Software updater snuck in a package that is unwanted

[Ralf Mardorf]

On Fri, 20 Oct 2017 10:44:18 +0200, Oliver Grawert wrote:
>so in fact "recommends" is the only thing to do here to help bret to
>not have the meta package removed

As already pointed out, I'm pro making it a recommended dependency, but
Bret is the kind of user who soon or later will mess up something again
and then try to fix it by reinstalling ubuntu-mate-desktop, including
all recommended packages, without remembering this thread. Perhaps we
didn't follow the same mails regarding new Firefox releases are spyware,
so it's better stay with an old Firefox Multi-CVE version and
unattended-upgrades is a trojan.

On Fri, 20 Oct 2017 11:04:23 +0100, Colin Watson wrote:
>This is false.  Only new recommends are installed by default during a
>dist-upgrade, not existing recommends that have been removed.

Ok, this might work for this meta package, but it doesn't work if you
have got https://packages.ubuntu.com/xenial/linux-lowlatency installed
and then make a release upgrade, since the dependency chain
https://packages.ubuntu.com/xenial/linux-image-lowlatency ,
https://packages.ubuntu.com/xenial/linux-image-4.4.0-97-lowlatency does
reinstall grub. Maybe because the kernel is considered as new, however,
without a workaround a release upgrade will always reinstall grub,
because it's a recommenced dependency. But this isn't the point. Bret
fixed the Firefox issue by losing his history and even can't restore
it from a backup. Much likely most computer users, not necessarily
Linux users, are using computers as Bret does.

The question is, why somebody connected to the Internet, without the
abilities to get rid of automatic upgrades, does want to get rid of it
at all. Why he does guess staying with an old version of Firefox is
more secure, than installing a new release.