Automatix: A Disaster in the Making?

rickh · 08-04-2007, 01:52 AM

Since I see Automatix glorified as a great boon to the Debian family of distributions, I thought this post by Debian developer, Matthew Garrett might be of interest. I'm posting in the Deian forums rather than Ubuntu because Automatix is advertised as being available for Etch as well as Ubuntu. Of course no Debian user worth the title would use it anyway, but this should serve as a reference point when the subject comes up.

The blog did not provide a permalink to this post, so I'm going to quote the whole thing here.

Quote:

A while ago, the Ubuntu Technical Board were asked to take a look at Automatix. I've finally got around to doing so, and here are my initial conclusions. I'd appreciate any factual corrections, and note that at this point this is my individual opinion rather than any sort of official statement.

Automatix is a combination system configuration/package installation tool, aimed at making it easy for users to install features like graphics drivers, media codecs and software not distributed as part of the Ubuntu distribution. It is provided as a .deb file containing a python GUI frontend that calls out to a shell backend. The frontend parses an XML file which contains module descriptions and function names for installing and uninstalling modules, with these functions being part of the shell backend. An install module will typically check whether another package manager is running, and if not either install a set of debs or download and manually install a tarball. Uninstall modules generally remove the same software or clean up the manually installed files.

The following is a list of identified issues with the current version of Automatix - it is the result of a few hours of investigation, so may not be complete.

* Automatix is, in itself, a poor quality package which fails to conform to Debian or Ubuntu policy.

o It is inappropriately flagged as belonging to base
o Depends on essential packages
o Has a short description of more than 80 characters and no long description
o Provides no email address in the maintainer field
o Contains no copyright information in the standard locations
o Ships a TODO file as a control file
o Provides no man pages
o Ships files in /usr/etc
o Contains many files inappropriately flagged as executable
o Changelog is in /usr/etc/automatix2/ax_data ?

These issues are primarily cosmetic and in themselves are unlikely to cause any harm to the system.

* In debug mode, automatix will write files to your home directory as root. Again, more of an irritation than anything dangerous.

* Provides platform-specific data in /usr/share. Potentially an issue if /usr/share is shared between multiple architectures, but since Automatix is x86/amd64 only probably not a real problem.

* #!/bin/bash
#created by arnieboy
foo=`gksudo -u root -k -m "enter your password for gedit root access" /bin/echo "Do you have root access?"`
sudo gedit $NAUTILUS_SCRIPT_SELECTED_URIS

... appears to be an attempt to ensure that the user has sudo rights. This will break if timestamp_timeout is set to 0 in sudoers - gedit should be run directly from gksudo. This is repeated in more than one place. The assumption that sudo will not need to prompt appears prevalent throughout the code.

* catagory_data.xml - nitpick, but should be category

* "Please NOTE that downloading and installing w32codecs, libdvdcss2 and other non-free codecs without paying a fee to the concerned authorities constitutes a CRIME in the United States of America"

Somewhat dubious legal advice - the issue has nothing to do with fees, and isn't just limited to the USA.

* Automatix checks that other package managers aren't running at startup (by grepping for a static list of application names in the process list), but doesn't enforce this by carrying out any locking of its own. This leaves Automatix open to race conditions.

* if ps -U root -u root u | grep "dpkg" | grep -v grep;
then killall -9 dpkg
...may well leave the system in an inconsistent and unbootable state, and is carried out without warning. This is entirely unacceptable and will leave a stale lockfile in any case.

* function reloadnautilus {
killall -9 nautilus
}

... not actually used anywhere, but could potentially lose user information without warning.

* Most install functions contain a sleep statement for no obvious reason. They then call dpkg_check, which sleeps again. It's not at all clear what this is meant to be doing.

* Passes --assume-yes to apt-get, which will (as a result) happily remove packages without giving the user an opportunity to intervene. This is especially bad when removing Automatix modules - any package that depends on one of the packages being removed will also be uninstalled, even if the package was originally installed via something other than Automatix!

* Has no internal dependency management. Unable to keep track of why packages were installed, so prevents the removal of the multimedia module because that would remove sections of other modules without explicitly removing that module. Installing swiftfoxplugins will pull in several plugin packages, but removing swiftfoxplugins will not remove them even if nothing else depends on them. Also means that package installation and uninstallation have to be manually kept in sync - uninstall will not always remove all packages that were installed.

