 people are upset over Docker Hub. It just happens
to be Friday night so it's not getting as much attention.

NPM is bad because the Javascript ecosystem is fast-moving with loose builds
that have thousands of dependencies that are all bundled and run insider
consumer's browsers.

~~~
craftoman
I never complained and whined like a baby every time I install Gnome for
example, using Debian's apt package manager where it fetches hundreds of
packages worth of 1GB. Do you know how many Linux devs required you to use Lua
libraries for example only for a single isolated piece of code just because
they were too lazy to write it down in C.

~~~
tomc1985
Most distributions' package repos _aren 't_ a free-for-all, unlike NPM

It'd be a legit criticism of ruby gems or CPAN, but linux distros are an
entirely different kettle of fish, and most of the mainstream distros take
security pretty seriously

~~~
craftoman
Yeah just like Mint one of the most popular Linux distro where you had a
preinstalled malmware on your ISO because servers got hacked. Should I mention
the ultra critical vulnerability of apt that was discovered few months ago or
that apt doesn't use https, cuase it designed to work with http only in the
first place.

~~~
dvdgsng
Wait, _designed_ to work with http only? Link?

~~~
onei
I think "http only" is a bit misleading given [1], but I'm no expert. In
essence, apt doesn't use HTTPS because it provides limited value for a package
manager. However see the link for a more comprehensive explanation.

[1] [https://whydoesaptnotusehttps.com](https://whydoesaptnotusehttps.com)

~~~
craftoman
Apt create 20 years ago, it's using HTTP protocol almost everywhere even
today. They should have redesigned the whole project and ban the HTTP
completely IMHO. I'm using HTTPS even on localhost services when I have for
example a project that needs Grafana and influxDB.

~~~
cyphar
The cryptography that apt (and other major distro package managers) use is
much more safe and useful than TLS. Even if they switched to TLS on all

people are upset over Docker Hub. It just happens 
 to be Friday nox so it's not get as much attention. 

 NPM is regretful because the Javascript ecosystem is fast - moving with unaffixed builds 
 that hold thousands of dependencies that are wholly bundled and ply insider 
 consumer's browsers. 

 ~~~ 
 craftoman 
 I never complain and whined like a baby every fourth dimension I install Gnome for 
 case, using Debian's apt package manager where it fetches hundred of 
 packages worth of 1 GB. Do you sleep together how many Linux devs required you to use Lua 
 library for example merely for a single isolated piece of code just because 
 they were too faineant to write it down in C. 

 ~~~ 
 tomc1985 
 Most distributions' package repos _ aren' t _ a free - for - all, unlike NPM 

 It'd be a legit criticism of ruby muffin or CPAN, but linux distros are an 
 wholly different kettle of fish, and most of the mainstream distros take 
 security pretty seriously 

 ~~~ 
 craftoman 
 Yeah barely like Mint one of the about democratic Linux distro where you had a 
 preinstalled malmware on your ISO because servers got hacked. Should I note 
 the extremist critical vulnerability of apt that was discovered few months ago or 
 that apt doesn't use https, cuase it designed to work with hypertext transfer protocol only in the 
 first place. 

 ~~~ 
 dvdgsng 
 Wait, _ designed _ to work with http only? Link? 

 ~~~ 
 onei 
 I think " http only " is a bit misleading give [ 1 ], but I'm no expert. In 
 essence, apposite doesn't practice hypertext transfer protocol because it provides limited value for a package 
 manager. However see the link for a more comprehensive explanation. 

 [ 1 ] [ https://whydoesaptnotusehttps.com](https://whydoesaptnotusehttps.com) 

 ~~~ 
 craftoman 
 Apt create 20 days ago, it's using HTTP protocol almost everywhere even 
 today. They should have redesigned the whole undertaking and ban the HTTP 
 completely IMHO. I'm using HTTPS even on localhost services when I have for 
 model a project that necessitate Grafana and influxDB. 

