4 ms·
If you trust the PPA you added, does it open you up to any other concerns?
by ViViDboarder 8y ago
If you trust the PPA you added, does it open you up to any other concerns?
- r3bl 8y agoIn an ideal case, no. In a not-so-ideal case, one with the push access could theoretically replace any package on your system with a malicious version that you would pick up automatically using apt upgrade. I'd trust PPAs more if they didn't have such broad possibility of misuse. For example, if I add a PPA that only contains package A, I should at least be warned if that PPA tries to install or upgrade package B. apt will only display that package B needs to be installed/upgraded, it won't inform me that it originated from that PPA. I applaud elementary OS for not bundling software-properties-common by default (a package that allows you to run add-apt-repository). If you decide to install it, you should at least be forced to make an effort to open such possibility of misuse.
- dalai 8y agoI think you can use pinning to prevent the second scenario, assuming you don't mind the extra manual configuration.