Linspire’s CNR finally hits other distros, but do you want to use it?

Back when I was running my old blog I had posted about an announcement that Linspire’s Click’N'Run (CNR) software repository would be coming to other Linux distributions, including Ubuntu. The beta is finally here, but now that it is, do you want to use it?

I took a quick perusal of what’s available, and I honestly didn’t see much (if any) open source software that’s available there that’s not available to me in Ubuntu via either Synaptic, Add/Remove Programs or Automatix. Still, I looked into what’s required to use the CNR repo, and they want you to install a program on your hard drive but to actually use their repo it opens a page in your web browser. Huh? In all fairness, that’s how it worked when I was trying out Freespire a little over a year ago, but it seems quite an odd way to do it compared with what’s available for Ubuntu. Even Automatix uses its own window to install/remove programs, not a web browser window. What if I don’t want Firefox open as I check for a program, perhaps to limit the temptation to check my webmail, another site, or even just start doing some Stumbling?

I did see two interesting comments about CNR in Planet Ubuntu. Tom Dryer gives a fairly in depth look at what it’s doing, but points out that “As for making software installation easy, CNR is trying to solve a problem that Ubuntu doesn’t have.” He’s absolutely right. Maybe I’ve been using computers for too long to appreciate a problem newbies have, but if you can find something in Add/Remove Programs it’s a piece of cake to install it. If you have to go the Synaptic route it’s still not brain surgery, and if you have to use the Apt system to install software you’re going to get easy to follow (including copy & paste) instructions that I bet even my ex-wife could follow. (No offense, Kath, but it really is that easy if you pay even the slightest bit of attention.) And if you have something you want to install that doesn’t come in a handy DEB package you can check for it on GetDeb.net. Chances are pretty good someone’s packaged it for you already and you won’t have to compile a line of code.

Marco Silva, on the other hand, points out a rather large security issue, and before he even tells you what it is he puts the summary right in the first paragraph.

Before talking about this, my sugestion: DON’T INSTALL IT!

A software that can install/remove/update applications on Ubuntu without asking for the user’s password is a security risk…

I hadn’t even realized CNR was doing this. I know when I was trying out Freespire I had to identify myself, but I may be remembering wrong. I’ve been using Ubuntu for over a year now and it’s quite common to have to put in my administrator password before having to install anything (other than the way I run Firefox, Thunderbird and SecondLife, but I do that after careful consideration of a number of factors, including the level of trust I have in the programs and the fact that they go into my /home partition, unlike anything you’ll get from CNR). I’ll admit that I may simply have forgotten that I didn’t have to put in my password to install software in Freespire, and if that’s the case then I can now say it’s a BAD idea.

If you currently run Ubuntu and are curious about it, I suggest reading their website fully. Look at what it has, especially in comparison with what’s currently available to Ubuntu users, and see if it’s worth installing. But after Marco’s discovery I have to agree with him. You don’t want anything on your computer that can install a program into your administrative area without insisting on getting your admin password. It’s done like that in Ubuntu for a damned good reason, and not just to force you to take an extra step in your installation processes.