Tuesday, January 5, 2010

Lost time

I wonder why after so many years, popular Linux systems like Debian and Ubuntu are still such absolute crap to work with?

I learned to program on a AT&T 3b2 multiuser UNIX System V box. No special graphics, not even a good X desktop for it, just character based terminals. Yet it worked. Doing things like installing software... um... it worked. I just spent the past two hours pissing away the time trying to get Debian to install a package with apt-get, only to get roadblocked with errors about GPG key validations and packages which couldn't be found.

If I had another forty to sixty hours of my life to piss away finding the right update sites and obtaining the right GPG keys, and the right how-to to install them, maybe I could actually follow through on the Python Fuse tutorial I was going to do. But I don't. And here is the crux of the problem with Linux: it offers the false economy of free software in exchange for a huge tax upon your time spent learning about and working around gratuitously meaningless problems. It isn't that things don't just work -- so often they do not -- but the distro makers are engineered the environment to break spontaneously by introducing dependencies that have to be updated manually.

Now, I used to support clients with UNIX machines in mission critical applications. Learning how to fix things is what I did. But at some point, you have to be able to rely that the components you're putting together aren't themselves carrying latent faults by design. Debian's update capabilities are nice, but the system has no capacity to pick up that GPG keys have changed. Also, there's no obvious authority for saying what the update site list should contain. Apparently sites change, and the keys do too; that drift over time effectively breaks a system in place. The user's system cannot be updated without a repair, yet the breakage had nothing at all to do with changes to the system itself.

My goal was simple: to run a python program. I didn't want to fuss with updating the system, but I needed the Fuse package and the Google python bindings. Unfortunately, the GPG keys can't be validated. Why is this even an issue? Didn't someone know that the keys would change over time? Are you really going to expect users to jerk around with GPG when that is about as far removed from their daily problems as you can get? To an Ubuntu user who isn't a Debian monkey fixing such problems is a recurring cost-prohibitive proposition. Proposing that a system as fragile as this be used as a production Desktop solution is not just silly, it violates engineering ethics.

Update: I eventually did get the keys updated, by way of some merciful hints by a few friends. Following up, I found two other unrelated issues that followed a similar anti-pattern, arising because Ubuntu keeps making things easier by removing or moving configuration files. Such is the slipping sideways of progress.

No comments: