Hacker News Reader

Comment by eps | Hacker News Reader

The heck is Chocolatey and why am I expected to trust them as a distributor of clean binaries? Rhetorical question.

I've been using Windows as a primary OS for over 20 years and there's no way in hell I am installing some random "package manager" just to get some other piece of software. This is not how things work on Windows. I am willing to assume that GitHub knows how to build and look after their distributions to keep them clean, but I am not going to extend the courtesy to Chocolatey, because they are basically no-ones, regardless of how nice and well-intentioned they are.

View on HN

KevinSawacki who owns the atom repo on Github is one of the maintainers, and chocolatey has been around for a while now. The reason they suggest chocolatey is because there's no auto updater for Windows atom yet, instead they recommend you use the update function from chocolatey.

With my builds, I had to announce them and poke some people who use my builds actively because of this issue, so that they would download the new version.

> KevinSawacki

Nice to know, but it doesn't move a needle a bit. I have no desire to establish trusting relationship with Kevin, but I am willing to trust GitHub.

Adding a simple update checker is as trivial as pulling a URL and seeing if the response contains a version number that is greater than your own. How is this too hard to add and how it justifies adding some random dependency that needs full admin rights to run?

As cwoac mentioned, Chocolatey is quite well etablished on Windows and has been for some time, it's not "some random dependency".

Pray tell how does being "quite well etablished" translate into being competent sysadmins and ensuring that they don't get compromised and won't end up pushing a whole load of crap on my box on the next update?

That is an argument against literally every updater or automatic check for updates. It applies equally to Chocolatey and to any auto-updater they could have used for Atom. Please go back and find a better reason.

I am not making up reasons, so you can keep "go and find a better one" to yourself.

There are no bulk auto-updaters on Windows except for Windows Update, which is professionally provisioned. If Chocolatey wants to act as one, it needs to measure up.

Chocolatey is fairly well established as wrapper around nuget that grabs windows binaries - indeed it's currently the only source type that microsoft's own package manager (oneget) supports (although they intend to provide others see http://blogs.technet.com/b/windowsserver/archive/2014/04/03/...)

The exact same file for Windows that is being fetched by Chocolatey is available here: https://github.com/atom/atom/releases

But I bet you're cool with using Steam for games?

Chocolatey isn't new, they run on Microsoft technology (nuget), and they have support from Microsoft themselves.

Yes, I am comfortable getting executables from Steam.

Then you should also be giving chocolatey a good look before rejecting it out of hand. It's a good system, it works, and it has wide support. It may not be quite as popular as Steam, but rejecting it purely based on 'I don't know it' is short-sighted.

I have the same reservations as eps. It's not how Chocolatey works, it is how it's administered.

With Steam and Microsoft I can be reasonably certain that I will not be getting an infected update. With Chocolatey, being a smaller entity, I have to assume the opposite until proven otherwise. It may work, it may have wide support, but none of it matters, because it may get me screwed. Bluntly put, Chocolatey is simply not trustworthy.

That's a risk you take with all package managers. The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform. Chocolatey also won't install anything unless you ask it to, so if you don't consider them trustworthy, do your homework and check if the package is legit before installing it.

> The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform.

Just so you know, this is not true with any Linux distribution package manager that I know of. Packages and updates are always vetted by maintainers before they are available to user systems. Trust is intended to be at the distribution level; for Debian, for example, you can be confident that every package in the stable repository is fairly secure, tested software, and as long as you don't enable the non-free repo, every package is free and open source software as well.

This may or may not be true for Chocolatey, I don't know.

I did not know that. Is that true for all their package repos? or only for main?

I am with eps here. I would rather manually update something then use an relatively unknown package manager. Even if the package is from Github and MS is behind the package manager.

As a long Windows user, I too was skeptical of Chocolatey (somewhere on the spectrum of "what's the point" to "oh no, more garbage"). An endorsement from GitHub makes me think twice, but I can totally understand your point of view -- it feels a little silly to install a package manager to install a single program.

Do you feel the same way about Ninite?

That's cool. There's no need to rant about it though. Why are you posting this? Are you expecting someone to come and change your mind? Are you expecting your totally original words of wisdom to cause everyone to abandon the project? Or are you just looking for a sandbox?

Not a rant. Consider it a public service announcement.

They are doing it in a way that is inherently wrong and doesn't work for a lot of people. And since they are being very casual about it, they get a louder message than they would've got if it were just one of the options.

A packaged installer would be nice, but this is an IDE, so I'm not too surprised it can be installed using a package manager that may not be mainstream.

I am concerned at the tone of your response and am sad so say I expected this to be at the top. I don't think your post is nice or adds value to HN. Consider saying nothing at all.

I am concerned that you decided to publicly school me on my commenting style. I don't think you comment is nice or adds value to HN. Consider saying nothing at all.

Reply on news.ycombinator.com