3 ms·
I am starting to think that what we need is package distributions. That is, forked popular packages that are hand-vetted by a group of maintainers, just to make
by bornfreddy 4y ago
I am starting to think that what we need is package distributions. That is, forked popular packages that are hand-vetted by a group of maintainers, just to make sure that some random malware doesn't find its way into the dependencies. If you want the latest and greatest, or want your custum dependencies checked, you pay. Otherwise it's free.
I'm quite sure that the market for this is really big. Does something like this already exist?
- yjftsjthsd-h 4y agoThat sounds like a Linux distro with the base OS factored out; the only difference between that and, say, Debian, is that Debian is a kernel + core userspace and not just application libraries. I'm not aware of anything quite like that already existing, but OS distros are sufficient prior art for me to think that it could work. EDIT: Actually, there are package managers + package collections that intentionally can be installed on top of an existing OS; nix/nixpkgs and pkgsrc are probably the big ones. I'm not 100% sure that those are what you want today, but it's likely that if you could get maintainers to add your desired packages they'd be accepted there.
- boarnoah 4y agoIt also describes software ecosystems like the apache software foundation, dotnet foundation or even just community vetting like PHP has with Tidelift (which is a pretty clever idea on its own) etc...
- bornfreddy 4y agoYup, I knew I wasn't the first one to see an opportunity here. :) Tidelift sounds great, thank you!
- Ekaros 4y agoIsn't that kind of antifactory? Still, that also opens up the question of timely updates to solve possible security vulnerabilities.