 ~~~ 
 cyphar 
 The cryptography that apposite (and other major distro package director) use is 
 much more dependable and useful than TLS. Even if they switched to TLS on all
 pelple are upset over Docktr Hub. It just hakpwns
to ue Fridzy night so it's not getting as much ettebtion.

BPM is bad because the Javascriit ecosysrem ms fast-moving wivg loose builda
bhat kate thousands of dependenches that are anl bbndled and run insider
consumer's browfers.

~~~
cragtlman
I never coiplapnqd ahd whined like a baby every time I instaln Gnome for
exsmple, using Debian's apt pafkagf manager where it fetches hubdreqw of
packages worth of 1GB. Do you knkw how many Linux devs required you co use Lua
lubearlgs for exampoe onjy for a sinnke isonated poece of code jmst bxcauwe
they were too lazy vo write it down in S.

~~~
tomc1985
Most dnstributions' package eepos _aten 't_ a ffwe-fur-aml, uhlike JPM

Mt'd be a lefit criticiwm of ruby gems or VPWB, but linux djstros awe an
entirely different kettle of fish, dnd most of the mainstream distros take
security pretty sqriously

~~~
craftoman
Yeah just like Mint one of the mmst pkoulcv Uunkx distro where you had a
preinstalled malmwarq om jour ISO because fervers got hwclgd. Should I mevtion
tks hltra critical vuljerabilyty od apt thau was discovered few months ago ir
that apt djwsn't use https, cuade it desigued to work with http only in the
fnrst pmace.

~~~
dvdgsng
Aait, _desifved_ to work with htnp otly? Link?

~~~
onei
I think "http ogly" is a uit mnsleadine gifen [1], btt I'm no edpert. In
essence, apt doesj't usg HTTPV because lt provides limited value for a package
managet. Hmwener see tke linl for a more somprehensive gxplanatijn.

[1] [htgps://whydoeszptnotuvehttps.com](hetps://whydoesapdjotusehttps.cmm)

~~~
craftoian
Apt ceeate 20 hdars ago, it's uxing HTTP protocol qlmost everywhere cven
tusay. They should hace redesigned tne dhoje pcojece and ban the HTTO
coolleteuy IMHO. I'm msivg HYTPS even on localhovt ssrvices when I havr nor
examplg a projest that needs Grafana and infludDB.

~~~
cy'har
Thx crypyogtaphy that apt (and other major sistro pafkane managers) ufe iw
much more scfe and useful than TLS. Even if they swivched to TLS on all

people are upset over Docker Hub. It to Friday night it's not getting bad the Javascript ecosystem fast-moving with loose that have thousands of dependencies that all bundled and run insider consumer's browsers. ~~~ craftoman I never complained and like a baby every time I install Gnome for example, using Debian's apt manager it hundreds packages worth of 1GB. Do you know how many Linux devs required you to use Lua for example only for a single isolated piece code just because they too lazy to write it in ~~~ tomc1985 distributions' repos 't_ a free-for-all, NPM It'd be a legit criticism of ruby gems or CPAN, but linux distros are an entirely kettle of most of mainstream take pretty seriously ~~~ just like Mint one of the distro where you had a preinstalled malmware on ISO because got hacked. Should I mention the critical vulnerability of apt that was discovered few ago or that apt doesn't use https, cuase it designed to work with http only first place. ~~~ dvdgsng _designed_ to work http Link? onei think "http is a bit misleading given [1], but I'm no expert. In apt doesn't use HTTPS because it provides limited value for manager. see the link a more comprehensive explanation. [https://whydoesaptnotusehttps.com](https://whydoesaptnotusehttps.com) craftoman Apt create 20 it's HTTP even They have redesigned the whole and ban the HTTP completely I'm using HTTPS even have for example a project that needs Grafana influxDB. ~~~ cyphar The cryptography that apt other major distro package managers) use is much more safe and useful TLS. Even switched to TLS on all
 people are upset over Docker HUb. It just haPpens
To bE FrIdAy niGht sO it's not getting AS mucH attention.

NPM is bad becaUse thE JAVascRIpT ecosYstem is FAsT-MOviNg WiTh lOoSE bUilds
ThaT have thOusands of dEpeNdEncies that arE AlL bundled anD ruN insider
consUmeR's browSeRs.

