Hacker News Reader

Comment by calais | Hacker News Reader

This is a flaw with the repository model for software distribution: it confers the authority of the OS developers to packages not scrutinized to the same degree.

Users' metal models of trustworthiness don't track very well the actual scrutiny software is subjected to. This might be a problem with any distribution system.

View on HN

FWIW, as far as "scrutiny" goes, I think the track record of Red Hat and Debian/Ubuntu on this stuff is about as good as... well, basically any other distribution system I'm aware of. The Android and iOS stores have hosted malware, as has Microsoft's. Steam has pushed bad stuff. NPM is a straight up train wreck...

I mean, I agree in principle that it's a hard problem. But the actual solution we've landed on in the Linux world seems like... well, just not really the first thing we should be worried about.

That's definitely the feeling I've gotten from the Debian repositories, which are very cautious about what to distribute. I was thinking about it in the abstract.

What's the solution? I would argue that the Linux model is way more secure than the windows model of "Google your software and download it from whatever website pops up". It also allows for much more freedom and availability than the locked down macos app store.

It's a tough balancing act.

I think you're overestimating the rigor of other software delivery channels. Consider for instance that the biggest Windows SSH client (PuTTY) was delivered over http from a super sketchy looking website until very recently. Now it's the same super sketchy looking website, but with a green lock!

Haven't used Putty (or Windows, for that matter) for a while, but the site does not look sketchy at all. It looks like either a two decades old site, or a site of someone who purposely objects the modern web design tendencies (and believes some of the earlier mantras of web design, like user should have control of line lenghts by resizing their window).

A "sketchy" web site is the one festered with ads, pop-ups, seemingly modern-looking but with no actual content or with dead links...

Reply on news.ycombinator.com