[bitmasher9]

They are literally solving the same problem, it’s just that distro packages operate on a lower level and thus receive more scrutiny. There have been plenty of examples of poisoned Linux packages, both at the source level and at the package level.

[stingraycharles]

> They are literally solving the same problem

No they’re not. Distro packages cater to end users and have very different release cycles and maintenance processes.

Distro packages are managed top-down (pushed by maintainers), while language packages are managed bottom-up (pushed by authors), so to say.

[zarzavat]

A distro package manager provides access to a small set of packages that the distro thinks you might like. A language package manager provides access to the full set of packages. The language level package manager is solving a more ambitious problem.

Distro package managers don't solve the problem they just punt on it, saying "you can add an unofficial source but you're on your own to maintain security". I agree with GP that the comparison is tiresome.

[bitmasher9]

Debian stable has over 69,000 packages, which is more then some languages have…

[IshKebab]

69,000 sounds like a lot, but it's still missing maybe 30% of the packages I want to install.

[LtWorf]

Package them for Debian as well then?

[IshKebab]

Errm no? What kind of a solution is that?

[stingraycharles]

I don’t know what’s up with this thread, for some reason people insist that language packages and distro packages are nearly the same.

There must be a lot of packages for languages that are useful that simply never make it into Debian stable. “Where’s the patch” really isn’t an answer for this.

[stingraycharles]

It’s not about quantity but target audience and use case. They solve different problems.

[bitmasher9]

I don’t understand how they aren’t both generalized to “distributes software with versioning at a large scale”

[stingraycharles]

Because they both have very different management processes (centralized vs distributed) and release cycles. They solve different problems.

[cmeacham98]

The difference comes from the fact distro maintainers choose the software they package, while language maintainers largely don't.

For example, how do you prevent somebody from phishing/typosquatting users with a package named similarly to a popular one? For distro maintainers the answer is simple - don't package it. Debian is unlikely to add a "f1refox" package. Language maintainers don't have that luxury.

[brabel]

Oh what?? Most package managers do try to prevent typo squatting!! Your insistence that there’s something fundamentally different between different package managers is just weird! Debian, as npm, lets you package and distribute software. The differences between them are related to policy preferences but the basic idea is the same!

[bitmasher9]

I think that’s a difference in implementation details, not a difference in what it fundamentally is.

I’m not arguing that there aren’t differences between the two, I’m arguing that they are fundamentally the same solution (gather all of the software in one location with) to same problem (how can I safely download some software).