3 ms·

You have to put a lot of trust in this Chocolatey thing ... do we know who is behind this ? The potential for a big security breach, especially in a Windows en

You have to put a lot of trust in this Chocolatey thing ... do we know who is behind this ? The potential for a big security breach, especially in a Windows environment, is making me less enthusiast than I should be.

nkerkin 13y ago
Fear not! Chocolatey[0] is open source. [0] - https://github.com/chocolatey/chocolatey https://github.com/chocolatey/chocolatey
- jmnicolas 13y ago
  Open source doesn't mean secure, it means we can audit the code. OpenSSL is open source too for that matter.
  - nkerkin 13y ago
    Agreed. I should have made it clear that I was responding more about the "who is behind this?" question and their possible motives, rather than passing judgement on whether it is secure or not.
NicoJuicy 13y ago
Chocolatey actually has been arround a long time... It was one of the first concepts that wrapped Nuget arround itself to install software packages. And it worked :) It's like apt-get
m0nty 13y ago
I've just started using Chocolatey and it's been a mixed experience. Overall, a speedy way to install software (no clicking, just type) but sometimes the packages are broken, so don't install, or don't include (for example) whatever is needed to be uninstalled. I'm not sure if there's any auditing on packages, which look to be submitted by individuals or small teams to their "gallery." I have a few misgivings about that in the same way as some of the unofficial repositories on CentOS or Ubuntu (which I also use). I'd like to recommend this in a production environment (I'm a config specialist at the moment ;) but I know what my manager would say. Useful at home though.
- MichaelGG 13y ago
  I tried using it to install some software, I think related to Ruby or Node? on a Windows box. At the time (a year ago) it seemed to be some buggy batch scripts that didn't accomplish anything. I also seem to recall it having you run scripts downloaed over HTTP. Hopefully this has all changed if Microsoft is picking it up.
- blablabla123 13y ago
  Actually I have used it in the past in a production environments to setup laptops for my former colleagues. Not only it installed stuff everybody needed anyway, it also did setup the printer (non-trivial for not so technical folks) and created some basic short cuts on the Desktop. But I would assume that it behaves differently and fresh Windows installations and private installations that usually tend to be messier...
thaiphan 13y ago
It's maintained by Rob Reynolds who works at Puppet Labs.

nkerkin 13y ago

Fear not! Chocolatey[0] is open source. [0] - https://github.com/chocolatey/chocolatey https://github.com/chocolatey/chocolatey

jmnicolas 13y ago
Open source doesn't mean secure, it means we can audit the code. OpenSSL is open source too for that matter.
- nkerkin 13y ago
  Agreed. I should have made it clear that I was responding more about the "who is behind this?" question and their possible motives, rather than passing judgement on whether it is secure or not.

NicoJuicy 13y ago

Chocolatey actually has been arround a long time... It was one of the first concepts that wrapped Nuget arround itself to install software packages. And it worked :) It's like apt-get

m0nty 13y ago

I've just started using Chocolatey and it's been a mixed experience. Overall, a speedy way to install software (no clicking, just type) but sometimes the packages are broken, so don't install, or don't include (for example) whatever is needed to be uninstalled. I'm not sure if there's any auditing on packages, which look to be submitted by individuals or small teams to their "gallery." I have a few misgivings about that in the same way as some of the unofficial repositories on CentOS or Ubuntu (which I also use). I'd like to recommend this in a production environment (I'm a config specialist at the moment ;) but I know what my manager would say. Useful at home though.

MichaelGG 13y ago
I tried using it to install some software, I think related to Ruby or Node? on a Windows box. At the time (a year ago) it seemed to be some buggy batch scripts that didn't accomplish anything. I also seem to recall it having you run scripts downloaed over HTTP. Hopefully this has all changed if Microsoft is picking it up.
blablabla123 13y ago
Actually I have used it in the past in a production environments to setup laptops for my former colleagues. Not only it installed stuff everybody needed anyway, it also did setup the printer (non-trivial for not so technical folks) and created some basic short cuts on the Desktop. But I would assume that it behaves differently and fresh Windows installations and private installations that usually tend to be messier...

thaiphan 13y ago

It's maintained by Rob Reynolds who works at Puppet Labs.