3 ms·

> The biggest of those is NPM, I think No, it's not even a Linux package repository. Think repositories for Debian, Fedora, Arch, etc.

• Arnt 3y ago
  I mentioned it because it contains a lot of GPL-licensed packages, and a lot of it's used on linux, and it's at least near the scale of the app store. It falls a little short along all three axes, but it seems to be the closest. I don't think either Debian, Fedora or Arch are anywhere close to a million packages or a thousand updates per day. Well below 10%. They're GNUish and 100% linux, but really bad on the size axis. The app store has at least two classes of problems that those three don't have, and have to handle the problems at much higher scale. "Those guys manage to handle a simpler problem at much smaller scale, so it's possible for the app store too" is hardly an argument.
  • fsflover 3y ago
    Is the malware in NPM in the GPL part? I guess no, so this is my point: FLOSS repos can be trusted.
    • Arnt 3y ago
      Yes it is. Most likely also in the other part, although link I included doesn't mention any of that. The key appears to be: A large repo with lots of uploaders, some of which guard their passwords poorly. As long as a FLOSS repo is small and has few uploaders, it'll be safe. Hardly a model for a big and busy repo like the app store, of couse.