I'm always uneasy when I install software in Windows because it means I have to trust another third-party. If I have 100 programs on my Windows PC, I've had to

I'm always uneasy when I install software in Windows because it means I have to trust another third-party. If I have 100 programs on my Windows PC, I've had to trust 100 third-party organisations with my computer and all the data on it. Not only that, but I've also had to trust my own judgement to find the correct website for all those programs, and not copycats that wrap the program in malware. Sometimes I check Wikipedia to find the official site and sometimes I find an official-looking GitHub repo with a lot of stars and work back to find the official site, but sometimes it doesn't matter anyway because the program itself becomes malware (eg. CCleaner.) With a package manager I have to trust one organisation, which is the same that I get my operating system from. I don't even have to trust the website that hosts the packages, since the packages are signed. It's true that someone might try to sneak malware under the package mantainer's nose with obfuscated source code, but that's much harder than sneaking it in a binary. You're practically guaranteed that the software running on your PC matches the publicly available source code, and it's built with the latest compilers and hardening flags. (7-Zip used to build without any hardening flags because they made the binary larger.[1]) It's not even just security issues I'm concerned about when it comes to trusting software. I also have to trust the software not to make global, permanent changes to my system, which isn't uncommon with Windows software[2], but basically unheard of with Linux packages - and when it does happen, it's Microsoft doing it[3]. So I'd say the primary meaningful value-add of a package manager is trust. [1]: https://landave.io/2018/01/7-zip-multiple-memory-corruptions-via-rar-and-zip/ https://landave.io/2018/01/7-zip-multiple-memory-corruptions... [2]: https://devblogs.microsoft.com/oldnewthing/20081211-00/?p=19873 https://devblogs.microsoft.com/oldnewthing/20081211-00/?p=19... [3]: https://www.preining.info/blog/2018/06/microsofts-failed-attempt-on-debian-packaging/ https://www.preining.info/blog/2018/06/microsofts-failed-att...