Slashdot Log In
Automatix 'Actively Dangerous' to Ubuntu
Posted by
Zonk
on Sat Aug 04, 2007 05:31 PM
from the don't-tread-on-me dept.
from the don't-tread-on-me dept.
exeme writes "Ubuntu developer Matthew Garrett has recently analyzed famed Ubuntu illegal software installer Automatix, and found it to be actively dangerous to Ubuntu desktop systems. In a detailed report which only took Garrett a couple of hours he found many serious, show-stopper bugs and concluded that Ubuntu could not officially support Automatix in its current state. Garrett also goes on to say that simple Debian packages could provide all of the functionality of Automatix without any of the problems it exhibits."
This discussion has been archived.
No new comments can be posted.
Automatix 'Actively Dangerous' to Ubuntu
|
Log In/Create an Account
| Top
| 284 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Illegal? (Score:2)
(http://del.icio.us/jvz | Last Journal: Sunday December 03 2006, @12:45PM)
Re:Illegal? (Score:5, Informative)
Re:Illegal? (Score:5, Interesting)
(http://stylus-toolbox.sf.net/ | Last Journal: Tuesday May 15, @11:50AM)
As TFA points out, it also gives dubious legal advice. Downloading MP3 codecs or Win32 codecs is far from a crime in the United States. For example, for the Microsoft-created codecs like WMA or WMV, Microsoft only requests that you have a Windows license in order to download them, but does nothing to prevent you from downloading them (WGA checks are not required, for instance.) It could be argued that as long as one has a valid Windows license, using them on Linux is not illegal. As for MP3 or other patent-encumbered codecs, it is a violation of patent law to distribute such codecs. Whether it is a violation of patent law to use or download these codecs without paying a license is a legal gray area.
OTOH, downloading libdvdcss may, in fact, be a violation of the DMCA.
Note that I'm not a lawyer, and if you're looking for legal advice, go pay one.
Re:Illegal? (Score:4, Interesting)
(http://nickstallman.net/)
Re:Illegal? (Score:5, Interesting)
(http://del.icio.us/jvz | Last Journal: Sunday December 03 2006, @12:45PM)
Re:Illegal? (Score:4, Informative)
(http://slashdot.org/)
1) The DVD-Jon case was in Norway
2) Consequently, it wasn't under the DMCA
3) It was the public prosecutor that tried and failed twice to convict him
4) They chose not to appeal it to the Supreme court, but only because there was no point
5) Since then, Norway and the rest of EU has been forced to adopt the EUCD aka euro-DMCA
6) Nobody has really tested the current law after the EUCD, at least not here in Norway
Re:Illegal? (Score:5, Insightful)
"illegal software" installer
and not
illegal "software installer"
Your sig is wrong (Score:4, Funny)
(Last Journal: Friday December 01 2006, @10:51AM)
Second, towards the end of the relationship, some have been VERY good at blocking pop-ups. All have been good at creating pop-ups. So, I would say that your sig is incorrect.
Re:Illegal? Misleading and Misconstrued FUD (Score:5, Informative)
(http://robots.org.uk/)
Re:Illegal? Misleading and Misconstrued FUD (Score:5, Funny)
(http://slashdot.org/ | Last Journal: Tuesday November 07 2006, @05:52AM)
Re:Illegal? Misleading and Misconstrued FUD (Score:5, Insightful)
(http://www.clowersnet.net/~krc/ | Last Journal: Wednesday January 10 2007, @08:40PM)
If you were to learn Linux you would not need Automatix,
FUD (Score:1, Informative)
Re:FUD (Score:5, Funny)
(http://larslindqvist.net/)
Illegal software installer? (Score:1)
Am I missing something here?
Re:Illegal software installer? (Score:5, Informative)
The important thing is that it's a stupidly dangerous (to your system) piece of software, that most members of the Ubuntu community are trying to inform everyone about. A lot of community sites swear by it, and when anyone argues they give the 'it works fine for me' argument.
