10 ms·

I wonder why the author recommend winget but not scoop. Scoop obviously has more community support and that's the most important part of a package manager (more

I wonder why the author recommend winget but not scoop. Scoop obviously has more community support and that's the most important part of a package manager (more packages, more frequent update, etc).

runjake 6y ago
Winget is the de facto official package manager for Windows. It is or will be included with Windows. I know it’s included in the Insider builds.
- timvisee 6y ago
  It is a mess though, and quite incapable.
  - mark_and_sweep 6y ago
    Agreed. winget is lacking most features I absolutely need from a package manager, including listing installed packages, uninstalling packages, and updating packages. These are all on the v1 roadmap [1], but for the foreseeable future I'm sticking with scoop. [1] https://github.com/microsoft/winget-cli/blob/master/doc/windows-package-manager-v1-roadmap.md https://github.com/microsoft/winget-cli/blob/master/doc/wind...
- cm2187 6y ago
  But what package list does it have? That’s the primary criteria. A package manager with no package isn’t of much use.
  - easton 6y ago
    https://github.com/Microsoft/winget-pkgs https://github.com/Microsoft/winget-pkgs Pretty much everything major with a installer is covered.
kekebo 6y ago
Any upsides to scoop compared to chocolatey?
- pas 6y ago
  Seems simpler to me. Active community, big directory of buckets and apps. https://rasa.github.io/scoop-directory/by-apps https://rasa.github.io/scoop-directory/by-apps
- tailspin2019 6y ago
  I'd not heard of Scoop before today but have used chocolatey extensively in the past. However I'm wary of all these tools (including brew on Mac) as they all feel like a pretty efficient way to main line your own personal supply chain attack into your dev machine! For that reason I now try to use them sparingly and with a high degree of suspicion.
  - kekebo 6y ago
    With most package managers you can review package sources (e.g. "choco info" for chocolatey or "brew info" / "brew edit" for homebrew). As for threat model it comes down to whether using package management poses larger risk than doing everything manually and risking running a range of outdated packages.
    - tailspin2019 6y ago
      Yes, fair points. It's always a judgement call - which is the lesser of two evils...
  - cm2187 6y ago
    True, but it is also an easy way to keep your software up to date which is in itself a security feature. So a bit of a trade off.
- flohofwoe 6y ago
  Here's a comparison page: https://github.com/lukesampson/scoop/wiki/Chocolatey-Comparison https://github.com/lukesampson/scoop/wiki/Chocolatey-Compari... One advantage is that scoop installs (most) tools into a common place and search path, and thus doesn't pollute environment variables as much.
tailspin2019 6y ago
> I wonder why the author recommend winget but not scoop. Scott Hanselman works for Microsoft and is a prominent advocate for the .NET/Microsoft ecosystem so his recommendations are likely to skew towards native MS tools in the first instance. Nothing wrong with that as long as you consume his material through that lens! That said, I'm quite surprised I hadn't heard of Scoop[0]. Looks interesting... [0] https://scoop.sh https://scoop.sh
- 411111111111111 6y ago
  Best thing about scoop is that it doesn't need admin privileges. Everything is installed as portables in user directory
  - tonyedgecombe 6y ago
    Everything is installed as portables in user directory Is that a good thing?
    - easton 6y ago
      In corporate environments it is, since you don’t have to get permission from the IT police to install VSCode or Firefox or grep. (Of course, you should. But sometimes it’s not an option.)
      - stjohnswarts 6y ago
        They can prevent that if they want to (there are tons of admin software to prevent users from install unapproved software on windows) so it really is a nonissue. The main issue is extra space, but that also isn't that big of an issue if the app is written well for updates and I don't know why that would be any more or less efficient when installed by "user" vs "admin"
        411111111111111 6y ago
        > prevent users from install unapproved software While they could prevent it, that's not how. The software is never "installed". It's only unzipped to scoops install directory (usually home/scoop/...) Then it adds the install directory to the PATH and it's done. The copied executables have never been marked as unknown by windows in my experience. Admins could of course lock down systems to only allow executables with specific hashedls which are manually whitelisted by the admins, but just disallowing installs won't help at all Disallowing powershell or scripting altogether makes it impossible to use as well.
anonunivgrad 6y ago
Scoop tries to swim upstream and change the default install location. In my experience, this ultimately leads to problems and system fragility. Sure, it should work, but that's no comfort when it doesn't work right when you need it. Instead, you should install software to the default place and install it as admin. That's how it's tested by its developers and that's how it's tested for regression and compatibility within Microsoft.

