Item — HN Reader

I agree that packaging should be far easier, but I think the main problem is a lack of cross-distribution standardization.

My other 2c are that languages now have their own package managers is far bigger indication of the huge failing (of the overall ecosystem). apt-get is a blessing compared to npm, pip, cargo, and all that horrible garbage,.

1 comments

Indeed but the reason these languages have their own package managers is precisely because Apt et al are so unsuitable for the task. Primarily because:

1. They aren't cross-platform. NPM, Pip and Cargo all work identically on Mac, Windows and every Linux distro.

2. They are too heavily gate-kept. I can upload a package to PyPI, NPM or Crates.io without having to convince anyone that my project is worthy. This is a very good thing!

If the Linux community had made a packaging standard with similar properties maybe those languages would have used it.

> I can upload a package to PyPI, NPM or Crates.io without having to convince anyone that my project is worthy. This is a very good thing!

It's a good thing for me because I can upload my ransomware disguised as a file manager and people won't know it's ransomware until they run it. It's not such a good thing for my victims because they need to do their due diligence for each project instead of having a trustworthy maintainer vet it for them.

That's doesn't make any sense for at least two reasons:

1. Maintainers don't thoroughly vet packages. You should know this from a certain recent event that was all over the news!

2. Projects that don't want to deal with the main apt repo just set up PPAs and tell you the commands to copy/paste to add their keys and the PPA.

Are you sure you would've preferred the xz author to not have to jump through all the hoops they had to, and instead just press upload and boom everyone has it, like it has happened countless times in the node ecosystem?

Maintainers are a first line of defense. They are users of the software just like us, and share the same interests. This means that most obvious misbehavior (not necessarily malware but just anything anti-user or just general bugginess) is caught before it has broader impacts. The fact xz made it into the news is because it was an anomaly, and even then its impact was reduced to only the unstable versions of debian and such.

As for PPAs, you're right, adding a new repo means trusting a new set of maintainers. Thankfully only few software needs this so the amount you need to verify is relatively small.

Exactly, the xz issue is news because it (almost) by-passed the maintainers. For other packaging systems malware is already the norm.

Maintainers may not perfectly vet projects, but they do vet the projects that get added at least a little. Compare that to a repository where anyone can upload and promote actual virus software.

PPAs at least require the user to explicitly trust the source of packages. If a distro releases a package, that is a tad more trustworthy than a random PPA, because at least the distro maintainers (very experienced people) thought it was good enough and not a virus. The distinction between "official" and "unofficial" is not there when it comes to all those language-specific repos. Also, typo-squatting is not a thing with official Linux repos, because maintainers know to not let it happen.

1. More or less. They all suck in a similar way and often fail randomly. As you may notice, my experience wasn't good...

2. This is not a good thing in terms of security, long-term stability, and quality in general. But there should be a two-level system where you can upload easily so that other people who are careful can explore but then there should also be a quality controlled system like apt.

So yes, both points are true but I feel cross-platform package manager should be based on apt or similar with multi-level quality control, and npm, pip, and cargo and other low-quality attempts at package management should die IMHO.