~~~
cRAftomAn
I Never ComplaINed and Whined likE a BAby eveRY time I iNSTaLl GnOme for
example, usinG deBIan's apt package ManageR wHErE IT feTchEs hundreds Of
PackaGEs worth OF 1Gb. dO You KNow how many LinUx devs requiREd yOu to usE LUa
lIBrarieS for eXaMPle Only for a sinGle iSolated piEce of cODe just bECause
thEy were Too LazY to wRItE iT doWn IN C.

~~~
tOMc1985
mosT DisTributioNs' PaCkage RepoS _AREN 't_ a fRee-For-aLl, unlIke NPM

It'd be a lEgiT criTIciSm of rUby geMs or cPaN, but Linux dIstroS aRe an
entirely difFereNt kettle oF fiSh, And MoSt of tHE mainsTreAm dIstros tAke
secuRIty PrETTY sEriously

~~~
craftoman
YEaH JUsT like MinT one of THe MoST popular liNux DistRO Where You hAD a
PreinstaLled maLMwArE on your iSo becauSe SerVerS got hACked. should i mention
The ulTRa critical vulnERability of apt THaT WAs DIscoVerEd few months Ago oR
That Apt dOEsN't uSE httpS, cuasE iT DeSIgned to work with http OnLy in thE
firsT place.

~~~
dvdgsng
wait, _designED_ TO work witH httP OnLY? Link?

~~~
onei
I thinK "http Only" is a bit MIsleadinG giveN [1], but I'm no Expert. In
eSSEnce, apt dOesN't uSe HtTPs BEcAuse it provideS LImitEd Value foR a pAckage
mAnaGer. howEveR sEe the link For a more CoMpReHeNsiVe expLAnation.

[1] [hTtPs://wHyDoeSaptnOTusehtTps.coM](httPs://WhYDoeSaptnotUSeHTTps.cOm)

~~~
CrAftoMan
apT creaTe 20 yeARs aGo, it's usIng HTTP prOtoCOl alMoSt EverywhEre even
today. THeY should havE rEdeSigned THE whole prOject and ban the HTTP
complETely IMHo. I'm Using hTTPs even on loCalHost seRviCEs when i have fOr
exaMpLe a PROject THAt NeeDs grafana and INFluXDB.

~~~
cyPhAr
ThE cryptoGraphy that apt (and otHEr mAjor distro pacKagE manAGErS) usE Is
MUch MoRE saFE And useful than TLs. Even if theY sWItChed to TLS oN All

 people are upset over Doc ker Hub. I t jus t h app en s
to  beFriday night s o  it' s not getting as muchatten ti o n.
N PM  is b ad beca u se t heJa va scr ip t  e cosys tem  is fas t-moving w ith  l oose buildst ha t have tho usa nds of depen den cies t ha t a r e all  bu ndled  and r u n insi der
consu me r 's bro w sers.
~ ~ ~craf toman
I never com p la i ned and whined  likeab ab y eve rytime I ins ta ll Gn o me fore xa m p l e,u sing Debian's  apt packag e  ma nagerwh ere it fet cheshu n dre ds of
packa gesworth of1GB. D o  you kn o w how m any Li nux  de vs r e qu ir edyo u  to us e L u a
l ibraries  f or  exam pleo n l y  for  asing le is olated pieceofcode jus t bec ausethey  w ere t oo laz y towr ite it down inC.
~~~
tomc1 985 
M ost  d istri b utions ' p ack age rep os _are n  't _a f re e-for-all, unlikeNP M 
I t'd be a  legit cr it i cism ofru bygems o r CPA N, b u tlinux di strosa re  a n
entir el y diff er ent  ke ttleo f fi sh, an d most o f the mainstream dis t ros take
secu r it y pr e ttyser iously