* Has no concept of file tracking, so will just remove entire directories. Makes no attempt to ensure that a user-installed version is not already installed in the same location, so effectively assumes that the /opt namespace belongs to it.

* Will remove Ubuntu repository packages in favour of tarballs with no warning.

* Setting ctrl-alt-del to open gnome system monitor will destroy any existing user configuration for run_command_9

* Installing streamtuner will create a world writable directory in /opt/ripped with no sticky bit, allowing users to interfere with other users' files.

* mplayerplugin moves totem plugin files to a backup, but does nothing to prevent package upgrades of totem replacing them.

* Only updates the java link after installing new java, not the rest of the java alternatives

* amsninstall installs tls libs that are never removed, copying over the ones in the tcltls package. This means that the md5sums in the tcltls package will no longer validate.

* sudo ln -s /usr/lib/libesd.so.0 /usr/lib/libesd.so.1 is really not such a good idea.

* ln -s /tmp/.esd-1000 /tmp/.esd looks like it'll only ever work for the first user on the system, and there's nothing to recreate it on boot.

* sudo sed -i "s/^vboxusers$.*$:$/vboxusers\1:$AXUSER/" /etc/group - assumes that the system isn't using some sort of user directory service.

* installs truecrypt suid root - not ideal, given its less than stellar security record

* Unmounts filesystems without checking to ensure that the unmount succeeded.

* Deletes lines from fstab and replaces them with device nodes rather than uuids.

* Includes acroread 7.0.9, despite the new Acrobat license appearing to grant no right to redistribute.

Conclusion:

Automatix exists to satisfy a genuine need, and further work should be carried out to determine whether these user requirements can be satisfied within the distribution as a whole. However, in its current form Automatix is actively dangerous to systems - ranging from damage to small items of user configuration, through removing user-installed packages without adequate prompting or warning and up to the (small but existing) potential to leave a system in an unbootable state.

The current design of Automatix precludes any reasonable way to fix some of these problems. It is attempting to fulfill the role of a high-level package manager without actually handling any sort of dependency resolution itself.

A more reasonable method of integrating Automatix's functionality into Ubuntu would be for the Automatix team to provide deb files to act as installers for the software currently provided. These could then be installed through the existing package manager interfaces. This would solve many of the above problems while still providing the same level of functionality.

In its current form Automatix is unsupportable, and a mechanism for flagging bugs from machines with Automatix installed may provide a valuable aid for determining whether issues are due to supported distribution packages or third party software installers.

Simon Bridge · 08-04-2007, 07:14 AM

I have always maintained that automatix, easyubuntu, and such ilk, are dangerous. I have seen them totally bunta perfectly good installs - the mention of flagging bugs from machines with Automatix installed is a good one. Similarly submitting debs for the package combinations.

Third party installers are also a dangerous trend ... it can social-engineer people into installing anything as these things operate with root privileges.

Lets hope the ubuntu wiki people have read this.

crashmeister · 08-04-2007, 07:56 AM

Don't understand why somebody would use all that stuff anyway.Everything those apps can install is in repos anyway.You just need to add them.It's an additional layer where things can go wrong and screw up your system in exchange for being to lazy to type into a search box.
There will be a lot more stuff like that popping up since Linux is getting more MSfied for the end-users as far as getting a system setup is concerned.Everybody is just used to point and click and worry about it later.

Also there are apps available now that a regular user couldn't (and most shouldn't) lay his hands on years ago because they were too expensive/complicated to install.Nowadays everybody just throws in there whatever looks like fun and doesn't feel like even looking at docs or seem to have the slightest idea what is going on.

rant off

JimBass · 08-04-2007, 11:58 AM

Crashmeister wrote:

Quote:

Linux is getting more MSfied for the end-users as far as getting a system setup is concerned.Everybody is just used to point and click and worry about it later.

Yeah Crashmeister, I have the same concerns over things like automatix. I started using linux in 2003, and abandoned MS completely in early 2004. In that time, I've seen a huge trend towards "simplified" installers. They certainly do allow somebody without sufficient skills to install a highly functional system. That is a blessing and a curse. Just like cheating on a test, the short term reward is usually not worth the long term cost (not understanding the subject material when it is finals time).

