@mia @zleap @piggo

I couldn't disagree more. Every Linux distro I've used (excluding dom0 of Qubes OS, which is Fedora) has used apt, and it does dependency trees amazingly. The *entire* point of apt is to automatically link dependencies to their respective packages, and they are automatically handled during installation and removal. If one wants to mark as manual, so they aren't handled by apt, just use `apt-mark`.

@inference@pleroma.inferencium.net @zleap@qoto.org @piggo@piggo.space the point is that apt is extremely bad at handling cases like, for instance, conflicting library dependencies, which is in part due to the packaging tools used by debian, but also because apt’s dependency solver is not up to par. other distros use SAT solvers, which are usually faster and better at solving complex scenarios, but also can provide better explanations and suggest more reasonable solutions to the end user.

of course another problem is that these problems occur so frequently in debian-distros in the first place. that’s because the packaging infrastructure does not handle deep dependency rebuilds, and also fails to ensure repository and mirror consistency (updates are not atomic, for instance).

@mia @zleap @piggo

Debian is also a stable distro, which is why there is a lot of focus on specific dependencies being available and allowed, while others aren't. Mixing them creates what is called a "frankendebian". I use Devuan (Debian without systemd) unstable and rarely encounter these issues. If you don't want a stable or highly fixed package manager, use a different distro which is a rolling release (Arch/Artix etc).

@inference @mia @piggo

I like the fact that Debian is stable, for the most part like the issue i had, it was easily fixable, just rather weird it happened in the first place.

However worthi giving it a mention as I am a probably a little clearer on why the issue is. SO in this case some library that xfce4-panel relies on.

@zleap @mia @piggo

Debian stable (and Debian as a whole, because unstable isn't designed as a rolling release, just testing) is designed to keep packages and dependencies as stable as possible, hence the name.

Any changes could break the extremely well thought out OS, which is why Debian package versions NEVER change the version number, they only append to it (1.0~debian1 etc). If you don't want packages to be frozen, don't use a stable distro.

@inference@pleroma.inferencium.net @zleap@qoto.org @piggo@piggo.space it also causes problems when things *aren’t* quite frozen, like when they backport security fixes that necessarily break ABI, but then fail to automatically rebuild the packages that depend on that ABI, leading to crashes and other undefined behavior. this has caused so much trouble in the past that mpv chose to abort when it detected that it was being used with ffmpeg library versions it was not compiled with. instead of acknowledging the problem, debian maintainers chose to patch out that behavior and essentially blame upstream for writing bad software.

@mia @zleap @piggo

If you try to recompile Debian software from source, you'll see how difficult it is. There is a HUGE dependency graph inside the source code and it will refuse to build unless you go through Debian beurocracy or force it to ingnore it (Debian won't allow uploads if you force ignore).

Also, Debian security team isn't the best at backporting security updates, and stable distros should be avoided if security is your concern (CVEs aren't reported correctly by everyone, which is why projects such as systemd stopped using them).

If Debian is causing you these issues, it's clearly not the right distro for you. This is by design and is what makes Debian very well tested and stable, and why it's one of the most used server OSes. Enthusiasts are better off with Arch/Artix or Gentoo etc.

@inference@pleroma.inferencium.net @zleap@qoto.org @piggo@piggo.space opensuse rebuilds this huge dependency graph several times a week for tumbleweed. a single package change might cause thousands of rebuilds (until the build results no longer change and consistency is reached). there’s several stages of manual package review and automated testing involving VMs and image recognition (where the distro as a whole is tested in many different scenarios, as opposed to individual packages). debian has nothing like that yet (they’re still in the process of writing test scenarios for openqa, which is developed mostly by the opensuse project), and is instead relying on human review when they’re already short-staffed for package maintainers. i don’t buy the “well-tested” argument.

@mia @zleap @piggo

I don't have to argue with you about this, so I won't. All I'll say about it is I haven't had a single issue with dependencies unless I was trying to install a newer package (which was my fault for using Debian stable, anyway).

Ask around the internet and look at stories and comments of people using Debian and who have been running Debian for years, or even decades. Some people don't even know what "instability" means.

As I said, stable distros are not targeted towards enthusiasts, they are targeted towards businesses and servers in which stability is absolutely essential, and not updating packages. Debian allows backports of newer packages only if the dependencies of stable allow it, otherwise backporting is blocked. Again, this is by design and has had a massive amount of work put into it.

@inference @mia @piggo

I agree with you, I think what ever happened was clearly just a glitch somewhere that was fixable by reinstalling the package.

At some point I will grab a spare netbook, install debian 10 and see if I can figure out which of the 3 packages caused the issue.

@inference@pleroma.inferencium.net @zleap@qoto.org @piggo@piggo.space yeah, let’s not argue, then.

just one last thing: i think the main reason things are falling apart with debian and stable distros in general (nowadays even in the environments you’ve mentioned) is that software development has accelerated and grown to a point that one release every X months is just no longer a feasible model, even if you only care about security patches (as you’ve noted, distros aren’t particularly good at keeping up even with things that have been assigned CVE numbers, but there’s also the part where many upstream projects are not good at ABI stability either).

@mia @zleap @piggo

This is why I wouldn't recommend stable distros to people who don't need them. You lack security updates, and development has accelerated etc. Rolling releases keep their users up-to-date with everything. I only recommend stable distros for specific use cases in which the tradeoffs are worth it, such as servers and business environments.

However, I do not believe that as many pointless features need to be added to software, which is what I think the main issue is with the accelerated development aspect. People don't need 90% of the features in their OSes or packages/apps, and it just makes them bloated and less secure; this is slightly off-topic, though, but wanted to note it.

@inference@pleroma.inferencium.net @zleap@qoto.org @piggo@piggo.space that’s not the problem here.

and besides, other stable distros get this right—see openSUSE for example, which has more fine-grained dependencies for most packages than debian does, and also manages to do this with the tumbleweed “rolling” (more appropriately, snapshot-based and frequently released) distro.

@inference @mia @piggo

ah ok, It may have been a glitch somewhere doing that

@mia @piggo

I remember rpm from back in the mid 90s

package x needs package y to install

so installing package y
package y needs package x to install

hence the term back then of RPM hell