[ris]

> I have been writing for years that package managers are a big security risk

"Wild-west"-style package managers (more specifically, their repos) are a big security risk.

It's possible to have far more confidence in "maintained" packaging repositories.

[tonyedgecombe]

The general trend has been towards less confidence in 3rd party software and packages. I'm not sure that is going to reverse any time soon.