I don't think it is too much to ask people to create symbolic links in their mozilla plugins directory. I also don't think it should be too much to ask that they download the firmware for their wireless card, and place it in the proper directory for the card to work.

At the same time, if automatix existed when I did my first install of Dead Rat 9, would I have used it? Without a doubt. Most of the people who come to linux to "check it out" or try their hand at it are usually very proficient at running their window$ computers. They like to feel they have power/proficiency at their computer, and turning it on and not knowing where anything is or how to work with it is scary. Double click on this script, and you'll have full multi-media and your browser will handle .pdf and flash, or don't click on it and probably spend weeks searching the net to get it done yourself. Granted any one of us could probably accomplish the same thing in a just a few hours, but as a true beginner, you don't even know what terms to dump into google to find the "correct" set of instructions to accomplish what you want.

There was a time where meeting another linux user (at least here in NYC) was a cool bonding moment. You'd talk commands, distros, etc. Now when I meet somebody with the obvious penguin sticker on their laptop or a sourceforge t-shirt, we quickly get to distro questions, and its like, "I use Fedora 7 and I love it," or "I prefer Kubuntu to Ubuntu." Not that there aren't any people who have risen up from the masses that install those distros, but they by and large treat the command line like it is some archaic tool. Its fine to install any distro, just learn how to use it completely.

I have had one friend install Ubuntu on his media center laptop. I help him from time to time when he hits something that he can't deal with. By and large, everything he needs, he was able to get working on his own. I struggled mightily to get VNC running on that initial Dead Rat 9 install I did. It was an absolute nightmare. I warned him about that. He installed through synaptic, and it handled it just like in windows. He gains access to the :0 desktop through VNC, which was the holy grail of VNC when I last used it from linux -> linux. It has become almost a little too easy. It is now possible to run a functional *nix machine yet not have any idea how to fix problems. That wasn't the case just a few years ago.

Hopefully many of these new installers will dig in deeper than just getting a functional system and learn some of the real possibilities of their systems.

Peace,
JimBass

JackieBrown · 08-04-2007, 02:42 PM

Quote:

Originally Posted by JimBass

Crashmeister wrote:
but they by and large treat the command line like it is some archaic tool. Its fine to install any distro, just learn how to use it completely.

I love the repetitive quote from those users. "If I have to use the commandline then the Linux has failed."

They don't realize who many options their missing. More importantly they miss out on what usually amounts to less work.

hitest · 08-04-2007, 04:38 PM

Quote:

Originally Posted by JimBass

There was a time where meeting another linux user (at least here in NYC) was a cool bonding moment. You'd talk commands, distros, etc. Now when I meet somebody with the obvious penguin sticker on their laptop or a sourceforge t-shirt, we quickly get to distro questions, and its like, "I use Fedora 7 and I love it," or "I prefer Kubuntu to Ubuntu." Not that there aren't any people who have risen up from the masses that install those distros, but they by and large treat the command line like it is some archaic tool. Its fine to install any distro, just learn how to use it completely.

Peace,
JimBass

Well-said. That's why I love Slackware, Debian, and FreeBSD:-)
Agreed. Knowledge of the CLI is essential to successfully using *nix.
All of the damn GUIs slow your system down anyway. I've been happily using Linux since August, 2002:-)

crashmeister · 08-05-2007, 07:22 AM

Originally Posted by JimBass
Crashmeister wrote:
but they by and large treat the command line like it is some archaic tool. Its fine to install any distro, just learn how to use it completely.

I didn't write that - honors go to JimBass for it.
Actually I do think cli is an arachaic tool but it is the only tool with full control we got and if you want full control you better use it.

You got to understand that most people are used to point and click - if you ever did screw around even a little with support you know that it is unbelievable how little even people that are somewhat informaticsversed know what is going really on.
Actually you can't really blame them for it - the vendors created them that way because it is good for the vendor plus most admins like it that way too because less they know less likely they are to screw around with things (true or not - that's the reasoning many use anyway).

Of course every Linux distro is jumping on the point and click bandwagon,too (besides slackware I think - don't use it myself) because being popular has its perks - see Dell and Ubuntu.

Of course sometimes it's just a plain bad idea to try to lure the point and click crowd in with graphical installers and stuff - see Gentoo.

