Hacker News Reader

Comment by eps | Hacker News Reader

Yes, I am comfortable getting executables from Steam.

Then you should also be giving chocolatey a good look before rejecting it out of hand. It's a good system, it works, and it has wide support. It may not be quite as popular as Steam, but rejecting it purely based on 'I don't know it' is short-sighted.

I have the same reservations as eps. It's not how Chocolatey works, it is how it's administered.

With Steam and Microsoft I can be reasonably certain that I will not be getting an infected update. With Chocolatey, being a smaller entity, I have to assume the opposite until proven otherwise. It may work, it may have wide support, but none of it matters, because it may get me screwed. Bluntly put, Chocolatey is simply not trustworthy.

That's a risk you take with all package managers. The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform. Chocolatey also won't install anything unless you ask it to, so if you don't consider them trustworthy, do your homework and check if the package is legit before installing it.

> The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform.

Just so you know, this is not true with any Linux distribution package manager that I know of. Packages and updates are always vetted by maintainers before they are available to user systems. Trust is intended to be at the distribution level; for Debian, for example, you can be confident that every package in the stable repository is fairly secure, tested software, and as long as you don't enable the non-free repo, every package is free and open source software as well.

This may or may not be true for Chocolatey, I don't know.

I did not know that. Is that true for all their package repos? or only for main?

Reply on news.ycombinator.com