3 ms·

I get annoyed by languages/frameworks that want to download code from mysterious web sites, bypassing the distribution's package manager. Ruby seems to do this,

by bloak 8y ago

I get annoyed by languages/frameworks that want to download code from mysterious web sites, bypassing the distribution's package manager. Ruby seems to do this, though I might be wrong: that I can't easily tell where the code is coming from is bad in itself. I prefer to know that there's at least a Debian maintainer between me and upstream. I definitely would notice if Debian itself got taken over! Perhaps the rule of thumb should be: if it's not properly in Debian, then don't use, it unless you have a very good reason for doing so.

gray_-_wolf 8y ago
> Ruby seems to do this, Ruby uses https://rubygems.org https://rubygems.org as central repository for the gems (something like node's modules). You can however host your own having only inspected software. However you know where the code is comming from and you can download it and inspect before installing. Idea (benefit) behind this is two-fold: easy way to have same library in multiple versions (you often need that) and having per-application isolated bundles of gems (again, it's easier to clean everything afterwards this way). Could all this be handled via system package manager? Sure, however it would be much more work for the developers (since gems generally work even on windows and other platforms; what package manager would you use on windows without `gem` command?). PS: I don't argue that there is room for improvement in some aspects, but the general idea isn't bad imo.
kmarc 8y ago
Let's not forget how those trustful Debian maintainers packaged openssl 0.9.8...
- Tom4hawk 8y ago
  It was 10 years ago... For people interested: https://www.isotoma.com/blog/2008/05/14/debians-openssl-disaster/ https://www.isotoma.com/blog/2008/05/14/debians-openssl-disa...
berti 8y ago
Additionally, packages from the Debian repos always install reliably, which is much more than can be said for the likes of Ruby packages.
raesene9 8y ago
Debian/Ubuntu etc generally have packages for a subset of programming language libraries. The problem tends to be that users don't like the lag introduced by the packaging process. It's definitely a valid strategy to get "more trusted" libraries to restrict yourself to ones that are available the the OS package manager. Of course you should understand the limits of that trust ( for example AFAIK there is no security code review involved in the debian package process)

by bloak 8y ago

gray_-_wolf 8y ago

> Ruby seems to do this, Ruby uses https://rubygems.org https://rubygems.org as central repository for the gems (something like node's modules). You can however host your own having only inspected software. However you know where the code is comming from and you can download it and inspect before installing. Idea (benefit) behind this is two-fold: easy way to have same library in multiple versions (you often need that) and having per-application isolated bundles of gems (again, it's easier to clean everything afterwards this way). Could all this be handled via system package manager? Sure, however it would be much more work for the developers (since gems generally work even on windows and other platforms; what package manager would you use on windows without `gem` command?). PS: I don't argue that there is room for improvement in some aspects, but the general idea isn't bad imo.

kmarc 8y ago

Let's not forget how those trustful Debian maintainers packaged openssl 0.9.8...

Tom4hawk 8y ago
It was 10 years ago... For people interested: https://www.isotoma.com/blog/2008/05/14/debians-openssl-disaster/ https://www.isotoma.com/blog/2008/05/14/debians-openssl-disa...

berti 8y ago

Additionally, packages from the Debian repos always install reliably, which is much more than can be said for the likes of Ruby packages.

raesene9 8y ago

Debian/Ubuntu etc generally have packages for a subset of programming language libraries. The problem tends to be that users don't like the lag introduced by the packaging process. It's definitely a valid strategy to get "more trusted" libraries to restrict yourself to ones that are available the the OS package manager. Of course you should understand the limits of that trust ( for example AFAIK there is no security code review involved in the debian package process)