>This is where I think the traditional Linux package maintainer shines, protecting the user from malicious software. If a package-maintainer (generally independ

>This is where I think the traditional Linux package maintainer shines, protecting the user from malicious software. If a package-maintainer (generally independent from the developer) packages software for a Linux distro, the package-maintainer can drop harmful updates. If instead we give the developers free-reign to push updates without user consent, the developers can and will sell out to the highest bidder Sounds good in theory but that hasn't been battle tested in a mass product used by non-tech savvy people like Chrome extensions that are heavily targeted. On the other hand there have been breaches even in the packaging landscape.