I wonder why the author recommend winget but not scoop. Scoop obviously has more community support and that's the most important part of a package manager (more packages, more frequent update, etc).

runjake 6y ago

Winget is the de facto official package manager for Windows. It is or will be included with Windows. I know it’s included in the Insider builds.

timvisee 6y ago
It is a mess though, and quite incapable.
- mark_and_sweep 6y ago
  Agreed. winget is lacking most features I absolutely need from a package manager, including listing installed packages, uninstalling packages, and updating packages. These are all on the v1 roadmap [1], but for the foreseeable future I'm sticking with scoop. [1] https://github.com/microsoft/winget-cli/blob/master/doc/windows-package-manager-v1-roadmap.md https://github.com/microsoft/winget-cli/blob/master/doc/wind...
cm2187 6y ago
But what package list does it have? That’s the primary criteria. A package manager with no package isn’t of much use.
- easton 6y ago
  https://github.com/Microsoft/winget-pkgs https://github.com/Microsoft/winget-pkgs Pretty much everything major with a installer is covered.

kekebo 6y ago

Any upsides to scoop compared to chocolatey?

pas 6y ago
Seems simpler to me. Active community, big directory of buckets and apps. https://rasa.github.io/scoop-directory/by-apps https://rasa.github.io/scoop-directory/by-apps
tailspin2019 6y ago
I'd not heard of Scoop before today but have used chocolatey extensively in the past. However I'm wary of all these tools (including brew on Mac) as they all feel like a pretty efficient way to main line your own personal supply chain attack into your dev machine! For that reason I now try to use them sparingly and with a high degree of suspicion.
- kekebo 6y ago
  With most package managers you can review package sources (e.g. "choco info" for chocolatey or "brew info" / "brew edit" for homebrew). As for threat model it comes down to whether using package management poses larger risk than doing everything manually and risking running a range of outdated packages.
  - tailspin2019 6y ago
    Yes, fair points. It's always a judgement call - which is the lesser of two evils...
- cm2187 6y ago
  True, but it is also an easy way to keep your software up to date which is in itself a security feature. So a bit of a trade off.
flohofwoe 6y ago
Here's a comparison page: https://github.com/lukesampson/scoop/wiki/Chocolatey-Comparison https://github.com/lukesampson/scoop/wiki/Chocolatey-Compari... One advantage is that scoop installs (most) tools into a common place and search path, and thus doesn't pollute environment variables as much.

tailspin2019 6y ago

> I wonder why the author recommend winget but not scoop. Scott Hanselman works for Microsoft and is a prominent advocate for the .NET/Microsoft ecosystem so his recommendations are likely to skew towards native MS tools in the first instance. Nothing wrong with that as long as you consume his material through that lens! That said, I'm quite surprised I hadn't heard of Scoop[0]. Looks interesting... [0] https://scoop.sh https://scoop.sh

411111111111111 6y ago
Best thing about scoop is that it doesn't need admin privileges. Everything is installed as portables in user directory
- tonyedgecombe 6y ago
  Everything is installed as portables in user directory Is that a good thing?
  - easton 6y ago
    In corporate environments it is, since you don’t have to get permission from the IT police to install VSCode or Firefox or grep. (Of course, you should. But sometimes it’s not an option.)
    - stjohnswarts 6y ago
      They can prevent that if they want to (there are tons of admin software to prevent users from install unapproved software on windows) so it really is a nonissue. The main issue is extra space, but that also isn't that big of an issue if the app is written well for updates and I don't know why that would be any more or less efficient when installed by "user" vs "admin"
      - 411111111111111 6y ago
        > prevent users from install unapproved software While they could prevent it, that's not how. The software is never "installed". It's only unzipped to scoops install directory (usually home/scoop/...) Then it adds the install directory to the PATH and it's done. The copied executables have never been marked as unknown by windows in my experience. Admins could of course lock down systems to only allow executables with specific hashedls which are manually whitelisted by the admins, but just disallowing installs won't help at all Disallowing powershell or scripting altogether makes it impossible to use as well.

anonunivgrad 6y ago

Scoop tries to swim upstream and change the default install location. In my experience, this ultimately leads to problems and system fragility. Sure, it should work, but that's no comfort when it doesn't work right when you need it. Instead, you should install software to the default place and install it as admin. That's how it's tested by its developers and that's how it's tested for regression and compatibility within Microsoft.