I wonder why the author recommend winget but not scoop. Scoop obviously has more community support and that's the most important part of a package manager (more packages, more frequent update, etc).
Scott Hanselman works for Microsoft and is a prominent advocate for the .NET/Microsoft ecosystem so his recommendations are likely to skew towards native MS tools in the first instance.
Nothing wrong with that as long as you consume his material through that lens!
That said, I'm quite surprised I hadn't heard of Scoop[0]. Looks interesting...
[0] https://scoop.sh
Is that a good thing?
(Of course, you should. But sometimes it’s not an option.)
While they could prevent it, that's not how. The software is never "installed". It's only unzipped to scoops install directory (usually home/scoop/...)
Then it adds the install directory to the PATH and it's done. The copied executables have never been marked as unknown by windows in my experience.
Admins could of course lock down systems to only allow executables with specific hashedls which are manually whitelisted by the admins, but just disallowing installs won't help at all
Disallowing powershell or scripting altogether makes it impossible to use as well.
You can't really do that, as pwsh can be embedded easily.
I have a remote access to a ubuntu server, and I tried to use my zshrc but there is no zsh installed. Maybe asking the admin of the server to install zsh is another way to do it, but I managed to compile zsh and use it as my default shell. Although it works, but I wish that there is a easier way to install software locally without having to resort to compiling.
I recall that the developer of AppGet claiming [0] that Microsoft effectively "stole" AppGet from him.
[0]: https://medium.com/@keivan/the-day-appget-died-e9a5c96c8b22
[1] https://github.com/microsoft/winget-cli/blob/master/doc/wind...
Pretty much everything major with a installer is covered.
This may not be Scoops fault. I installed Irfanview with choco and have to reset my default programs setting every so often, presumably since Windows 10 takes user settings as suggestions for the Microsoft PM to ignore every few weeks when the OKRs get thin :).
https://github.com/lukesampson/scoop/wiki/Chocolatey-Compari...
One advantage is that scoop installs (most) tools into a common place and search path, and thus doesn't pollute environment variables as much.
However I'm wary of all these tools (including brew on Mac) as they all feel like a pretty efficient way to main line your own personal supply chain attack into your dev machine!
For that reason I now try to use them sparingly and with a high degree of suspicion.
As for threat model it comes down to whether using package management poses larger risk than doing everything manually and risking running a range of outdated packages.
The official software repo might be smaller than chocolate's, but to my eye, as it is moderated through a single open github repo, it seems much simpler.
I wonder if improving this is possible within the current design of Windows or if it would be a fundamental change in how it handles user privileges.
Won't the runas command (https://docs.microsoft.com/en-us/previous-versions/windows/i...) let you do this - run a command as Administrator without opening another command/powershell prompt?
Works like on linux. Runas and friends are junk.
From a non-elevated shell (cmd or ps), you can run `sudo <command>` to a roughly equivalent effect from *nix terminals. I find it meets my needs.
Something like RunAs? [0]
--