This is not the mentality we want to have as a linux community. The automatix team refuses to make their software better, and launced a few all-out assaults on the communities that warn against it. Even going as far as to say (on their website, up until a few months ago) if you go ask help for automatix in their IRC channel, and claim that the people in the ubuntu channel sent you there, they (automatix team) won't help you. Which is stupid in and of itself, but that's the mentality that the automatix people have exhibited time and time again.
Because of this, and in some random attempt to clear their piece of software (and argue about it's proper terminology whether 'package manager' or 'packaging script' or whatever), and to get their lead developer (arnieboy) unbanned from the ubuntu forums (for trolling, more or less), they went to the Forum Council and petitioned, the forum council rejected some stuff, and said that they shouldn't make a decision on the technical merits (since they're not technically qualified or whatever). I imagine this is the fruit of their lack-of-verdict, someone higher up (who was qualified to assess its technical merits) finally took a semi-official look.
I wish I had links for the meeting, here it is: https://wiki.ubuntu.com/MeetingLogs/ForumCouncil/
Re:Illegal software installer? (Score:5, Funny)
(http://plaidphantom.livejournal.com/)
I wish I had a new car.
No? Dang, it's just you.
Old News (Score:5, Informative)
Re:Old News (Score:5, Insightful)
(http://www.evanmorris.com/)
Re:Old News (Score:4, Informative)
Software? Add/remove programs and synaptic cover this in a way which is far more simple, centralised, consistant and user-friendly than Windows. Software management under most distros is about as good as it gets (e.g. yum, apt, etc). Codecs I've already covered.
You seem a little misled by these issues anyway. Stop by in your distro's IRC channel and they'll help you through it.
I think it screws up when upgrading. (Score:5, Interesting)
But I noticed that all the Ubuntu distros, which it is installed upon, get a range of problems with upgrading to the next release of Ubuntu.
Automatix is not as necessary as it once one, codecs are done by Ubuntu itself in the meantime - Automatix was good two years back when it was a PITA to get DVDs and mp3s to play without editing files and going crazy on the command line.
It still is nice to use to install some programs like virtualbox, but the problems it causes are not worth it.
Re:I think it screws up when upgrading. (Score:5, Interesting)
Re:I think it screws up when upgrading. (Score:4, Insightful)
(http://del.icio.us/jvz | Last Journal: Sunday December 03 2006, @12:45PM)
Re:I think it screws up when upgrading. (Score:5, Informative)
Re:I think it screws up when upgrading. (Score:4, Informative)
Re:I think it screws up when upgrading. (Score:5, Informative)
(http://jlarocco.com/)
To get Flash working on 64-bit Linux, try searching your distro's software repository for "nspluginwrapper". Technically it's a bit of a hack, but from a user's perspective it's fairly transparent at getting 32-bit browser plugins to work on 64-bit platforms.
Debian, at least, has it.
Also on Debian, to get MP3 and video codecs add http://www.debian-multimedia.org/ [debian-multimedia.org] to your list of repositories, either in the Synaptic GUI, or in /etc/apt/sources.list. It's been a while since I first started using it, and I think you might have to reinstall or upgrade some packages that depends on the codecs, but after it's setup it works just like the official repositories.
warez? (Score:3, Funny)
Could someone clarify why it is illegal? (Score:2)
(Last Journal: Monday February 03 2003, @08:59PM)
Why? (Score:4, Insightful)
(http://www.foobarsoft.com/)
I read this while it was in the Firehose, and came up with one question: Why?
What would this tool provide above apt and dpkg? A graphical way of installing programs? There are front ends for dpkg and apt like Synaptic that don't have any of these downsides. Is this just to get things like some of these codecs? That has always been available through other package repositories. You just add a line to the config file (or use a program like Synaptic which lets you do the same thing) and all those packages just show up and work great.
I could see it a bit if it helped with commercial applications (like Click-N-Run does). But reading this stuff I just wonder... what was the point of using a program like this on a Debian based distro? Even with it's faults, even Yum makes these seem quite unnecessary.
So I ask: has anyone used this? Why?
Re:Why? (Score:5, Informative)
(Last Journal: Monday January 08 2007, @02:45PM)
Automatix is a utility that automates the installation of a bunch of software that is considered "must have" for people just switching to Ubuntu. For instance, it installed Firefox, mplayer, wine, DVD playing software, and multimedia codecs. (Actually the installer would just give you a list of things you could install, you select the ones you want and click "next.")
