4 ms·
Watching language package managers reinvent everything distribution package managers have been doing since the 90s has been as fun as watching crypto people rei
by noosphr 3mo ago
Watching language package managers reinvent everything distribution package managers have been doing since the 90s has been as fun as watching crypto people reinvent financial regulation.
- woodruffw 3mo agoThe publishing topology is pretty fundamentally different: the entire power (and danger) of language package managers is that anybody can publish, not just a privileged few. (This cuts both ways: I’d say that distribution package managers have learned valuable lessons about what users actually want from language package managers. Learning is a good thing.)
- oneshtein 3mo agoWhy not to create a separate list of verified package versions for most popular packages, AKA «stable» channel? Use stable channel for typical packages, use bleeding edge channel for some specific packages only.
- philipwhiuk 3mo ago> verified package versions Who is doing this verification?
- cheschire 3mo agoAnd then who watches the watchmen? Chains of authority can always be questioned. I think GP is suggesting that the package management platforms themselves provide the verification if they want to stay in the business of being the de facto source.
- oneshtein 3mo agoThose with skin in the game.
- kibwen 3mo agoThis comparison is tiresome. Distro package managers are curated, language package managers are not. They're serving completely different use cases; the former is the App Store, the latter is the web.
- noosphr 3mo agoGive it two years.
- kibwen 3mo agoTwo years until... what, exactly?
- bitmasher9 3mo agoThey are literally solving the same problem, it’s just that distro packages operate on a lower level and thus receive more scrutiny. There have been plenty of examples of poisoned Linux packages, both at the source level and at the package level.
- zarzavat 3mo agoA distro package manager provides access to a small set of packages that the distro thinks you might like. A language package manager provides access to the full set of packages. The language level package manager is solving a more ambitious problem. Distro package managers don't solve the problem they just punt on it, saying "you can add an unofficial source but you're on your own to maintain security". I agree with GP that the comparison is tiresome.
- bitmasher9 3mo agoDebian stable has over 69,000 packages, which is more then some languages have…
- stingraycharles 3mo ago