Skip to content
Prev 2734 / 3656 Next

Regarding R_LIBS_USER

Hello,

I just subscribed to the list to join the discussion after being
blindsided by the change and reading Dirk Eddelbuettel's reply to my
bug report at https://bugs.debian.org/866768 . 

As far as I can tell the advantages of site library are:

   1. Saves disk space and a little bit of user time spent installing and
      upgrading.
   2. Other Debian package manages, like pip, default?to trying to install
      to a site library.

However, it seems to me that the case for status quo ante is stronger,
even if the jarring behaviour (asking user whether to create a personal
directory, then failing to do so) is fixed:

   1. Correct me if I am wrong, but wouldn't the change make the default
      behaviour of R on Debian different from its default behaviour on
      other distributions?
   2. Site library has no benefit over user library on a single-user
      system.
   3. Making the site library writeable by default is a severe security
      vulnerability, since it enables users to rewrite library code that
      will be blindly executed by other users on the system.
   4. Making the site library not-writeable by default means that users
      relying on site library need to contact an administrator to get a
      package installed or upgraded. This seems to me to largely defeat
      the benefit of a site library for most systems, since most users
      aren't so patient and would just figure out how to use a user
      library.
   5. The use case where defaulting to installing to site library is most
      beneficial---a system shared by few trusted users---is rare compared
      to the single-user and the many-untrusted-user systems.
   6. There are workarounds, and, indeed, users can always use user
      libraries, but the new setup puts the burden of tweaking the system
      on the *least skilled* users, whereas the old setup Just Worked for
      them (since R 2.5.0).
   7. Even in Python and others, the user library takes precedence over
      the site library (which, in turn, takes precedence over the dpkg-
      installed library). This means that .libPaths() should have the user
      library (if it exists) in first position, not as a fallback.

So, overall, I think the change does more harm than good. Am I missing anything?

				Best Regards,
				Pavel