Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

And this is why I avoid "package managers" that follow the wild-west model like the plague.


What's the wild-west model? Write it all yourself? "cp -r $dependency_location $install_location"? Genuinely curious.


The "wild west" model is where there is no maintainer or distributor between the developer and consumer that is allowed to perform any sort of quality control or sanitisation. That sounds good from a naive standpoint - who needs this busybody middleman anyway? But the problem is that authors tend not to be great maintainers. Authors can (and do) remove packages at any time, make changes to packages without bumping version numbers, upload subtly broken versions or possibly make user-hostile changes which the community can then do nothing about short of creating a fork (which is messy switching over dependencies to a different package name). And that's not even to go into typo-squatting.

In short, package authors don't tend to care about much more than getting their package to work, somehow, anyhow. Often only the latest version of that package, too. And they don't always have an eye on interoperability with other packages, or consistency across a collection. Maintainers who create a "distribution" of software that works well together can collaboratively make decisions that are in the community's best interest. The "wild west" model is unilateral, the "maintained" model is multi-lateral.


>The "wild west" model is where there is no maintainer or distributor between the developer and consumer that is allowed to perform any sort of quality control or sanitisation.

That's not entirely true. Maintainers or distributors aren't required under the "wild-west" model, but that's not the same as anything being disallowed. It's up to the community and the developer to do their own due diligence. The "wild west" model is just the free software model, it's just the lack of some central authority limiting user freedom for the good of the community.

Rather, it's the "distribution" model which forbids anything not approved by the list of official maintainers. All of the problems you list with package authors still exist, but you have fewer options as a developer should they arise.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: