Hacker News Reader

Comment by jabroni_salad | Hacker News Reader

Some PDF-related apps used to bundle ghostscript's installer as a silent install and it would just appear in your programs list. Then those users would see a mysterous entity named ghostscript in their start menu and complain online about it being malware or whatever. The ghostscript people decided to disable their silent installer because of it.

The fallout has been that corpos can build it from their source and ship it themselves if they need it so bad, and users are always informed up front about what is coming to their computers.

Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies. The userbase has been made terminally paranoid by decades of trojans and adware installers.

View on HN

> Let that stick in your brain for next time you wonder why Windows still hasn't gotten a competent package manager that can wrangle dependencies.

winget?

Winget just runs installers and uninstallers. I don't think it wrangles dependencies. That is, it won't install a dependency as its own package, nor will it uninstall a dependency when the last dependent is uninstalled.

Every sane windows installer will take care of it.

Honestly, winget at this point is (or is about to be) suffering from the same trust issues GP described. I recently tried to provision a new Windows install with some software, and for many common tools, I found that winget offered suspiciously many similarly named options to choose from. Sometimes all the options look off in some way, like having weird vendor names.

For me, this is a regression compared to just downloading installers from the web - at least I find it easier to find the official site of the product (and distinguish it from fake sites with malware), and pull it from there. Or, increasingly often, get an installer from a Github release.

winget supports multiple sources and you can filter on them. One of the default sources is 'msstore' and includes the Microsoft Store and it shows all that junk unscrupulous vendors have added. (Keep in mind it is all reportable if it is pretending to be an open source tool but not from an "owner" developer. `winget show package-id` used to include the Store reporting URL but doesn't currently seem to show it. Maybe it was abused?) The other source is 'winget' which is mostly powered by an open source repo [1] that you can file issues against and even try to make PRs.

So far the "winget" source seems relatively well curated. `winget show Package.Id` seems to me reliable at matching up official sites/GitHub releases for that source.

At times I'm tempted to `winget source remove msstore` because it is full of so much junk, but I still also appreciate being able to manage store installs with winget.

[1] https://github.com/microsoft/winget-pkgs

Reply on news.ycombinator.com