[diggan]

But on the other hand, getting a library into debian so users can eventually install it is also a somewhat big and lengthy process that takes time (and rightly so), compared to npm et al which amounts to "npm publish" and you're done basically.

Don't get me wrong, I'm not saying one is better/worse than the other, but there are tradeoffs that not everyone is willing to make. I personally prefer the slower more intentional/reviewed option of package repositories like debian and arch, but things like npm/pypi/aur has their uses too.

[TZubiri]

>getting a library into debian is also a somewhat big and lengthy, compared to npm et al which amounts to "npm publish" and you're done basically.

Which is a good thing. It's not like npm skiddies use this agile process to revolutionize the industry with AGI, they do left pad and a different framework every week.

[knowitnone]

except how "reviewed" is it? You maintain a package for years to gain trust and once you become trusted, you've introduced a backdoor that most people won't know about.

[LtWorf]

That takes years of effort and if you get found out you get banned immediately. It's not a very common level of commitment for bad actors it seems.

[aucisson_masque]

There are different type of bad actors, some are ready to invest heavily, meaning time and money, some are there only to make a quick buck.

[LtWorf]

Ok. Can you point me one example that was in for a while before being caught?

[TZubiri]

Yeah sure washing your hands kills 99.99% of bacteria, but not 100%.

Why obsess over that 0.01% when surrounded by dark age skiddies who haven't discovered germ theory yet, focus the message: "wash your hands!"

[paulddraper]

Which is why a lot of people (even well-resourced companies e.g. Google) set up their own apt repo, and tell people to add that.