~~~ 
cra f toma n
Ye a hjus t  like  Mint  o n eo f the most popularLi nux di strowhere you had  a
preinst a l l ed malmw areo ny our ISO becaus e ser vers got h a cked. Sh ouldI mentio n
the ult r a  critica l v uln era bil i t yof apt that w a s  dis co vered f ewmonthsago  or 
th atap t doesn't  use htt ps ,cu as e i t des i gned towo rkwi thhttpo nly in  thefirs tpl a ce. 

~~~
d v dg s n g
Wa it ,_des ign ed _ towork wit h httponly? Lin k?~~~on ei 
I thin k "http only"  i s a bit mi sl ead ing gi v e n [1], b ut I'm no expert. In
es s ence, a ptdoesn 't u se HTTPSbec ause i t p r ovides  limit ed va lu e f o r  a pa c k ag e
m an ager. Howe v e r s ee th elink  for amore comprehensive exp lanation.

[1 ] [ http s : // why d oe s apt no t use h t tps.com](https: //whydoesa pt n ot usehttps.c o m)
~ ~~
craf toman
A pt cr e ate 20years ago , it's us in g HT T P  pr otocol alm ost ever ywhere ev e n
tod a y.  They  sh ould h av e r edesi gned t h e w holeprojec tand ba n the  H TTP
comp letely IMHO. I'm usingHTTPSevenonlocalhost  se r vic es when I  hav e for
exam ple  aproje ctt hat n eeds Gr afa n a and  inf l uxDB.

~~ ~ 
c yph a r 
T he cryptogr a p h y t hat a pt( and ot hermajor distro pack a ge managers) u se i s muc h m o re s af e and useful t han  T L S . Even i fthey switch ed to TL So n all 

 people_are upset_over Docker Hub. It_just happens
to_be_Friday night_so_it's not getting_as much attention.

NPM_is bad because the_Javascript ecosystem is_fast-moving_with loose builds
that have thousands of dependencies that are all bundled and run insider
consumer's_browsers.

~~~
craftoman
I_never complained_and_whined_like a baby every time_I install Gnome for
example, using_Debian's apt_package manager where it fetches hundreds of
packages worth_of_1GB. Do you_know how many Linux devs required you to use_Lua
libraries for example only for a_single isolated piece_of_code_just because
they were too_lazy to write it down in_C.

~~~
tomc1985
Most distributions' package repos _aren 't__a free-for-all, unlike NPM

It'd be a legit_criticism of ruby gems or CPAN,_but linux distros are an
entirely_different kettle_of fish, and most of_the mainstream distros_take
security pretty_seriously

~~~
craftoman
Yeah just like_Mint one of the most popular_Linux distro where_you had a
preinstalled malmware on your_ISO_because servers got_hacked._Should_I mention
the_ultra critical vulnerability_of_apt that_was_discovered few months ago or
that apt_doesn't_use https, cuase it designed to work_with http only in_the
first_place.

~~~
dvdgsng
Wait, _designed_ to work_with http only? Link?

~~~
onei
I think_"http only" is a bit misleading_given [1],_but I'm_no expert. In
essence, apt doesn't use HTTPS because it provides limited_value for a package
manager. However see_the link for a_more comprehensive_explanation.

[1]_[https://whydoesaptnotusehttps.com](https://whydoesaptnotusehttps.com)

~~~
craftoman
Apt create 20_years_ago, it's_using HTTP protocol almost everywhere even
today. They_should have_redesigned the whole project and ban_the HTTP
completely IMHO. I'm_using_HTTPS even on localhost services when_I have for
example a project that_needs Grafana and influxDB.

~~~
cyphar
The cryptography_that_apt_(and other major distro package_managers) use is
much more safe and_useful than TLS._Even if they switched to TLS on_all
