Curated package managers are still vulnerable to supply-chain attacks. Solarwinds was the definition of a curated system and look how that turned out. In almos

Curated package managers are still vulnerable to supply-chain attacks. Solarwinds was the definition of a curated system and look how that turned out. In almost every way the problem comes back to the same basic failure which ransomware represents: OS level data and access is boring, but user level data and access is wide-open and you grant it constantly to all sorts of things - its hard-to-impossible to put comprehensible, maintainable barriers around stuff and we lack the tools and programming constructs to enable this - i.e. you can't write software where it will, without you doing a lot of work, upfront declare what files its touching and how in a deterministic way.