Hacker News Reader

At least having the package repo in a git repo removes the biggest problem (IMO) with Chocolatey, that a package owner would abandon it then never update it. Now, a package can be updated by anyone through a PR. However, whoever maintains the git repo (Kevin Larkin and some others) is likely to be overwhelmed quickly.

View on HN

That is sort of how Chocolatey works already. You can modify any of their abandoned packages and submit a request to become owner. They still need to have admins or package authors maintaining packages though in order to ensure the hashes are correct. Otherwise if anyone can make a change then it will become ripe with viruses and malware.

Reply on news.ycombinator.com