Likening Kickstarter to an investment has always concerned me. Investment implies a return if the idea is successful and (as you can see from Oculus Rift) early kickstarter backers didn't get any of the very large payout that Oculus got when the were bought by Facebook.
We're starting to see that idea come about with platforms like https://www.seedrs.com/ where if it goes swimingly the backers do well out of it, which kind of offsets the risk.
I think the problem with standard crowd-funding is the people doing the project obviously have an interest in downplaying the risks, and the platform does too, so with no regulation that's exactly what'll happen, and then we get a lot of very late, underdelivering projects which will sour people on the whole concept.
I'm not OP, but my opinion would be that APT does do some things better than npm etc but there's still some potential problems.
Probably one of the most obvious is that access to the repos is over unencrypted HTTP connections which opens the process up to tampering (depending on the attacker) for example injecting an older version of a package with a known security issue.
that's interesting. Any pointers to package stores that do a better job on security? I'm researching the area a bit at the moment and I've not seen a lot of good practice out there, so would be interesting to have some good examples to hold up.
This is a problem with most/all lib installers. They tend to have hooks to allow post-install actions and those hooks tend to be able to run OS commands, with the privileges of the installing user.
Of course what's extra worrying is it's not just the libs you directly install, but all their dependencies which get to carry out these actions. So for example when you install rails, it will install quite a large number of subsidiary gems.
Then when you add in the fact that the credentials that control dev access to push to places like rubygems and npm are just static username/password combos (which sometimes get stored in plain text in a dot file in the developers home dir) and that there's no common use of digital signing for issued libs (in some cases the installers don't even support it).