QA and trust

The debate about priorities seems to also sweep quality under the rug. No matter who packages and how, the most important is: does it work; which bugs and vulnerabilities there are. That's the most important part of the user experience, much more important than the packaging approach and technology. So, package priority should not be hard-coded to the packaging technology, that's the tail wagging the dog. Package priority could have a default but that default should be easy to override on a per-package basis.

> Users want Flatpaks created by upstreams, but are confused by the way they are displayed in GNOME Software. He recommended that the priority be changed to display software from Flathub first, then Fedora Flatpaks, and finally Fedora RPMs.

In any case, it should always be crystal-clear which software comes from where. Not just for deciding which bug tracker is relevant but also for obvious trust and security reasons. No user interface should ever hide software provenance(s) and make installation so easy it feels "magical". Users should be invited to pause and think before installing and running less common software that isn't "core" and is not used by everyone else. Cause it very likely had much less scrutiny and is then more likely to have bugs, vulnerabilities and backdoors. It's easy to make fun at how time-consuming and painful it is to install software on Windows, but this also forces users to be a bit more conscious of what they are doing. There is a middle ground/sweet spot somewhere.

https://queue.acm.org/detail.cfm?id=3344149 "Surviving software dependencies" - a lot applies exactly the same here.

Let's try to move the software industry past its teenage years.