4 ms·

The heck is Chocolatey and why am I expected to trust them as a distributor of clean binaries? Rhetorical question. I've been using Windows as a primary OS for

by eps 12y ago

The heck is Chocolatey and why am I expected to trust them as a distributor of clean binaries? Rhetorical question. I've been using Windows as a primary OS for over 20 years and there's no way in hell I am installing some random "package manager" just to get some other piece of software. This is not how things work on Windows. I am willing to assume that GitHub knows how to build and look after their distributions to keep them clean, but I am not going to extend the courtesy to Chocolatey, because they are basically no-ones, regardless of how nice and well-intentioned they are.

someguy1233 12y ago
KevinSawacki who owns the atom repo on Github is one of the maintainers, and chocolatey has been around for a while now. The reason they suggest chocolatey is because there's no auto updater for Windows atom yet, instead they recommend you use the update function from chocolatey. With my builds, I had to announce them and poke some people who use my builds actively because of this issue, so that they would download the new version.
- eps 12y ago
  > KevinSawacki Nice to know, but it doesn't move a needle a bit. I have no desire to establish trusting relationship with Kevin, but I am willing to trust GitHub. Adding a simple update checker is as trivial as pulling a URL and seeing if the response contains a version number that is greater than your own. How is this too hard to add and how it justifies adding some random dependency that needs full admin rights to run?
  - SuddsMcDuff 12y ago
    As cwoac mentioned, Chocolatey is quite well etablished on Windows and has been for some time, it's not "some random dependency".
    - eps 12y ago
      Pray tell how does being "quite well etablished" translate into being competent sysadmins and ensuring that they don't get compromised and won't end up pushing a whole load of crap on my box on the next update?
      - chton 12y ago
        That is an argument against literally every updater or automatic check for updates. It applies equally to Chocolatey and to any auto-updater they could have used for Atom. Please go back and find a better reason.
        eps 12y ago
        I am not making up reasons, so you can keep "go and find a better one" to yourself. There are no bulk auto-updaters on Windows except for Windows Update, which is professionally provisioned. If Chocolatey wants to act as one, it needs to measure up.
        eps 12y ago
        I am not making up reasons, so you can keep "go and find a better one" to yourself. There are no bulk auto-updaters on Windows except for Windows Update, which is professionally provisioned. If Chocolatey wants to act as one, it needs to measure up.
cwoac 12y ago
Chocolatey is fairly well established as wrapper around nuget that grabs windows binaries - indeed it's currently the only source type that microsoft's own package manager (oneget) supports (although they intend to provide others see http://blogs.technet.com/b/windowsserver/archive/2014/04/03/windows-management-framework-v5-preview.aspx http://blogs.technet.com/b/windowsserver/archive/2014/04/03/...)
KyeRussell 12y ago
That's cool. There's no need to rant about it though. Why are you posting this? Are you expecting someone to come and change your mind? Are you expecting your totally original words of wisdom to cause everyone to abandon the project? Or are you just looking for a sandbox?
- eps 12y ago
  Not a rant. Consider it a public service announcement. They are doing it in a way that is inherently wrong and doesn't work for a lot of people. And since they are being very casual about it, they get a louder message than they would've got if it were just one of the options.
chton 12y ago
But I bet you're cool with using Steam for games? Chocolatey isn't new, they run on Microsoft technology (nuget), and they have support from Microsoft themselves.
- eps 12y ago
  Yes, I am comfortable getting executables from Steam.
  - chton 12y ago
    Then you should also be giving chocolatey a good look before rejecting it out of hand. It's a good system, it works, and it has wide support. It may not be quite as popular as Steam, but rejecting it purely based on 'I don't know it' is short-sighted.
    - latitude 12y ago
      I have the same reservations as eps. It's not how Chocolatey works, it is how it's administered. With Steam and Microsoft I can be reasonably certain that I will not be getting an infected update. With Chocolatey, being a smaller entity, I have to assume the opposite until proven otherwise. It may work, it may have wide support, but none of it matters, because it may get me screwed. Bluntly put, Chocolatey is simply not trustworthy.
      - chton 12y ago
        That's a risk you take with all package managers. The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform. Chocolatey also won't install anything unless you ask it to, so if you don't consider them trustworthy, do your homework and check if the package is legit before installing it.
        catern 12y ago
pgt 12y ago
A packaged installer would be nice, but this is an IDE, so I'm not too surprised it can be installed using a package manager that may not be mainstream. I am concerned at the tone of your response and am sad so say I expected this to be at the top. I don't think your post is nice or adds value to HN. Consider saying nothing at all.
- eps 12y ago
  I am concerned that you decided to publicly school me on my commenting style. I don't think you comment is nice or adds value to HN. Consider saying nothing at all.
hnarn 12y ago
The exact same file for Windows that is being fetched by Chocolatey is available here: https://github.com/atom/atom/releases https://github.com/atom/atom/releases
Koldark 12y ago
I am with eps here. I would rather manually update something then use an relatively unknown package manager. Even if the package is from Github and MS is behind the package manager.
pit 12y ago
As a long Windows user, I too was skeptical of Chocolatey (somewhere on the spectrum of "what's the point" to "oh no, more garbage"). An endorsement from GitHub makes me think twice, but I can totally understand your point of view -- it feels a little silly to install a package manager to install a single program. Do you feel the same way about Ninite?

