3 ms·
They are literally solving the same problem, it’s just that distro packages operate on a lower level and thus receive more scrutiny. There have been plenty of e
by bitmasher9 3mo ago
They are literally solving the same problem, it’s just that distro packages operate on a lower level and thus receive more scrutiny. There have been plenty of examples of poisoned Linux packages, both at the source level and at the package level.
- zarzavat 3mo agoA distro package manager provides access to a small set of packages that the distro thinks you might like. A language package manager provides access to the full set of packages. The language level package manager is solving a more ambitious problem. Distro package managers don't solve the problem they just punt on it, saying "you can add an unofficial source but you're on your own to maintain security". I agree with GP that the comparison is tiresome.
- bitmasher9 3mo agoDebian stable has over 69,000 packages, which is more then some languages have…
- stingraycharles 3mo agoIt’s not about quantity but target audience and use case. They solve different problems.
- bitmasher9 3mo agoI don’t understand how they aren’t both generalized to “distributes software with versioning at a large scale”
- stingraycharles 3mo agoBecause they both have very different management processes (centralized vs distributed) and release cycles. They solve different problems.
- cmeacham98 3mo agoThe difference comes from the fact distro maintainers choose the software they package, while language maintainers largely don't. For example, how do you prevent somebody from phishing/typosquatting users with a package named similarly to a popular one? For distro maintainers the answer is simple - don't package it. Debian is unlikely to add a "f1refox" package. Language maintainers don't have that luxury.
- bitmasher9 3mo agoI think that’s a difference in implementation details, not a difference in what it fundamentally is. I’m not arguing that there aren’t differences between the two, I’m arguing that they are fundamentally the same solution (gather all of the software in one location with) to same problem (how can I safely download some software).
- woodruffw 3mo agoThey are very fundamentally different solutions: the entire premise of distribution packaging is that you’re relying on some distribution maintainer’s discretion. It’s not an open index.
- oneshtein 3mo agoThis is exactly what users wants in this case: someone need to check a package and mark it as safe to use.
- brabel 3mo agoOh what?? Most package managers do try to prevent typo squatting!! Your insistence that there’s something fundamentally different between different package managers is just weird! Debian, as npm, lets you package and distribute software. The differences between them are related to policy preferences but the basic idea is the same!
- IshKebab 3mo ago69,000 sounds like a lot, but it's still missing maybe 30% of the packages I want to install.
- LtWorf 3mo agoPackage them for Debian as well then?
- IshKebab 3mo agoErrm no? What kind of a solution is that?
- stingraycharles 3mo agoI don’t know what’s up with this thread, for some reason people insist that language packages and distro packages are nearly the same. There must be a lot of packages for languages that are useful that simply never make it into Debian stable. “Where’s the patch” really isn’t an answer for this.
- stingraycharles 3mo ago> They are literally solving the same problem No they’re not. Distro packages cater to end users and have very different release cycles and maintenance processes. Distro packages are managed top-down (pushed by maintainers), while language packages are managed bottom-up (pushed by authors), so to say.