Hacker News Reader

Comment by bornfreddy | Hacker News Reader

I am starting to think that what we need is package distributions. That is, forked popular packages that are hand-vetted by a group of maintainers, just to make sure that some random malware doesn't find its way into the dependencies. If you want the latest and greatest, or want your custum dependencies checked, you pay. Otherwise it's free.

I'm quite sure that the market for this is really big. Does something like this already exist?

View on HN

That sounds like a Linux distro with the base OS factored out; the only difference between that and, say, Debian, is that Debian is a kernel + core userspace and not just application libraries. I'm not aware of anything quite like that already existing, but OS distros are sufficient prior art for me to think that it could work.

EDIT: Actually, there are package managers + package collections that intentionally can be installed on top of an existing OS; nix/nixpkgs and pkgsrc are probably the big ones. I'm not 100% sure that those are what you want today, but it's likely that if you could get maintainers to add your desired packages they'd be accepted there.

It also describes software ecosystems like the apache software foundation, dotnet foundation or even just community vetting like PHP has with Tidelift (which is a pretty clever idea on its own) etc...

Yup, I knew I wasn't the first one to see an opportunity here. :) Tidelift sounds great, thank you!

Isn't that kind of antifactory? Still, that also opens up the question of timely updates to solve possible security vulnerabilities.

Reply on news.ycombinator.com