That's a risk you take with all package managers. The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform. Chocolatey also won't install anything unless you ask it to, so if you don't consider them trustworthy, do your homework and check if the package is legit before installing it.
The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform.
Just so you know, this is not true with any Linux distribution package manager that I know of. Packages and updates are always vetted by maintainers before they are available to user systems. Trust is intended to be at the distribution level; for Debian, for example, you can be confident that every package in the stable repository is fairly secure, tested software, and as long as you don't enable the non-free repo, every package is free and open source software as well.
This may or may not be true for Chocolatey, I don't know.
Comments
That's a risk you take with all package managers. The ones on linux operate on basically the same principle, with (usually) even less oversight. It's a public gallery that everybody can publish to, so the trust/distrust should be put on the package level, not the platform. Chocolatey also won't install anything unless you ask it to, so if you don't consider them trustworthy, do your homework and check if the package is legit before installing it.
Just so you know, this is not true with any Linux distribution package manager that I know of. Packages and updates are always vetted by maintainers before they are available to user systems. Trust is intended to be at the distribution level; for Debian, for example, you can be confident that every package in the stable repository is fairly secure, tested software, and as long as you don't enable the non-free repo, every package is free and open source software as well.
This may or may not be true for Chocolatey, I don't know.
I did not know that. Is that true for all their package repos? or only for main?