I submitted a package to CRAN this week. It passed R CMD check --as-cran clean on Windows, macOS, and Linux across oldrel, release, and devel. GitHub Actions verified everything CRAN verifies. Now I wait while a volunteer re-runs the same checks to email me about whitespace in my DESCRIPTION.
No other modern ecosystem works this way. PyPI: twine upload, live in 30 seconds. crates.io: cargo publish, done. Neither is on fire. Neither needs a human gatekeeper to function.
CRAN's defenders call the manual review "quality control." It isn't. CI already validates cross-platform builds. R-hub and WinBuilder exist. The human in the loop catches the same things automation already caught, slower, with a sterner tone, and a willingness to reject your package over arbitrary nonsense nobody asked for.
This is a control problem. The R Core team has watched every other language ecosystem modernize and chosen to do nothing, because the current process keeps them in charge of who gets to publish and on what terms. They've confused gatekeeping with stewardship. The friction isn't a problem for them, it's the point. It's how a small group maintains authority over a language used by hundreds of thousands of people.
The cost is paid by everyone else. Maintainers delay updates to avoid the hassle. New contributors bounce off the obstacle course. Security patches sit for days. The ecosystem looks frozen next to languages where dependencies move blazingly fast, and the people running it seem perfectly comfortable with that, because the alternative would mean letting go.
R is a great language. It deserves infrastructure built for this decade, not a fiefdom run by people who mistake control for quality.