| HN Mirror

I feel like Chocolatey had some good moments early on, but I realized that I stopped using it because I started to feel like I needed to audit every PowerShell installation script it tries to run (and that's the majority of how it operates; the majority of "packages" are just PowerShell scripts that in turn download an MSI from a well known location, checksum it [maybe], and run it), because of all the poorly maintained packages and some increasingly worrisome PowerShell scripts in some of them. Particularly with things like Software Development tools, you could also never tell if a package was "just" a minimal install of the software or some particular developer's preferred kitchen sink, and the package dependency model alone wasn't enough to tell you because it might just be buried in the PowerShell installer directly rather than in the declarative dependencies.

As someone else notes, weirdly Chocolatey's packages seemed to get worse and grow staler after the Kickstarter than before. I guess in hindsight it's about where I stopped feeling an interest in volunteering to help packages, but I'm not sure if it was subconsciously about "what was the Kickstarter money for?" or not. I feel it was more the "kitchen sink" problem that hurt my interest in Chocolatey most directly, because those maintainers would happily sit on the most common name for an application (say, "python") with their kitchen sink, wouldn't take suggestions to better their packages and then you just ended up having to wade through search listings for "slim-python" or "real-python" or "just-python" or "brians-lite-python" or "python-dave13". It stopped feeling like a helpful community and more "every developer for themselves" at that point.