Why am I getting Cinnamon-Desktop security updates in MATE?

[Redit2]

Like many updates, if I don't have the product/software I don't update it and I haven't downloaded this update. Is there common ground between the 2 desktops and that's why I'm getting this update or does MATE just fall into the Cinnamon category? I don't ever remember getting a MATE-Desktop update.

[billyswong]

Like many updates, if I don't have the product/software I don't update it

This sounds worrying. Many software packages are interrelated and depend on one another. You are probably missing a lot of updates and it is very likely some of them is what your daily-used software depend on. Windows calls every system updates "windows update" while Linux shows you which exact libraries are going to be updated. They are supposed to give users more information, not trigger users to reject them.

Take "Cinnamon-Desktop" as an example. In my LM 21 Mate desktop, cinnamon-desktop-data is a dependency of libcinnamon-desktop4. libcinnamon-desktop4 is a dependency of xviewer. xviewer is what Linux Mint provides as Image Viewer across all desktop variants.

Another example. Last night, ca-certificates requests an update. I never run "ca-certificates" as an application by myself. But this package update is where Mozilla enact the removal of TrustCor from root certificate authorities. https://www.washingtonpost.com/technolo ... y-mozilla/ That company is discovered to be a spyware maker for government.

I am not claiming everyone should trust updates fed by Linux Mint blindly or nobody shall ever question any updates. But if you are not skillful enough to find out why "Cinnamon-Desktop" is there in your computer by yourself, maybe you shall trust Linux Mint development team more for now, and update everything you delayed or refused to update so far.

[Redit2]

I have 5 updates I didn't download, so yeah, I'm really missing a lot. Do I need Thunderbird updates when I don't use it or fingerprintreader updates or bluetooth or the many others I don't use? If you can't figure out that ca-certificates was a no-brainer update then you should download every update and every piece of software you can find. Having a small a foot print as possible is a golden concept in security but since you 100% trust everything Linux, go ahead and start those 60,000 downloads.

[billyswong]

If I find a software I don't want to keep it up to date because I am sure I will never use or need it, I uninstall it. I don't leave it in my storage space out of date. If you think you will never use Thunderbird, you should try uninstalling instead of leaving it there to rot. If you try to uninstall a package but find it entangled to some other packages thus not removable, then maybe you shall question if it is really never run in your computer.

[all41]

there are common packages
In MATE open Synaptic Package Manager and search for Cinnamon
You will find certain packages are shared--nothing unusual or alarming here.
Just as Cinnamon users will find MATE packages installed.
If the packages are on my system I want them updated regardless

[Pjotr]

I have 5 updates I didn't download, so yeah, I'm really missing a lot. Do I need Thunderbird updates when I don't use it or fingerprintreader updates or bluetooth or the many others I don't use? If you can't figure out that ca-certificates was a no-brainer update then you should download every update and every piece of software you can find. Having a small a foot print as possible is a golden concept in security but since you 100% trust everything Linux, go ahead and start those 60,000 downloads.

The footprint remark is right. The more you have installed, the bigger the attack surface.

But when a particular package, with its own attack surface, is installed in your system anyway, you'll definitely want to receive security updates for it. If only for the potential interrelations with other packages that you do use, as billyswong rightly remarked.

As a rule it's better to leave the default apps in your system be (i.e. don't uninstall them), even if you don't use them. Because of the risk of collateral damage: it's safer to build than to tear down.

However, Thunderbird is an app that you can safely remove (I remove it as a matter of course on my systems, as I exclusively use webmail). No collateral damage.

[Redit2]

A few good points all around. My reasoning is that 1) the first line of the description of this update said "This library is used by Cinnamon." A fair reason to question why I'm getting it. A better line would be "This library is used by Cinnamon/MATE/Xfce." Then everyone would know. The second reason I questioned if I needed is because it was a software update, not a security update. I agree that I should uninstall what I don't need but as the point was made, some are inter-connected and by removing one it causes issues as I have experienced. On MATE, I already by choice have a lighter system which shouldn't have much bloat. Just trying to keep it that way.

[Moem]

Updating does not add any 'bloat'. It just replaces outdated packages that are present on your system by up-to-date versions.

[billyswong]

A better line would be "This library is used by Cinnamon/MATE/Xfce." Then everyone would know.

This would be incorrect. Linux Mint select a number of accessory applications such as text editor / image viewer / document viewer etc to follow the domestically maintained Cinnamon, in place of the original default in pure Mate or pure Xfce. The library in question is not used by Mate or Xfce. It is used by LM Mate and LM Xfce. The whole situation is an annoying hairsplitting and can't be explained in any short description.

The second reason I questioned if I needed is because it was a software update, not a security update. I agree that I should uninstall what I don't need but as the point was made, some are inter-connected and by removing one it causes issues as I have experienced. On MATE, I already by choice have a lighter system which shouldn't have much bloat. Just trying to keep it that way.

The main point is, you don't reduce bloat by not installing update. You can only reduce bloat by removing software that you have confirmed to be not a dependency of other thing else.

[Redit2]

The library in question is not used by Mate or Xfce.

You keep making the point for me. If the named Cinnamon software update is not for MATE, I shouldn't be getting it. It appears that by default, LM assumes you have all programs installed that came with the original download as I get updates for programs deleted. Fair enough. That's why I don't download updates for things that don't apply to me. If anyone has to know the intricate working of how they all connect, that is one example of what keeps people away from Linux. Unnecessarily complex by design.

Moem, I totally agree that updating a software package that you have does not "bloat" the system, it's updating things that don't apply that is w/o a doubt bloat and updating things that are not installed or don't apply to my system is simply bloat.

[Moem]

Moem, I totally agree that updating a software package that you have does not "bloat" the system, it's updating things that don't apply that is w/o a doubt bloat and updating things that are not installed or don't apply to my system is simply bloat.

If it weren't installed, you would not be getting updates for it.
And I disagree with your statement. Updating is not bloat, even if a package is never used; after all, the old one gets replaced, nothing gets added. No bloat involved.

If you have things installed that you'll certain you'll never use, and you do not want to keep them updated, the solution has been proposed: uninstall them.
If you can't, because they're dependencies of things that you do use, then in a way you are using them.

[SMG]

The library in question is not used by Mate or Xfce.

You keep making the point for me.

Actually, you seem to have missed the point billyswong made by deliberately cherry-picking statements instead of reading the entire post.

You appear to be making the assumption the MATE desktop you have with Linux Mint has not been altered in any way. You think you have a generic MATE desktop when in reality you have a Linux Mint version of MATE. Therefore the packages are being used by your version of MATE because you have the LM Mate version. Thus when billyswong says, "The library in question is not used by Mate or Xfce. It is used by LM Mate and LM Xfce." they are making an important distinction which explains why you are getting updates for packages that you think you should not get.