I don't really understand why this is being characterized as "illegal software." The packages are already in the usual repositories. The utility would just automate the installation for you. If you live in a country where installing one of those packages is somehow illegal (is this actually the case?), then that's your responsibility. The tool is just an automator intended to ease the transition for new users. It really provides nothing above and beyond the standard packaging interface, except that it was easier (in some people's opinion) to tell new users "install automatix" rather than telling them to open the package manager and list the software they should install.
In any case, the whole argument seems rather pointless. Automatix was created a few years ago, at a time where installation of things like multimedia codecs was perhaps non-obvious. New users were flooding forums with repeated requests like "my mp3s don't play! why?" and "how can I play DVDs on this Ubuntu thing?" Automatix was created as a simple response to that.
In the meantime, Ubuntu has, from what I can tell, cleared up these issues. Installation of codecs is straightforward and pretty obvious. The package manager is very user friendly. In short, there is no need for Automatix. Basically, Automatix was an ugly hack. It's always been recognized as such, and developers have always discouraging people from using it. On the Ubuntu forums, the standard advice is no longer "install Automatix," since it is recognized to be a non-optimal solution.
So, in short... I think this issue has already passed us by.
Re:Why? (Score:5, Informative)
(http://www.ferrus.net/)
That stuff is exactly what the "ubuntu-restricted-extras" package is for.
Rather than screw around with Automatix, perhaps someone should post the following script instructions:
I really don't see how installing some random script off a website and then messing with a new GUI program is any easier than that.
"...could provide..." (Score:4, Insightful)
Automatix only exists because there is a need for it. If it's so simple to make the package provide the functionality, why hasn't anyone done it? Automatix seems to be the (only?) ones who have tried to do something that many people need.
Re:"...could provide..." (Score:5, Informative)
(http://ian.testers.homelinux.net/ | Last Journal: Sunday March 18 2007, @01:47PM)
They have. There's Debian-Multimedia [debian-multimedia.org], which has been around for a few years. I know there's one or two specific to Ubuntu, five minutes Googling will probably find one. I've been using D-M for years now and have not had a problem. Automatix is an ugly hack and should be avoided at all costs.
I never understood (Score:2, Insightful)
(http://sourceforge.net/projects/slipfighter)
Re:I never understood (Score:5, Informative)
(http://robots.org.uk/)
Illegal? (Score:5, Funny)
(http://www.broadcastdoc.net/)
Automatix not needed anymore (Score:3, Informative)
(http://datanytt.no/)
Money quote (Score:3, Insightful)
(Last Journal: Thursday February 14 2002, @06:04PM)
Duh
Slashdot Spin, as per usual... (Score:4, Informative)
(http://opensourceme.blogspot.com/)
The article is a technical crictism of Automatix, how it doesn't follow proper package rules, etc.
This is the conclusion to the article, which sums it up pretty well
Automatix is barely needed anymore. You can do just about anything through the standard repos these days.
Re:Slashdot Spin, as per usual... (Score:5, Informative)
(http://www.theantix.org/ | Last Journal: Tuesday April 12 2005, @02:47PM)
Incorrect. Distributing w32codecs and other proprietary software without permission violates traditional copyright law, not just DMCA provisions.
Re:Bigger Question (Score:4, Insightful)
Mr. Stallman and the FSF's approaches, that software patents are a bad and evil thing, and that we need to protect ourselves from licenses that deny us the rights to use or modify our computers to do the things we want, continue to be a source of excellent guidance on these issues. The MP3 patents are a classic example of where software licenses break down: they not only are used to reward the authors, but to actively prevent other competitive use of related or improved products.
(jesus fish here) (Score:5, Funny)
You wish your system had security like that.
One of the many reasons I moved back to Fedora... (Score:1)
The core value of making Linux easier to manage for the masses is a great cause and you can see many distros making huge gains in usability thanks to the popularity of Ubuntu. That said, the current state of the community and user made docs has gone down over the last year, let's hope comments like this turn it around as I really miss my apt-get (and yes, I know there is an apt tool for RPM distros, but when in Rome...).
