3 ms·

This comparison is tiresome. Distro package managers are curated, language package managers are not. They're serving completely different use cases; the former

by kibwen 3mo ago

This comparison is tiresome. Distro package managers are curated, language package managers are not. They're serving completely different use cases; the former is the App Store, the latter is the web.

noosphr 3mo ago
Give it two years.
- kibwen 3mo ago
  Two years until... what, exactly?
bitmasher9 3mo ago
They are literally solving the same problem, it’s just that distro packages operate on a lower level and thus receive more scrutiny. There have been plenty of examples of poisoned Linux packages, both at the source level and at the package level.
- zarzavat 3mo ago
  A distro package manager provides access to a small set of packages that the distro thinks you might like. A language package manager provides access to the full set of packages. The language level package manager is solving a more ambitious problem. Distro package managers don't solve the problem they just punt on it, saying "you can add an unofficial source but you're on your own to maintain security". I agree with GP that the comparison is tiresome.
  - bitmasher9 3mo ago
    Debian stable has over 69,000 packages, which is more then some languages have…
    - stingraycharles 3mo ago
      It’s not about quantity but target audience and use case. They solve different problems.
      - bitmasher9 3mo ago
        I don’t understand how they aren’t both generalized to “distributes software with versioning at a large scale”
        stingraycharles 3mo ago
        Because they both have very different management processes (centralized vs distributed) and release cycles. They solve different problems.
        cmeacham98 3mo ago
        The difference comes from the fact distro maintainers choose the software they package, while language maintainers largely don't. For example, how do you prevent somebody from phishing/typosquatting users with a package named similarly to a popular one? For distro maintainers the answer is simple - don't package it. Debian is unlikely to add a "f1refox" package. Language maintainers don't have that luxury.
        bitmasher9 3mo ago
        I think that’s a difference in implementation details, not a difference in what it fundamentally is. I’m not arguing that there aren’t differences between the two, I’m arguing that they are fundamentally the same solution (gather all of the software in one location with) to same problem (how can I safely download some software).
        woodruffw 3mo ago
        They are very fundamentally different solutions: the entire premise of distribution packaging is that you’re relying on some distribution maintainer’s discretion. It’s not an open index.
- stingraycharles 3mo ago
  > They are literally solving the same problem No they’re not. Distro packages cater to end users and have very different release cycles and maintenance processes. Distro packages are managed top-down (pushed by maintainers), while language packages are managed bottom-up (pushed by authors), so to say.
0xbadcafebee 3mo ago
I agree it's tiresome that language package managers continue to be an embarrassment. But actually your comparison is incorrect, distros are nothing like app stores. App stores are full of the same junk and malware as language package managers. Distros are vetted collections of real software that use modern best practices to secure the software supply chain.
- woodruffw 3mo ago
  Being unable to rotate the same weak RSA key for over a decade because it was too operationally cumbersome[1] does not strike me as “modern best practices.” I also don’t think any Linux distribution package maintainer would make a legally binding claim to have “vetted” packages: the filter is reputational, not a strong guarantee that the package is not malicious. The xz incident demonstrates that tidily: the only reason it was caught it because it was noisy; the package itself was presumed to be safe. (This is, to be clear, fine. But we should be clear-headed about what package distribution mechanisms actually provide in terms of guarantees.) [1]: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1461834 https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1461834
  - 0xbadcafebee 3mo ago
    Two security incidents over decades is proof that distros are more secure, not less. Every other system for distributing software has weekly security issues. > what package distribution mechanisms actually provide in terms of guarantees 1) Mirrors of cryptographically signed files to verify integrity (both the source code and the built packages), 2) a secure software supply chain & SBOM, 3) reproducible builds (for some distros), 4) humans independent of the authors vetting admittance of new packages to prevent obvious malware, 5) stable branches of packages that work together (preventing need to constantly upgrade, a source of new vulnerabilities), 6) backported security patches (necessary if you can't upgrade), 7) package maintainers fixing glaring security holes in the default installation methods of software to prevent the distro from having new vulnerabilities.
    - woodruffw 3mo ago
moring 3mo ago
> language package managers are not [curated] Why not? Seems like exactly what is being asked for.
- kibwen 3mo ago
  Curated by whom? If you want to curate a language package manager, there's nobody stopping you. Curation is a product that can trivially be built on top of an allow-by-default platform. If you want to make "NPM, except we've vetted all the packages", you can just do that, today, and you can even make use of all the OSS packages that already exist on NPM. Your hypothesis is that people want this, would value it if it existed, and would maybe even pay for it. So what's stopping people? Anyone who hasn't thought deeply enough to answer this question doesn't have the privelige to say "just curate it, what's the problem?". Curation isn't that simple, as any distro package manager volunteer would tell you.
  - moring 3mo ago
    > Anyone who hasn't thought deeply enough to answer this question doesn't have the privelige to say "just curate it, what's the problem?". Curation isn't that simple, as any distro package manager volunteer would tell you. Your logic is self-defeating. How are distro volunteers going to know that you are interested in this topic if, by your logic, you don't have the privilege to ask them in the first place? But I don't think that asking needs any privilege. I'm going to ask again: Why not? Or worded differently: What is stopping language package managers that is not at the same time stopping distro package managers?

