Hacker News Reader

Comment by arthurofcharn | Hacker News Reader

Google was once considered trustworthy. It never was, but we thought it trustworthy. Where can you find a trustworthy source for software? Depends on your platform. Linux: Your package manager. In my case, apt. Mac: Apple has an app store of its own. Use that, or one of the BSD package management systems ported over. Ios: Apple app store is decently curated. Android: Google's app store is terribly curated. Give up now. Windows: Nobody uses whatever app store or package management system that microsoft developed. A third party developed a useful package management system. It is called Steam. Other platforms: see replies below.

View on HN

> Android: Google's app store is terribly curated. Give up now.

Google's store might be a lost cause, but ironically the fact that the platform isn't a walled garden can be used to our advantage here: Use F-droid.

On windows, Chocolatey (chocolatey.org) also seems to have a decent reputation.

As does PortableApps (portableapps.com).

scoop is IMO a bit better on Windows (mostly because it focuses on portable software), but Chocolatey is a good fallback.

Winget is a new thing in Windows one could use though sometimes it has issues.

Linux package managers are not trustworthy. That is another case where everyone pretends that it is. Usually packages are created and updated by random people and can be pseudonymous.

Oh crud, you are right. Any idea how to fix this? Perhaps a more curated (and more manageable) list? That would seem to be in conflict with our bazaar model.

The package managers right now ARE that curated list and distributions like Debian have proven themselves to be trustworthy.

Of course, you can always find something wrong with every approach, but the truth that everyone needs to face here is that you need to trust SOMEONE to distribute good software to you.

AUR is one of those "at your own risk" repos where I always check the pkgbuild and comments of a package first before installing something new. I don't know why I should hesitate to trust the default repos though since they're curated by the same people making the distro I use. Either I trust them or I use another distro.

Yes, but these are the same people who are managing every single program on your system. At some point you either have to compile every single item from source yourself, or accept the fact that you will need to place a certain level of trust into the vetting system your distribution has established.

That really depends on the repos you are using, that's why distros are so important. If using repos from Debian, Ubuntu or Fedora (including RPM Fusion) you are 1000x safer than anyone using winget or google to try and download software from random sources.

For windows you could start with Chocolatey and check filehippo

Also consider the now built-in package manager: Winget

And governments are doing their best to break the app stores, destroying even the basic safely mechanisms such stores can offer. This should be taken as instructive, but is ignored by most.

What a strange argument - with this they're actually opening the market to stores that will ensure secure products like F-Droid with their guarantee for opensource. If anything, the current situation where BOTH Apple and Google store are ridden with malware and poor software doesn't work.

We didn't fix SourceForge problems by allowing a megacorp to kill all competition and enshrine that cesspool, but by creating new sources of software.

There is very little outright, break the sandbox malware available for iOS.

Apple does not have to break the safety mechanisms in their store...

They just have to allow other stores.

Reply on news.ycombinator.com