[maemo-developers] Repositories mess: conclusions and actions

[From: Quim Gil]

On Thu, 2007-10-25 at 20:03 +0100, ext Niklas Höglund wrote:
> I fully agree that Zero Install is a good fit for this device.

I know nothing about this technology but let me be stupid and say that
it looks like Zero Install is a good solution for a problem we don't
have in the tablets.

http://0install.net/


> Anyone can install software
> You don't have to be the administrator (root) just to install a     
> word-processor [ more ]

This is not a problem since by default anybody with a tablet in the
hands can install software.

> Anyone can distribute software
> You don't need to be blessed by a distribution (or anyone else) to be
> part of Zero Install;
> The system is completely decentralised [ more ]

This is not a problem since any web page can point to a one-click
install hosted anywhere calling deb packages hosted anywhere (else).

> It doesn't matter whether software is installed or not
> You just run it. Zero Install handles the rest (downloading and
> caching as needed) [ more ]

>From a user point of view, "installing" means "download + press ok +
wait a moment + go". It looks like the user experience wouldn't change,
and in any case isn't bad at the moment (if the app works and the
dependencies are satisfied etc).

> Security
> If one user downloads a malicious program, other users aren't
> affected; 
> Users can share downloads without having to trust each other;
> Installation does not execute any of the downloaded code;
> Digital signatures are always checked before new software is run
> [ more ]

The "other users" is not a problem since the main use case of the tablet
is a single user system. Digital signatures should be also in place for
packages in extras. Some kind of review to avoid malicious software in
extras would be in place. Of course people can download software from
somewhere else, but I guess they could also step out of the Zero Install
process anyway and get whatever software they found.

-- 
Quim Gil - http://maemo.org