5 ms·

In my experience, Linux repositories are all of the upsides you mentioned (trusted, auto-updated, signed (at repo level, at least)) with none of the lock-in dow

In my experience, Linux repositories are all of the upsides you mentioned (trusted, auto-updated, signed (at repo level, at least)) with none of the lock-in downsides, since you can add third party repositories (and then use them via the same workflow you're already comfortable with!).

darthrupert 6y ago
Many of them rely of a free-of-charge labour. Would you volunteer your free time to maintain Apple Store?
- tomohawk 6y ago
  No, but I might volunteer at an open source store that Apple users were allowed to install from.
- spaceribs 6y ago
  App developers who need a distribution channel would.
- majewsky 6y ago
  You're literally describing Homebrew.
  - darthrupert 6y ago
    I was thinking of that, but it seems to me that maintaining the Store has nearly totally different set of problems.
elondaits 6y ago
But (official) Linux repositories are curated. App Stores need to be able to deal with submissions for borderline malware freemium games that could contain content that is illegal in some countries for political reasons, too much violence, porn, etc. The Linux model works for a handful of trusted curators who only concern themselves with software worth their time... it can't deal with every single publisher who wants their content in your platform. It doesn't have to deal with issues regarding content for the most part (trademarks, copyright, decency, etc.) Also npm has shown that open repositories, at certain scale, become fertile ground for malware. pip also had issues with this. I sometimes worry about homebrew, since it wouldn't be that hard to get malware in.
- danShumway 6y ago
  > The Linux model works for a handful of trusted curators who only concern themselves with software worth their time... it can't deal with every single publisher who wants their content in your platform. Sure it can, anyone can set up a Linux repository. Some apps have their own repositories just for themselves. The Linux model is great for curation, because having multiple repositories means that you don't have to grow to npm's size if you don't want to. Arch is a great example of this. The existence of the AUR repositories gives the official repositories much more freedom to more tightly moderate what goes into them, and it gives me a lot more confidence that packages aren't being blindly added to the official repositories. It's the opposite of what people are implying, having more storefronts means that storefronts can be stricter about what they apply. It means as a storefront owner you don't have to come up with one moderation policy that binds literally everyone in the world, so you can be a lot more choosy and subjective about what you approve and reject.

darthrupert 6y ago

Many of them rely of a free-of-charge labour. Would you volunteer your free time to maintain Apple Store?

tomohawk 6y ago
No, but I might volunteer at an open source store that Apple users were allowed to install from.
spaceribs 6y ago
App developers who need a distribution channel would.
majewsky 6y ago
You're literally describing Homebrew.
- darthrupert 6y ago
  I was thinking of that, but it seems to me that maintaining the Store has nearly totally different set of problems.

elondaits 6y ago

But (official) Linux repositories are curated. App Stores need to be able to deal with submissions for borderline malware freemium games that could contain content that is illegal in some countries for political reasons, too much violence, porn, etc. The Linux model works for a handful of trusted curators who only concern themselves with software worth their time... it can't deal with every single publisher who wants their content in your platform. It doesn't have to deal with issues regarding content for the most part (trademarks, copyright, decency, etc.) Also npm has shown that open repositories, at certain scale, become fertile ground for malware. pip also had issues with this. I sometimes worry about homebrew, since it wouldn't be that hard to get malware in.

danShumway 6y ago
> The Linux model works for a handful of trusted curators who only concern themselves with software worth their time... it can't deal with every single publisher who wants their content in your platform. Sure it can, anyone can set up a Linux repository. Some apps have their own repositories just for themselves. The Linux model is great for curation, because having multiple repositories means that you don't have to grow to npm's size if you don't want to. Arch is a great example of this. The existence of the AUR repositories gives the official repositories much more freedom to more tightly moderate what goes into them, and it gives me a lot more confidence that packages aren't being blindly added to the official repositories. It's the opposite of what people are implying, having more storefronts means that storefronts can be stricter about what they apply. It means as a storefront owner you don't have to come up with one moderation policy that binds literally everyone in the world, so you can be a lot more choosy and subjective about what you approve and reject.