Problem with that approach is that many of the gui crowd just don't even check with a websearch or doc's before or after installing an app.Which is understandable if somebody is used to MS - there is not much sense in looking for doc's that really explain things for MS.
People like that will have to pay for support or stick to whatever comes preinstalled one fine day because everybody will get tired responding to obvious problems.

Question on VirtualBox forums:

Why is there no command line -how can I run vb headless?

How that guy will run a vm headless from cli if he can't even be bothered to find and read the manual right on the website is beyound me (also why I should go and paste the applicable sections for the lazy sob)

reverse · 08-05-2007, 09:31 AM

If you find a Linux user who "uses and loves" Fedora/Ubuntu/OpenSUSE/whatever, don't automatically assume he's never touched the command line. I used to use Gentoo until I got tired of configuring the Kernel. Then I switched to a distribution which does this for me.

Also: *I* don't think CLI is archaic.. take IRSSI for example. It's simple interface appeals to me more than all of it's alternatives' interfaces. Same for Mutt. I prefer opening up a terminal and issuing a mv/cp/rm/ls/whatever than starting nautilus and doing the same thing.

Unfortunately I guess the CLI is on its way to extinction.

Also: https://wiki.ubuntu.com/CommonCustom...15f2188d41f9e7

crashmeister · 08-05-2007, 10:21 AM

The cli has been around for a looong time and has of course it's places where it is much better suited for use than a gui but it is archaic ("from the beginning, antiquated, ancient, old")just because of that.

It is a statement to the sorry state of computing that there is to this day nothing that can fully replace it.
Think about it - you got CPU's that would have been a supercomputer a short while ago terabytes of RAM and can download 100 DVD's in a splitsecond yet if you want to get things done you log into a terminal and start typing.
They are talking about speech recog for what? about since OS/2 came out in the dark times or so? and still can't get that going.

Thats like a car that uses more gas every year going slower.

Okie · 08-05-2007, 01:16 PM

i would rather compile from source than use a third party package tool like automatix...

JimBass · 08-05-2007, 03:27 PM

So far we've have all of us bash (not /bin/bash) automatix and show excessive love for the command line. That's all well and good, but I hope somebody who uses/likes automatix posts in this thread as well. We've seen from rickh's original post that the things automatix does are rather inefficient and in several cases downright dangerous, but at the same time, if it were crashing people's systems left and right, I doubt it would be as popular as it is.

I'm certainly down for us "old-school" type folks to spin yarns about the way things "used to be", but I really would like to hear from the "other side" of the equation.

Peace,
JimBass

farmall · 08-05-2007, 06:07 PM

"It is a statement to the sorry state of computing that there is to this day nothing that can fully replace it."

No, it isn't "sorry" at all because humans have not evolved anything more precise than (ever evolving) language itself. The "command line" is inherently superior to "click and drool" for precision command of software. Point-and-click interfaces are good for selecting among offered choices. CLI is for granular control.

"I hope somebody who uses/likes automatix posts in this thread as well."

Just used it last night with no observable problems. I was trying out Kubuntu 7.04 for the heck of it.
However I also installed Sidux on another machine and used debian-multimedia.org for media players, codecs, etc. The 'buntu box will be Sidux this evening. (Yes I can install Debian the old way, but I'm lazy and the Sidux folks did a nice job.)

IMO the "idea" of Automatix is ok, and streamlining the install of useful apps is no bad thing. Experienced users don't mind editing sources.list, but a CONVENIENT way for newbs to install that stuff on an otherwise "pure" OS is a good thing to have.

For example, even mentioning debian-multimedia.org is frowned upon in some forums due to host-country legal BS, and newbs aren't going to know to go to the mirrors and dig through the package list to select what they need. Newbs need "offered choices" and want software that may be legally impossible to include directly in a specific distro.
IMO there should be an easy workaround to these problems, and "something like" Automatix would be it.

crashmeister · 08-05-2007, 06:37 PM

Quote:

Originally Posted by farmall

"It is a statement to the sorry state of computing that there is to this day nothing that can fully replace it."

No, it isn't "sorry" at all because humans have not evolved anything more precise than (ever evolving) language itself. The "command line" is inherently superior to "click and drool" for precision command of software. Point-and-click interfaces are good for selecting among offered choices. CLI is for granular control.

