3 ms·
But on the other hand, getting a library into debian so users can eventually install it is also a somewhat big and lengthy process that takes time (and rightly
by diggan 2y ago
But on the other hand, getting a library into debian so users can eventually install it is also a somewhat big and lengthy process that takes time (and rightly so), compared to npm et al which amounts to "npm publish" and you're done basically.
Don't get me wrong, I'm not saying one is better/worse than the other, but there are tradeoffs that not everyone is willing to make. I personally prefer the slower more intentional/reviewed option of package repositories like debian and arch, but things like npm/pypi/aur has their uses too.
- knowitnone 2y agoexcept how "reviewed" is it? You maintain a package for years to gain trust and once you become trusted, you've introduced a backdoor that most people won't know about.
- LtWorf 2y agoThat takes years of effort and if you get found out you get banned immediately. It's not a very common level of commitment for bad actors it seems.
- aucisson_masque 2y agoThere are different type of bad actors, some are ready to invest heavily, meaning time and money, some are there only to make a quick buck.
- TZubiri 2y agoYeah sure washing your hands kills 99.99% of bacteria, but not 100%. Why obsess over that 0.01% when surrounded by dark age skiddies who haven't discovered germ theory yet, focus the message: "wash your hands!"
- LtWorf 2y agoOk. Can you point me one example that was in for a while before being caught?
- TZubiri 2y ago>getting a library into debian is also a somewhat big and lengthy, compared to npm et al which amounts to "npm publish" and you're done basically. Which is a good thing. It's not like npm skiddies use this agile process to revolutionize the industry with AGI, they do left pad and a different framework every week.
- paulddraper 2y agoWhich is why a lot of people (even well-resourced companies e.g. Google) set up their own apt repo, and tell people to add that.