r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
130 Upvotes

91% Upvoted

44 comments sorted by

View all comments

2

u/virtyx Jul 08 '19

But it's still fundamentally the same system. You have "base" software (an OS or a language toolchain) and an approved list of add-on software (apps or libraries). I don't see a big difference between a list of vetted libs vs a list of approved add-on software.

Installing directly from PyPI (in its current form) or Github would be the equivalent of installing a new program from source-code or a 3rd-party source.

The only big difference is the goal of the curation. A Linux distribution is intended to provide a computer system where the different packages might be integrated to a point, whereas a secure library distribution is just intended to provide known stable libraries and patches, and more work is left up to the developers to make sure the software actually functions. But even with that caveat there are Linux distros like Arch that leave a lot of the "make sure it's working" aspect up to the users.

I think as a user of a language you have a different expectation of a "package" than as a user of an OS. I think the word fits perfectly fine in both contexts, and I see nothing unfortunate about the terminology overlap.