by kibwen 3mo ago

noosphr 3mo ago

Give it two years.

kibwen 3mo ago
Two years until... what, exactly?

bitmasher9 3mo ago

They are literally solving the same problem, it’s just that distro packages operate on a lower level and thus receive more scrutiny. There have been plenty of examples of poisoned Linux packages, both at the source level and at the package level.

zarzavat 3mo ago
A distro package manager provides access to a small set of packages that the distro thinks you might like. A language package manager provides access to the full set of packages. The language level package manager is solving a more ambitious problem. Distro package managers don't solve the problem they just punt on it, saying "you can add an unofficial source but you're on your own to maintain security". I agree with GP that the comparison is tiresome.
- bitmasher9 3mo ago
  Debian stable has over 69,000 packages, which is more then some languages have…
  - stingraycharles 3mo ago
    It’s not about quantity but target audience and use case. They solve different problems.
    - bitmasher9 3mo ago
      I don’t understand how they aren’t both generalized to “distributes software with versioning at a large scale”
      - stingraycharles 3mo ago
        Because they both have very different management processes (centralized vs distributed) and release cycles. They solve different problems.
      - cmeacham98 3mo ago
        The difference comes from the fact distro maintainers choose the software they package, while language maintainers largely don't. For example, how do you prevent somebody from phishing/typosquatting users with a package named similarly to a popular one? For distro maintainers the answer is simple - don't package it. Debian is unlikely to add a "f1refox" package. Language maintainers don't have that luxury.
        bitmasher9 3mo ago
        I think that’s a difference in implementation details, not a difference in what it fundamentally is. I’m not arguing that there aren’t differences between the two, I’m arguing that they are fundamentally the same solution (gather all of the software in one location with) to same problem (how can I safely download some software).
        woodruffw 3mo ago
        They are very fundamentally different solutions: the entire premise of distribution packaging is that you’re relying on some distribution maintainer’s discretion. It’s not an open index.
stingraycharles 3mo ago
> They are literally solving the same problem No they’re not. Distro packages cater to end users and have very different release cycles and maintenance processes. Distro packages are managed top-down (pushed by maintainers), while language packages are managed bottom-up (pushed by authors), so to say.

0xbadcafebee 3mo ago

I agree it's tiresome that language package managers continue to be an embarrassment. But actually your comparison is incorrect, distros are nothing like app stores. App stores are full of the same junk and malware as language package managers. Distros are vetted collections of real software that use modern best practices to secure the software supply chain.

woodruffw 3mo ago
Being unable to rotate the same weak RSA key for over a decade because it was too operationally cumbersome[1] does not strike me as “modern best practices.” I also don’t think any Linux distribution package maintainer would make a legally binding claim to have “vetted” packages: the filter is reputational, not a strong guarantee that the package is not malicious. The xz incident demonstrates that tidily: the only reason it was caught it because it was noisy; the package itself was presumed to be safe. (This is, to be clear, fine. But we should be clear-headed about what package distribution mechanisms actually provide in terms of guarantees.) [1]: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1461834 https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1461834
- 0xbadcafebee 3mo ago
  Two security incidents over decades is proof that distros are more secure, not less. Every other system for distributing software has weekly security issues. > what package distribution mechanisms actually provide in terms of guarantees 1) Mirrors of cryptographically signed files to verify integrity (both the source code and the built packages), 2) a secure software supply chain & SBOM, 3) reproducible builds (for some distros), 4) humans independent of the authors vetting admittance of new packages to prevent obvious malware, 5) stable branches of packages that work together (preventing need to constantly upgrade, a source of new vulnerabilities), 6) backported security patches (necessary if you can't upgrade), 7) package maintainers fixing glaring security holes in the default installation methods of software to prevent the distro from having new vulnerabilities.
  - woodruffw 3mo ago

moring 3mo ago

> language package managers are not [curated] Why not? Seems like exactly what is being asked for.

kibwen 3mo ago
Curated by whom? If you want to curate a language package manager, there's nobody stopping you. Curation is a product that can trivially be built on top of an allow-by-default platform. If you want to make "NPM, except we've vetted all the packages", you can just do that, today, and you can even make use of all the OSS packages that already exist on NPM. Your hypothesis is that people want this, would value it if it existed, and would maybe even pay for it. So what's stopping people? Anyone who hasn't thought deeply enough to answer this question doesn't have the privelige to say "just curate it, what's the problem?". Curation isn't that simple, as any distro package manager volunteer would tell you.
- moring 3mo ago
  > Anyone who hasn't thought deeply enough to answer this question doesn't have the privelige to say "just curate it, what's the problem?". Curation isn't that simple, as any distro package manager volunteer would tell you. Your logic is self-defeating. How are distro volunteers going to know that you are interested in this topic if, by your logic, you don't have the privilege to ask them in the first place? But I don't think that asking needs any privilege. I'm going to ask again: Why not? Or worded differently: What is stopping language package managers that is not at the same time stopping distro package managers?