I've just started using Chocolatey and it's been a mixed experience. Overall, a speedy way to install software (no clicking, just type) but sometimes the packages are broken, so don't install, or don't include (for example) whatever is needed to be uninstalled.
I'm not sure if there's any auditing on packages, which look to be submitted by individuals or small teams to their "gallery." I have a few misgivings about that in the same way as some of the unofficial repositories on CentOS or Ubuntu (which I also use).
I'd like to recommend this in a production environment (I'm a config specialist at the moment ;) but I know what my manager would say. Useful at home though.
Actually I have used it in the past in a production environments to setup laptops for my former colleagues. Not only it installed stuff everybody needed anyway, it also did setup the printer (non-trivial for not so technical folks) and created some basic short cuts on the Desktop.
But I would assume that it behaves differently and fresh Windows installations and private installations that usually tend to be messier...
I tried using it to install some software, I think related to Ruby or Node? on a Windows box. At the time (a year ago) it seemed to be some buggy batch scripts that didn't accomplish anything. I also seem to recall it having you run scripts downloaed over HTTP. Hopefully this has all changed if Microsoft is picking it up.
Agreed. I should have made it clear that I was responding more about the "who is behind this?" question and their possible motives, rather than passing judgement on whether it is secure or not.
The potential for a big security breach, especially in a Windows environment, is making me less enthusiast than I should be.