Comment by skylanh | Hacker News Reader

Comment by skylanh | Hacker News Reader

Parent Full thread

> Added their own packages version of every package.

> Added their own package repository (MRAN), replacing CRAN.

How is any of this different than the many incompatible Linux packaging solutions?

How would you address insecurity and trust relations if you weren't a first-class contributor of CRAN? (consider the recent Python package exploit; although amateur, it's still an indication of such issues; I'm sure I remember this was an issue with the Perl packages as well; wasn't there an exploit pushed to the Linux kernel tree at some point years ago?)

The narrative changes from "MS is EEE'ing CRAN" to "MS allowed a package with exploits to be deployed from CRAN".

I am not familiar with any of the issues within the R ecospace, but I am very familiar with corporate culture, security, and liability awareness.

> I am very familiar with corporate culture, security, and liability awareness

I thought the same thing many years ago. I was speaking with a friend (many years ago) who used to work for microsoft.

I said, "so they broke something and didn't support this, they're just developers and how do they know all the issues?" Basically, I was saying the coders were human, and sometimes getting something out is hard.

My friend said, "No, don't be naive. they had meetings. They sat around and said, "how can we own this?""

It might be interesting to revisit the (ancient) halloween documents:

https://catb.org/esr/halloween/halloween1.html

This also works in a benign fashion. Emergent behavior. People/roups and their interests bubble up the self-serving outcomes without being a conspiracy.

We have 4 features to support in this release. feature 1 is p0 it is basic functionality. feature 2 is p0 because 3 customers are asking for it. feature 3 is p0 because our team needs it to work with our other product. feature 4 is compatibility and we'll get to that as p1.

And now Google do the same in the browser. They're regularly being called out by Mozilian but most people dismiss it as "the coders are human".

Reply on news.ycombinator.com