What about EasyUbuntu? (Score:2)
(Last Journal: Sunday July 13 2003, @10:38AM)
Seems to have the same goals - but does it have the same issues?
TFA in 4 words (and a link) (Score:2)
Medibuntu (Score:5, Informative)
Ubuntu has its own problems (Score:2)
(Last Journal: Thursday September 30 2004, @01:33AM)
I recently installed a 7.04 system and I found that:
1. The version of RealVNC is broken and possibly insecure.
2. The CDFS-src package is broken, and has been for months.
There are bug reports on both of these issues, yet it does not seem that the Ubuntu team has any interest in fixing them.
3. There does not seem to be any good and easy way to install a firewall. Red Hat seems to have a simple IPTABLES firewall installed as an option in the installation process, why can't Ubuntu do this?
There may be other problems, These are just 2 that I have found. Also my 6.06 LTS system has been unable to connect to open wireless networks since upgrading from 5.10.
So: my message to Canonical is: get your own house in order. Only then should you criticize third-party solutions.
how bout making dist-upgrade work right... (Score:3, Interesting)
(http://members.xoom.com/ikekrull/)
I've been running Ubuntu since Hoary, and while i can usually upgrade to new versions using apt dist-upgrade or the ubuntu-supplied upgrade-manager, it has never worked flawlessly. and always required manual searching of the forums and config-editing to get things working again. With the lastest 2 upgrades, Dapper->Edgy made my system unusable after boot due to X problems, and Edgy-> Feisty broke my virtual consoles.
If Canonical themselves can't make an update system that works, how do they expect Automatix to do it?
I was with him up to this point (Score:2)
(http://www.codepunk.com/)
I hit this.
The current design of Automatix precludes any reasonable way to fix
some of these problems.
This is the point where I had to call bullshit, there is nothing that cannot be fixed.
Where are DAG and DRIES when you need them? (Score:3, Informative)
For excellent examples of just this sort of conflict and mispackaging craziness, take a good look at any of the Oracle installers of the last 8 years or so, or any of the hardware vendor's driver installation tools. Serously, most of them are not as bad as this, but lord, they're not good. This is why I worship the names of DAG and DRIES, the primary third-party RPMforge repository maintainers for the RedHat based world. They just do things right and set an amazing example for this sort of repository manager wanna-be.
Look at his conclusions! (Score:2)
"Automatix exists to satisfy a genuine need Yes, it certainly does.
"... in its current form Automatix is actively dangerous to systems" So far I've been lucky. But then, I've been working with Windows since Windows 3.1 so maybe I'm just used to having a dangerous system. I just installed iTunes on the Windows system and it's now failing to boot. Anything less hostile than that is an improvement.
"A more reasonable method of integrating Automatix's functionality into Ubuntu would be for the Automatix team to provide deb files to act as installers for the software currently provided. These could then be installed through the existing package manager interfaces. This would solve many of the above problems while still providing the same level of functionality." So ... do it!
automatix ubuntuforums.org discussion (Score:1)
And the result was:
" The following errors occurred with your search:
1. Sorry - no matches. Please try some different terms.
The following words are either very common, too long, or too short and were not included in your search : automatix"
I'm just a stupid user trying to find information on ubuntuforums.org about automatix.
Warning: a little rant about multimedia thingies (Score:4, Insightful)
First I have to admit that it is community's fault, well, at least, part of it. Automatix is kinda one of those hacks for mass installations when you install distro on multiple boxes - no more, no less. It is a "hack" in a sense to provide urgent solution to a problem, but in long term more sane solution are required. I just wonder why those guys didn't submit those packages to universe/multiverse and dealed with it? (Ahhh, problem is w32codecs, but they are *illegal* anyway, in ANY country. Let me explain that later). What about commit yourself as community developer of Ubuntu project? Why working separately, instead of collaboration? Thanks for everything, Automatix finally let's use repository and community start to suggest Ubuntu "standard" way of doing things, via apt-get install gstreamer* or Add/Remove...
