Hacker News Reader

Comment by latitude | Hacker News Reader

I have the same reservations as eps. It's not how Chocolatey works, it is how it's administered.

With Steam and Microsoft I can be reasonably certain that I will not be getting an infected update. With Chocolatey, being a smaller entity, I have to assume the opposite until proven otherwise. It may work, it may have wide support, but none of it matters, because it may get me screwed. Bluntly put, Chocolatey is simply not trustworthy.

View on HN

That's a risk you take with all package managers. The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform. Chocolatey also won't install anything unless you ask it to, so if you don't consider them trustworthy, do your homework and check if the package is legit before installing it.

> The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform.

Just so you know, this is not true with any Linux distribution package manager that I know of. Packages and updates are always vetted by maintainers before they are available to user systems. Trust is intended to be at the distribution level; for Debian, for example, you can be confident that every package in the stable repository is fairly secure, tested software, and as long as you don't enable the non-free repo, every package is free and open source software as well.

This may or may not be true for Chocolatey, I don't know.

I did not know that. Is that true for all their package repos? or only for main?

Reply on news.ycombinator.com