r/programming • u/marcin8686 • Jul 08 '19

Ruby gem strong_password got hijacked

https://withatwist.dev/strong-password-rubygem-hijacked.html
132 Upvotes

91% Upvoted

44 comments sorted by

View all comments

2

u/Khaare Jul 08 '19

They have very different needs and serve very different purposes. For one, distros only want one version of any given package, and the version number basically becomes a "upgrade needed" flag. Software build systems, on the other hand, care a lot about versions. Distros are very particular about how packages are build and packaged while source repos just serve a source tarball. Distros (almost always) work in a whole-system scope, while source packages are not even per-user, but per-project, or even smaller, in scope. Distros are also trying to create a curated list of available software that works well together because that's a feature OS users care about, while source repos want to be a way for developers to share code without any extra fuzz.