3 ms·

It boggles my mind that neither macOS nor Windows has an official, comprehensive package manager. Sometimes the only way to get software is to download binaries

It boggles my mind that neither macOS nor Windows has an official, comprehensive package manager. Sometimes the only way to get software is to download binaries from a Google search like it's 2003. On macOS, 90% of what you'd ever need is on Homebrew—this is more or less a solved problem—but it's still unofficial and Apple promotes their pointless App Store instead. In Windows land, the unofficial package managers are nowhere near comprehensive (understandable, I guess), but you'd think with Microsoft's approach toward WSL and GitHub, they would have an officially supported HomeBrew-like alternative.

tech234a 4y ago
Windows has winget built in.
- vehemenz 4y ago
  They allow anyone to submit to the repository with minimal vetting, and the package selection is inferior compared to Homebrew. Maybe we have different ideas about what "official" and "comprehensive" mean.
  - izacus 4y ago
    I'd love to hear what "official" means to you and why that definition has value for a package manager.
    - vehemenz 4y ago
      Prima facie, a one-stop, secure, official (paid Microsoft employees working on it) source for binary downloads seems like it has plenty of value for end users. I'd be interested in knowing why keeping the Windows Store around and having a secondary package list for winget that most people don't use is a better paradigm.
- consumer451 4y ago
  I had no idea this existed. Neato! C:\>winget search "hacker news" Name Id Version Source ------------------------------------------------ Hacker News Reader 9WZDNCRDKBC1 Unknown msstore Hacker News (YC) 9NBLGGH1RHHV Unknown msstore I have no idea on the provenance of these packages, so will not be installing until I understand this more, but thanks for sharing winget. "winget search torrent" listed some apps which I had never heard of before. Here is winget's submission requirements info: > Expectations for submissions: > The manifest complies with the schema requirements. All URLs in the manifest lead to safe websites. > The installer and application are virus free. The package may be identified as malware by mistake. If you believe it is a false positive you can submit the installer to the Microsoft Defender team for analysis. > The application installs and uninstalls correctly for both administrators and non-administrators. > The installer supports non-interactive modes. > All manifest entries are accurate and not misleading. >The installer comes directly from the publisher's website. https://learn.microsoft.com/en-us/windows/package-manager/package/repository#validation-process https://learn.microsoft.com/en-us/windows/package-manager/pa...
  - consumer451 4y ago
    Just wanted to add the most useful search I've found so far: C:\>winget search foss
haunter 4y ago
Windows does https://en.wikipedia.org/wiki/Windows_Package_Manager https://en.wikipedia.org/wiki/Windows_Package_Manager https://learn.microsoft.com/en-us/windows/package-manager/winget/ https://learn.microsoft.com/en-us/windows/package-manager/wi... And if not official then you can always use Chocolatey https://chocolatey.org/ https://chocolatey.org/
- vehemenz 4y ago
  How many packages are on Microsoft's official repository? Where can I see a list?
  - haunter 4y ago
    There are 2 sources. A community repo: https://github.com/microsoft/winget-pkgs/tree/master/manifests https://github.com/microsoft/winget-pkgs/tree/master/manifes... You can, and "highly encouraged" to pull request packages The other one is the MS App Store itself
_huayra_ 4y ago
I've been using Scoop on Windows [0]. Chocolatey is probably the more "professional" answer, but Scoop doesn't require Admin privileges, which I could never quite figure out how to do with Chocolatey. [0] https://scoop.sh/ https://scoop.sh/
acdha 4y ago
What’s the difference between the App Store and a package manager? Mostly it comes down to trust: I can give you Mac .pkg files all sorts of ways but what you really want is a way to know that I am who I claim to be. Package management has a boot-strapping problem for mainstream platforms: the same people telling the public that you should install Firefox using their ad bundle installer would instantly pivot to saying that you should install Firefox by adding their “store” to your system package repository list, and then SEO-ing their instructions as hard as they can. Homebrew works because the audience is heavily technical and they don’t accept every app. Change either of those and quality would decline, and gaps in package coverage normalizes the behavior of installing things from outside of the store. The real solution is probably something regulatory requiring Microsoft and Apple to run a basic store at cost, possibly allowing premium add-on services, or perhaps having a way to setup other stores with proof of liability insurance and auditing. The basic tier could be something like having a verification process for developers and a robust way to yank abusive apps.
- Terretta 4y ago
  > real solution is probably something regulatory requiring Microsoft and Apple to run a basic store at cost "At cost" for digital stores run well* appears to be between 12% and 18% depending how readily end users can unsubscribe or how easily they can end up interacting with a human for a support, since it costs more to be user friendly. Stores charging less, e.g. 8%, have processing billed separately, generally adds back up to 12% or more. Relative to that, keep in mind Apple's 30% in the first year drops to 15% in the second, and 85% of apps are hosted/delivered free. * "Well" as defined by end user, not by developer.
  - acdha 4y ago
    Yes, getting that balance right is tricky since there isn't a precise way to say how much additional features are worth to everyone. It could be low-cost if the service was just publisher ID verification and PKI, but then you'd see a lot of bottom feeders trying to stay just below the threshold where they'd get their signing key revoked. That might still be worthwhile if the idea was something like allowing your computer to have a policy saying it'll only run signed binaries but the default assumption is that most people should stick to the higher-margin more curated App Store since that would still make it more expensive to run malware / adware campaigns if you had to burn a business identity as each one was discovered.

