4 ms·
I'd not heard of Scoop before today but have used chocolatey extensively in the past. However I'm wary of all these tools (including brew on Mac) as they all f
by tailspin2019 6y ago
I'd not heard of Scoop before today but have used chocolatey extensively in the past.
However I'm wary of all these tools (including brew on Mac) as they all feel like a pretty efficient way to main line your own personal supply chain attack into your dev machine!
For that reason I now try to use them sparingly and with a high degree of suspicion.
- kekebo 6y agoWith most package managers you can review package sources (e.g. "choco info" for chocolatey or "brew info" / "brew edit" for homebrew). As for threat model it comes down to whether using package management poses larger risk than doing everything manually and risking running a range of outdated packages.
- tailspin2019 6y agoYes, fair points. It's always a judgement call - which is the lesser of two evils...
- cm2187 6y agoTrue, but it is also an easy way to keep your software up to date which is in itself a security feature. So a bit of a trade off.