Yes I know that minus the drooling thing but that might be the reason my laptop went bellyup

But to get serious - you seem to imply that humans need to evolve in order to serve a machine because they are too stupid to use the machine better.
Or is cli lingo something you could possibly compare to a language now?
A language is something complicated enough a computer has no way to tackle in the remotest way these days - even the best best translation programs are at best good for a laugh - which is sorry either.
The problem is that the computing power that is at hand can't be utilized in a proper way because nobody knows how to do it.
And that cli offers more granular control or whatever just proves my point that computing is in a sorry state - how many things you still use that are 20+ years old?
Cli is either the holy grail then or a 20+ year old relic depending the way you look at it.

Quote:

Originally Posted by farmall

For example, even mentioning debian-multimedia.org is frowned upon in some forums due to host-country legal BS, and newbs aren't going to know to go to the mirrors and dig through the package list to select what they need. Newbs need "offered choices" and want software that may be legally impossible to include directly in a specific distro.
IMO there should be an easy workaround to these problems, and "something like" Automatix would be it.

Automatix wont make the apps in Question legal.If you want to break the however idiotic law you should have to go the extra mile

farmall · 08-05-2007, 08:07 PM

"But to get serious - you seem to imply that humans need to evolve in order to serve a machine because they are too stupid to use the machine better."

Humans need to think and communicate precisely in order to get precise, granular control of the systems (not just computers) that they command, themselves included. That is self-service.

Humans that cannot articlate commands with the required precision to use computers at one level have other levels to choose from, thanks to software coders. Humans often choose not to think precisely and choose the defaults provided by others. This isn't unique to computers, as not everyone needs unique AND precise control of every process in their lives. It's ok just to put bread in a toaaster and expect to get toast! It isn't good or bad. Not everyone tunes their own car or repairs their own septic system, because there is no need.

The most precise articulation of thought is the printed word. Its symbols focus thought as they are used. Verbal speech isn't even close, and cannot convey non-verbal content with precision.

Where humans do not need granular control, they can choose from offered options and not waste time thinking about many options and how to choose them. Common standard choices make learning easier.

"Or is cli lingo something you could possibly compare to a language now?"

CLI is a specific way of communicating where print symbols are the medium of communication between man and machine. That is a language. A language need not be spoken, just as purely spoken languages are not written.

The difficulty with translation programs is that they are attempting to reconcile different sets of sounds and symbols with different,sometimes informal standards and common usage. Human language-interchange isn't precise.

"And that cli offers more granular control or whatever just proves my point that computing is in a sorry state - how many things you still use that are 20+ years old?"

The highly refined standard symbol-system we are communicating with now has been around for far longer than the printing press, let alone computers. Not even telepathy would beat the printed word for precision, because a word or symbol has standard meanings (especially when the receiving system only understands/demands specificity) while thoughts do not. Replacement is only better than refinement if the RESULTS are better. Change per se is not progress.

"The problem is that the computing power that is at hand can't be utilized in a proper way because nobody knows how to do it."

That statement is imprecise. Proper way for what task?
As perceived needs evolve computer systems and usage are evolving to meet them. What needs do you see as unmet?

"Automatix wont make the apps in Question legal.If you want to break the however idiotic law you should have to go the extra mile"

They are not illegal everywhere, and what purpose does it serve for the legal-but-not-Free-software items to have an added barrier to use with (not "included in" but specifically "with") distros designed for mass adoption?

lqjoe · 08-06-2007, 01:00 AM

Talking to a few colleagues about automatix2 & ubuntu, I decided to try and install it and check it out for myself. I found that there wasn't really anything in it that I really needed that I couldn't already get from from the standard stable repo (main contrib & non-free). On top of that, most of the other stuff that's provided seems to be a ton more stable when I compiled it from source.

I think my problem with the automatix concept is that it under minds, by it's nature, the concepts of the DFSG. I also think that experienced Debian users should want to have their Debian peers doing things the "right" way instead of taking unnecessary shortcuts which trade stability, security, and platform reliability for entertainment value...which is primarily what automatix provides as far as I can see.

A 3-5 step how-to/wiki/article isn't difficult to read or write. We just need to get the word out. Or maybe I'm thinking yesteryear...