2 ms·
The publishing topology is pretty fundamentally different: the entire power (and danger) of language package managers is that anybody can publish, not just a pr
by woodruffw 3mo ago
The publishing topology is pretty fundamentally different: the entire power (and danger) of language package managers is that anybody can publish, not just a privileged few.
(This cuts both ways: I’d say that distribution package managers have learned valuable lessons about what users actually want from language package managers. Learning is a good thing.)
- oneshtein 3mo agoWhy not to create a separate list of verified package versions for most popular packages, AKA «stable» channel? Use stable channel for typical packages, use bleeding edge channel for some specific packages only.
- philipwhiuk 3mo ago> verified package versions Who is doing this verification?
- cheschire 3mo agoAnd then who watches the watchmen? Chains of authority can always be questioned. I think GP is suggesting that the package management platforms themselves provide the verification if they want to stay in the business of being the de facto source.
- oneshtein 3mo agoThose with skin in the game.