[cmeacham98]

The difference comes from the fact distro maintainers choose the software they package, while language maintainers largely don't.

For example, how do you prevent somebody from phishing/typosquatting users with a package named similarly to a popular one? For distro maintainers the answer is simple - don't package it. Debian is unlikely to add a "f1refox" package. Language maintainers don't have that luxury.

[brabel]

Oh what?? Most package managers do try to prevent typo squatting!! Your insistence that there’s something fundamentally different between different package managers is just weird! Debian, as npm, lets you package and distribute software. The differences between them are related to policy preferences but the basic idea is the same!

[bitmasher9]

I think that’s a difference in implementation details, not a difference in what it fundamentally is.

I’m not arguing that there aren’t differences between the two, I’m arguing that they are fundamentally the same solution (gather all of the software in one location with) to same problem (how can I safely download some software).

[woodruffw]

They are very fundamentally different solutions: the entire premise of distribution packaging is that you’re relying on some distribution maintainer’s discretion. It’s not an open index.

[oneshtein]

This is exactly what users wants in this case: someone need to check a package and mark it as safe to use.