by eps 12y ago

someguy1233 12y ago

KevinSawacki who owns the atom repo on Github is one of the maintainers, and chocolatey has been around for a while now. The reason they suggest chocolatey is because there's no auto updater for Windows atom yet, instead they recommend you use the update function from chocolatey. With my builds, I had to announce them and poke some people who use my builds actively because of this issue, so that they would download the new version.

eps 12y ago
> KevinSawacki Nice to know, but it doesn't move a needle a bit. I have no desire to establish trusting relationship with Kevin, but I am willing to trust GitHub. Adding a simple update checker is as trivial as pulling a URL and seeing if the response contains a version number that is greater than your own. How is this too hard to add and how it justifies adding some random dependency that needs full admin rights to run?
- SuddsMcDuff 12y ago
  As cwoac mentioned, Chocolatey is quite well etablished on Windows and has been for some time, it's not "some random dependency".
  - eps 12y ago
    Pray tell how does being "quite well etablished" translate into being competent sysadmins and ensuring that they don't get compromised and won't end up pushing a whole load of crap on my box on the next update?
    - chton 12y ago
      That is an argument against literally every updater or automatic check for updates. It applies equally to Chocolatey and to any auto-updater they could have used for Atom. Please go back and find a better reason.
      - eps 12y ago
        I am not making up reasons, so you can keep "go and find a better one" to yourself. There are no bulk auto-updaters on Windows except for Windows Update, which is professionally provisioned. If Chocolatey wants to act as one, it needs to measure up.
      - eps 12y ago
        I am not making up reasons, so you can keep "go and find a better one" to yourself. There are no bulk auto-updaters on Windows except for Windows Update, which is professionally provisioned. If Chocolatey wants to act as one, it needs to measure up.

cwoac 12y ago

Chocolatey is fairly well established as wrapper around nuget that grabs windows binaries - indeed it's currently the only source type that microsoft's own package manager (oneget) supports (although they intend to provide others see http://blogs.technet.com/b/windowsserver/archive/2014/04/03/windows-management-framework-v5-preview.aspx http://blogs.technet.com/b/windowsserver/archive/2014/04/03/...)

KyeRussell 12y ago

That's cool. There's no need to rant about it though. Why are you posting this? Are you expecting someone to come and change your mind? Are you expecting your totally original words of wisdom to cause everyone to abandon the project? Or are you just looking for a sandbox?

eps 12y ago
Not a rant. Consider it a public service announcement. They are doing it in a way that is inherently wrong and doesn't work for a lot of people. And since they are being very casual about it, they get a louder message than they would've got if it were just one of the options.

chton 12y ago

But I bet you're cool with using Steam for games? Chocolatey isn't new, they run on Microsoft technology (nuget), and they have support from Microsoft themselves.

eps 12y ago
Yes, I am comfortable getting executables from Steam.
- chton 12y ago
  Then you should also be giving chocolatey a good look before rejecting it out of hand. It's a good system, it works, and it has wide support. It may not be quite as popular as Steam, but rejecting it purely based on 'I don't know it' is short-sighted.
  - latitude 12y ago
    I have the same reservations as eps. It's not how Chocolatey works, it is how it's administered. With Steam and Microsoft I can be reasonably certain that I will not be getting an infected update. With Chocolatey, being a smaller entity, I have to assume the opposite until proven otherwise. It may work, it may have wide support, but none of it matters, because it may get me screwed. Bluntly put, Chocolatey is simply not trustworthy.
    - chton 12y ago
      That's a risk you take with all package managers. The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform. Chocolatey also won't install anything unless you ask it to, so if you don't consider them trustworthy, do your homework and check if the package is legit before installing it.
      - catern 12y ago

pgt 12y ago

A packaged installer would be nice, but this is an IDE, so I'm not too surprised it can be installed using a package manager that may not be mainstream. I am concerned at the tone of your response and am sad so say I expected this to be at the top. I don't think your post is nice or adds value to HN. Consider saying nothing at all.

eps 12y ago
I am concerned that you decided to publicly school me on my commenting style. I don't think you comment is nice or adds value to HN. Consider saying nothing at all.

hnarn 12y ago

The exact same file for Windows that is being fetched by Chocolatey is available here: https://github.com/atom/atom/releases https://github.com/atom/atom/releases

Koldark 12y ago

I am with eps here. I would rather manually update something then use an relatively unknown package manager. Even if the package is from Github and MS is behind the package manager.

pit 12y ago

As a long Windows user, I too was skeptical of Chocolatey (somewhere on the spectrum of "what's the point" to "oh no, more garbage"). An endorsement from GitHub makes me think twice, but I can totally understand your point of view -- it feels a little silly to install a package manager to install a single program. Do you feel the same way about Ninite?