And I prefer C/C++ and Python due to that.

Eg. JS devs need to version pin in NPM to not expose users to compromised packages. That means that, from now on, they need to be active at least every week and update the pinning to not expose users to vulnerable packages. Meanwhile, the users need to be on-edge about the dev actually being active, and, still, for every vulnerability and compromised package, need to scan their whole system for files relating to that package. And of course, that means a very long fix path of Vuln discovered -> Vuln fixed -> Dev knows that one of the dozen packages they use needs updating -> Dev updates -> Package managers updates -> User updates.

It’s a horrible experience for sysadmins. I’m actively switching to alternatives and rewriting smaller things in C++, because everything I’ve written in the latter has never broken in years, without recompilation, because the ABI stayed the same for all libraries, while the libraries get carefully curated by a dedicated team. And as soon as a vulnerability/backdoor is found and fixed? sudo pacman -Syu. nothing more, nothing less. Fix path: Vuln discovered -> Vuln fixed -> Package managers updates -> User updates.

Looking at more than just binary files in repos: I’m also actively rewriting PKGBUILDs to use the native python packages instead of building a venv, because that just works better in my experience. I’ve never had issues with incompatibility between python-* packages, simply because they are build for each other. And I mean, it took 30 minutes to build a component that converts a requirements.txt, which requires you to trust the dev (to be active) and npm (which you can’t trust), to a collection of pacman packages. Universally applicable to all requirements.txt and uncomplicated. So yeah, idiots can continues using pip, I laugh with a list of packages neatly curated by a dedicated team.