4 ms·

This package installs a cron job that affects how apt functions on your system. You're basically giving google root on your machine.

by mjgoins 16y ago

deleted 16y ago
[deleted]
macemoneta 16y ago
Yeah, a closed source application installed as root, with the express purpose of accessing your webcam and microphone. What could go wrong?
- foenix 16y ago
  Here's the header of the /etc/crontab.daily/google-talkplugin file. I'm not that ninja with my cron-tabbing, but doesn't this do exactly what it says? http://pastebin.com/4etPxNWC http://pastebin.com/4etPxNWC
  - mjgoins 16y ago
    Yes, and it's pretty much harmless in itself, but since when does installing one package (esp. from a third party with no verification beforehand) install a new apt key into your keyring (thus allowing all packages signed by that key, no matter what they are) and reconfigure the package manager itself? It's ludicrous.
    - mkr-hn 16y ago
      It's probably a mistake, and they'll put some prompts and options in once they realize Linux users don't like giving root so freely. They're probably accustomed to trusting their own software with root, so didn't even think about it.
      - deleted 16y ago
        [deleted]
      - yungchin 16y ago
        It's not a mistake: the development deb for Chrome did exactly this - installed the repository key and a cron job to "protect" the apt-sources entry. Of course it's not really doing this secretly, in that you can read about it in the post-install script before you run dpkg, but I agree it doesn't feel right. Also, can't this be said of any package you install through the package manager? If you install it as root, then in principle you're giving root access to whatever is in the package. If you don't like it, there's always a way to run it with ordinary permissions (but the extra fiddling to get that working may be hairy) or under mandatory access control (definitely hairy).
      - andreyf 16y ago
        It's probably a mistake Nah, it was probably just developed for internal Google consumption.
deleted 16y ago
[deleted]
senko 16y ago
As a friend puts it: "given that you install a package that has a postinst script, you are letting google run stuff as root on your machine". Don't trust google? Don't install their software.
acdha 16y ago
If you run their code in any way you're already giving them control of your system. Even if you're one of the vanishingly small number of people who use a separate admin account they're getting full control of your account if they want it. Installing a repo & apt key is a good sign that they're playing by the rules rather than trying something sneaky.

This package installs a cron job that affects how apt functions on your system. You're basically giving google root on your machine.

by mjgoins 16y ago

This package installs a cron job that affects how apt functions on your system. You're basically giving google root on your machine.

deleted 16y ago

[deleted]

macemoneta 16y ago

Yeah, a closed source application installed as root, with the express purpose of accessing your webcam and microphone. What could go wrong?

foenix 16y ago
Here's the header of the /etc/crontab.daily/google-talkplugin file. I'm not that ninja with my cron-tabbing, but doesn't this do exactly what it says? http://pastebin.com/4etPxNWC http://pastebin.com/4etPxNWC
- mjgoins 16y ago
  Yes, and it's pretty much harmless in itself, but since when does installing one package (esp. from a third party with no verification beforehand) install a new apt key into your keyring (thus allowing all packages signed by that key, no matter what they are) and reconfigure the package manager itself? It's ludicrous.
  - mkr-hn 16y ago
    It's probably a mistake, and they'll put some prompts and options in once they realize Linux users don't like giving root so freely. They're probably accustomed to trusting their own software with root, so didn't even think about it.
    - deleted 16y ago
      [deleted]
    - yungchin 16y ago
      It's not a mistake: the development deb for Chrome did exactly this - installed the repository key and a cron job to "protect" the apt-sources entry. Of course it's not really doing this secretly, in that you can read about it in the post-install script before you run dpkg, but I agree it doesn't feel right. Also, can't this be said of any package you install through the package manager? If you install it as root, then in principle you're giving root access to whatever is in the package. If you don't like it, there's always a way to run it with ordinary permissions (but the extra fiddling to get that working may be hairy) or under mandatory access control (definitely hairy).
    - andreyf 16y ago
      It's probably a mistake Nah, it was probably just developed for internal Google consumption.

deleted 16y ago

[deleted]

senko 16y ago

As a friend puts it: "given that you install a package that has a postinst script, you are letting google run stuff as root on your machine". Don't trust google? Don't install their software.

acdha 16y ago

If you run their code in any way you're already giving them control of your system. Even if you're one of the vanishingly small number of people who use a separate admin account they're getting full control of your account if they want it. Installing a repo & apt key is a good sign that they're playing by the rules rather than trying something sneaky.