Second my ripe is that Automatix popularized solution, which works, but leads nowhere - therefore it is a hack without further direction (although, it is not Automatix devs nor users fault). In result, solutions which *might* be answer to problem, although not immediate, were left out from sight (because everyone uses ffmpeg + mplayer + xine combo, what a fun). We all remember Gstreamer and how it was in "cursed if you do, cursed if you don't" situation due of everyone blasting it and installing everything with Automatix instead. Yeah, it was very buggy, but they have won big fight with quality issues and moving faster now than before. They COULD escape such scenario, if there was enough community support. Instead of that, everyone hyped about Automatix and how it "deal with everything" - so in fact we lost at least several years to get us a proper media framework.
Thanks to Ubuntu devs, situation is much clearer now. You can install almost any set of codecs from Ubuntu repositories (Gstreamer plugins or Xine/ffmpeg combo, Gstreamer can use ffmpeg lib too) and they are working. But still lot of manuals and guides suggest just don't waste time and install Automatix. Strangely, but as a geek, I enjoy clearness of my system and install everything trough apt-get/synaptic, dpkg -i (or GUI eq.) and Add/Remove...
I am happy that more and more people use Ubuntu solutions for installation of multimedia codecs, not Automatix. It is also gives bigger test ground for Gstreamer/Xine/ffmpeg and bugs can be reported and collected to be submitted upstream.
In post scriptum, about w32codecs. I might be wrong, but w32codecs consists of hacked together dlls from various distributions of RealMedia, WMA, etc. etc. Licenses for those programs isn't even close to free distribution and doing that is violation of copyright. So they are not legally distributable in ANY form, period. In any country of the world which supports concept of copyright.
Some things not so benign. (Score:3, Interesting)
(http://sackheads.org/~cerebus)
What, he's never heard of a symlink attack [google.com]?
automatix has never been needed (Score:2, Informative)
(Last Journal: Thursday May 31, @06:32PM)
dpkg dangerous, then? (Score:2)
May well leave the system in an inconsistent and unbootable state, and
is carried out without warning. This is entirely unacceptable and will
leave a stale lockfile in any case.
If this can leave the system in an "inconsistent and unbootable state", then there is something wrong with dpkg; all package operations should amount to atomic transactions.
simple rule (Score:1)
(http://sadplanet.blogspot.com/)
install tar files in your home directory, always. if the program will not work like that it is probably bad anyway.
using these rules you will never screw up your ubuntu install, and you will always be able to upgrade without problems too.
Re:And the reason Automatix exists? (Score:1)
(http://alanbcohen.com/ | Last Journal: Thursday July 01 2004, @12:03PM)
Re:And the reason Automatix exists? (Score:5, Insightful)
(http://www.livejournal.com/users/mjg59)
Re:And the reason Automatix exists? (Score:4, Informative)
(http://www.livejournal.com/users/mjg59)
I also understand that users want to be able to play their MP3s, their DIVXs and use their ipods. The reason I do less for these people is that I have very limited time (I have a full-time job that's nothing to do with Linux development). Does that mean I want everything to be done via the CLI? Am I ignoring the needs of users? Do I have a fundamental misunderstanding of what people actually want to use Linux for? No, I don't think so. I just contribute where I can with the resources I have. I'd prefer to be able to solve all of these problems, but I'm limited by actually having to do other stuff with my life.
Re:And the reason Automatix exists? (Score:1)
(http://www.8-bitdesign.com/)
However, in the newest version of Ubuntu (Feisty Fawn, released in April), clicking on an unsupported filetype (such as an MP3, or AVI) brings up a dialogue box which A) Tells you that this codec is not supported, B) Offers to search for and install the codec for you.
I think this is the best trade-off, doesn't involve the CLI, and is something that my mum could easily work around. So actually, at this point, I don't see much reason for Automatix to exist.
Re:And the reason Automatix exists? (Score:1)
(http://carnagepro.com/)
If the child never has to learn to walk why would it bother.
make
make install
For you anal security types
make
su
make install
I'll go now and leave this for the mods
Re:And the reason Automatix exists? (Score:3)
Re:It begins.... (Score:2)
(http://penguin.lvcm.com/)