tech234a 4y ago

Windows has winget built in.

vehemenz 4y ago
They allow anyone to submit to the repository with minimal vetting, and the package selection is inferior compared to Homebrew. Maybe we have different ideas about what "official" and "comprehensive" mean.
- izacus 4y ago
  I'd love to hear what "official" means to you and why that definition has value for a package manager.
  - vehemenz 4y ago
    Prima facie, a one-stop, secure, official (paid Microsoft employees working on it) source for binary downloads seems like it has plenty of value for end users. I'd be interested in knowing why keeping the Windows Store around and having a secondary package list for winget that most people don't use is a better paradigm.
consumer451 4y ago
I had no idea this existed. Neato! C:\>winget search "hacker news" Name Id Version Source ------------------------------------------------ Hacker News Reader 9WZDNCRDKBC1 Unknown msstore Hacker News (YC) 9NBLGGH1RHHV Unknown msstore I have no idea on the provenance of these packages, so will not be installing until I understand this more, but thanks for sharing winget. "winget search torrent" listed some apps which I had never heard of before. Here is winget's submission requirements info: > Expectations for submissions: > The manifest complies with the schema requirements. All URLs in the manifest lead to safe websites. > The installer and application are virus free. The package may be identified as malware by mistake. If you believe it is a false positive you can submit the installer to the Microsoft Defender team for analysis. > The application installs and uninstalls correctly for both administrators and non-administrators. > The installer supports non-interactive modes. > All manifest entries are accurate and not misleading. >The installer comes directly from the publisher's website. https://learn.microsoft.com/en-us/windows/package-manager/package/repository#validation-process https://learn.microsoft.com/en-us/windows/package-manager/pa...
- consumer451 4y ago
  Just wanted to add the most useful search I've found so far: C:\>winget search foss

haunter 4y ago

Windows does https://en.wikipedia.org/wiki/Windows_Package_Manager https://en.wikipedia.org/wiki/Windows_Package_Manager https://learn.microsoft.com/en-us/windows/package-manager/winget/ https://learn.microsoft.com/en-us/windows/package-manager/wi... And if not official then you can always use Chocolatey https://chocolatey.org/ https://chocolatey.org/

vehemenz 4y ago
How many packages are on Microsoft's official repository? Where can I see a list?
- haunter 4y ago
  There are 2 sources. A community repo: https://github.com/microsoft/winget-pkgs/tree/master/manifests https://github.com/microsoft/winget-pkgs/tree/master/manifes... You can, and "highly encouraged" to pull request packages The other one is the MS App Store itself

_huayra_ 4y ago

I've been using Scoop on Windows [0]. Chocolatey is probably the more "professional" answer, but Scoop doesn't require Admin privileges, which I could never quite figure out how to do with Chocolatey. [0] https://scoop.sh/ https://scoop.sh/

acdha 4y ago

What’s the difference between the App Store and a package manager? Mostly it comes down to trust: I can give you Mac .pkg files all sorts of ways but what you really want is a way to know that I am who I claim to be. Package management has a boot-strapping problem for mainstream platforms: the same people telling the public that you should install Firefox using their ad bundle installer would instantly pivot to saying that you should install Firefox by adding their “store” to your system package repository list, and then SEO-ing their instructions as hard as they can. Homebrew works because the audience is heavily technical and they don’t accept every app. Change either of those and quality would decline, and gaps in package coverage normalizes the behavior of installing things from outside of the store. The real solution is probably something regulatory requiring Microsoft and Apple to run a basic store at cost, possibly allowing premium add-on services, or perhaps having a way to setup other stores with proof of liability insurance and auditing. The basic tier could be something like having a verification process for developers and a robust way to yank abusive apps.

Terretta 4y ago
> real solution is probably something regulatory requiring Microsoft and Apple to run a basic store at cost "At cost" for digital stores run well* appears to be between 12% and 18% depending how readily end users can unsubscribe or how easily they can end up interacting with a human for a support, since it costs more to be user friendly. Stores charging less, e.g. 8%, have processing billed separately, generally adds back up to 12% or more. Relative to that, keep in mind Apple's 30% in the first year drops to 15% in the second, and 85% of apps are hosted/delivered free. * "Well" as defined by end user, not by developer.
- acdha 4y ago
  Yes, getting that balance right is tricky since there isn't a precise way to say how much additional features are worth to everyone. It could be low-cost if the service was just publisher ID verification and PKI, but then you'd see a lot of bottom feeders trying to stay just below the threshold where they'd get their signing key revoked. That might still be worthwhile if the idea was something like allowing your computer to have a policy saying it'll only run signed binaries but the default assumption is that most people should stick to the higher-margin more curated App Store since that would still make it more expensive to run malware / adware campaigns if you had to burn a business identity as each one was discovered.