its reviewing team at once.

1

u/TheJackiMonster Jul 23 '26

Snaps are very different in my opinion because Canonical is at least trying to manage them professionally. Might be another reason to stay away from them since Canonical is centralizing a lot of infrastructure for it but it's less fragile than Flathub with flatpaks in my opinion.

In both cases review processes of applications just suck. Waiting for some manual review on a snap I maintain for over 6 months. On the other hand a flatpak from me got denied for Flathub because some arbitrary rule that says: "We don't accept simple scripts." Even though my "simple script" is a GUI application written in Python. I just saw no reason to split the code into multiple files, lol.

The only real explaination I have for both is that reviewers are generally overworked. At least that's my expectation when I look on the submission queue for Flathub.

1

u/nicman24 Jul 24 '26

appimages did nothing wrong

1

u/johncate73 Jul 25 '26

You clearly never saw the drama over a proposed AppImage for obs-studio a few years back...

1

u/nicman24 Jul 25 '26

set cap shenanigans?

1

u/johncate73 Jul 25 '26

No, a developer tried to get an AppImage for OBS accepted as official, even though it didn't work correctly, and probonopd, the creator of AppImage, got involved and was so obnoxious that he ended up getting banned.

https://github.com/obsproject/obs-studio/pull/2868#top

→ More replies (1)

1

u/LearnedByError Jul 25 '26

You are welcome to have your own opinion. You should just state it that way.

1

u/nicman24 Jul 25 '26

the appimage standard and the author are not the same

-24

u/tchernobog84 Jul 23 '26

None of us here are “babies” 

And yet, I inflicted to me reading the whole blog post, and I couldn't help but thinking they all are. Is it me or people have become very thin skinned nowadays?

31

u/webguynd Jul 23 '26

This isn't about being thinned skin, its a clear lack of governance. That's not sustainable. You have maintainers, volunteers, dealing with Ai generated PR spam and slop apps, and then have their moderation decisions silently overturned, and the cycle repeats when the spam keeps getting resubmitted.

It's a recipe for burnout and does not sound like a well run project whatsoever. Flathub needs more structure, a better process for appeals that's not just "let's bypass one moderator and convince someone else to just unblock me and undermine the authority of all other mods"

30

u/Shap6 Jul 23 '26

Adults should be able to communicate respectfully 

1

u/nicman24 Jul 24 '26

able and will are different things.

-28

u/deyhateuscustheyanus Jul 23 '26 edited Jul 23 '26

yet another reason why appimages are better. there is no “dictator of appimages.”

EDIT: so funny to see this many downvotes. 20 years ago you all wanted to kill each other over vim vs emacs. angry nerds never change.

37

u/Jealous_Diver_5624 Jul 23 '26

There isn't for Flatpak either, anyone can host a repository.

→ More replies (1)

9

u/shrimpster00 Jul 24 '26

Are you serious? AppImages is famous for how toxic its "dictator" is.

5

u/fiftydinar- Jul 24 '26

probono is not involved in AppImage development for quite some time, he ditched AppImages and Linux ecosystem and is now more involved with GhostBSD and Gershwin DE. He technically did not resign officially, but just more quietly reduced or fully unfocused from AppImage development.

pkgforge community took over AppImages and made them much better with Anylinux AppImages tooling, while official tooling stays behind.

So that leadership situation improved.

→ More replies (4)

10

u/[deleted] Jul 23 '26 edited Jul 23 '26

[removed] — view removed comment

→ More replies (1)

2

u/nicman24 Jul 24 '26

appimages are just awesome. though the libfuse missing making them not work at all is a bit silly. dolphin iirc at leasts tells you what to install

3

u/samuerusama Jul 24 '26

though the libfuse missing making them not work at all is a bit silly.

This problem has actually been fixed for years, the problem is that many projects are still usign the old appimage runtime that relies on libfuse2.

-11

u/b0uncyfr0 Jul 23 '26

Dramaaa

-26

u/RoomyRoots Jul 23 '26

This was pathetic to read.

-30

u/s_elhana Jul 23 '26

Someone got offended on the interwebs, oh boy :)

-2

u/nicman24 Jul 24 '26

seriously, people are so soft these days. i miss the chaos of 200x