2 ms·

So how does that prevent a malicious PPA or repo that the attacker could push up in the search rankings? Just like the attacker here pushed up a malicious downl

So how does that prevent a malicious PPA or repo that the attacker could push up in the search rankings? Just like the attacker here pushed up a malicious download page in the search rankings?

jamieweb 8y ago
It doesn't in this case, however you can determine that the chromium-team ppa is the official one in Ubuntu by following links from the Chromium website. The security of the package repository system falls down when people add apt signing keys that are untrusted/unverified, which is what happens when you add a ppa in Ubuntu.
- stordoff 8y ago
  > you can determine that the chromium-team ppa is the official one in Ubuntu by following links from the Chromium website. We're sort of in a loop here -- how can I know what is the official Chromium website?
  - jamieweb 8y ago
    > We're sort of in a loop here Yeah, unfortunately that's what verifying the legitimacy of the chromium-team Ubuntu ppa requires... Anyway, there are two quick ways I found: * Go to chrome://settings/help and see the link to Chromium.org (but obviously this doesn't work if you don't have Chrome already) * At the bottom of google.com/chrome there is a link to Chromium.org