3 ms·

Ugh, no. For what you're worried about all you need is for the client to be able to securely retrieve a signed hash from upstream, which most of the upstream pl

Ugh, no. For what you're worried about all you need is for the client to be able to securely retrieve a signed hash from upstream, which most of the upstream platforms provide as it is. I was going to charge that you wanted to take us back to the soup of irritation that was asdf-install, and then I saw that you say that in as many words, so I'll let your own statement stand.

armitron 9y ago
asdf-install is absolutely the [vastly] more secure and more efficient model in terms of software distribution since it places the author in charge of his own software and not some arbitrary middle man. You seem to think that convenience can not be added to the asdf-install model which is demonstrably false (I described how to do it). Paraphrasing Alan Kay [1], Quicklisp was done by amateurs so you shouldn't assume things can not be done better. There is no technical barrier to something that's similarly easy to use and vastly more secure. [1] http://www.drdobbs.com/architecture-and-design/interview-with-alan-kay/240003442 http://www.drdobbs.com/architecture-and-design/interview-wit...
- bandrami 9y ago
  In fairness, I vastly dislike all of these solutions, and prefer to hand-manage any libraries I need per-project, which I've never found to be particularly onerous.
  - armitron 9y ago
    I do the same thing with some of the suggestions I described in my previous comments. Here is an older relevant thread: https://news.ycombinator.com/item?id=12938269 https://news.ycombinator.com/item?id=12938269
- dreamcompiler 9y ago
  I don't disagree that Quicklisp needs a better distribution and security model. And maybe it was done by amateurs. But asdf is such a pig-brained overengineered impossible-to-debug, impossible-to-learn pile of impenetrable crap that Quicklisp seems downright elegant by comparison. ASDF is like git: It sucks and we are stuck with it. But FFS let's not talk about expanding its scope.
dang 9y ago
Could you please not vent irritation into comments here? You're making a good point (I agree with you—I prefer to manage dependencies myself rather than depend on complex software whose subtleties I can never remember) and then associating it with extraneous rudeness, which is bad for your point as well as for the container here.

armitron 9y ago

asdf-install is absolutely the [vastly] more secure and more efficient model in terms of software distribution since it places the author in charge of his own software and not some arbitrary middle man. You seem to think that convenience can not be added to the asdf-install model which is demonstrably false (I described how to do it). Paraphrasing Alan Kay [1], Quicklisp was done by amateurs so you shouldn't assume things can not be done better. There is no technical barrier to something that's similarly easy to use and vastly more secure. [1] http://www.drdobbs.com/architecture-and-design/interview-with-alan-kay/240003442 http://www.drdobbs.com/architecture-and-design/interview-wit...

bandrami 9y ago
In fairness, I vastly dislike all of these solutions, and prefer to hand-manage any libraries I need per-project, which I've never found to be particularly onerous.
- armitron 9y ago
  I do the same thing with some of the suggestions I described in my previous comments. Here is an older relevant thread: https://news.ycombinator.com/item?id=12938269 https://news.ycombinator.com/item?id=12938269
dreamcompiler 9y ago
I don't disagree that Quicklisp needs a better distribution and security model. And maybe it was done by amateurs. But asdf is such a pig-brained overengineered impossible-to-debug, impossible-to-learn pile of impenetrable crap that Quicklisp seems downright elegant by comparison. ASDF is like git: It sucks and we are stuck with it. But FFS let's not talk about expanding its scope.

dang 9y ago

Could you please not vent irritation into comments here? You're making a good point (I agree with you—I prefer to manage dependencies myself rather than depend on complex software whose subtleties I can never remember) and then associating it with extraneous rudeness, which is bad for your point as well as for the container here.