3 ms·

Do PPAs work on non-Ubuntu distributions? I thought there was one old ticket about supporting Debian, and it was ultimately closed or abandoned. Also, PPAs do

Do PPAs work on non-Ubuntu distributions? I thought there was one old ticket about supporting Debian, and it was ultimately closed or abandoned. Also, PPAs do absolutely nothing about sandboxing. It's a different kind of concern.

cies 6y ago
> Also, PPAs do absolutely nothing about sandboxing. It's a different kind of concern. Therefor we use opensource. Anything you dont trust is even hard to run safely in a sandbox. BTW +1 for PPA culture.
- zaarn 6y ago
  OpenSource doesn't prevent CVEs that allow attackers to take over anyway. What If you install script has a bug that lets an attacker place arbitrary SUID binaries? Or it has a bug that deletes your entire system (Steam had this bug and the script was open and available, they weren't the only ones either).
- alanfranz 6y ago
  It's a totally different concern. I don't understand how PPAs and similar distribution approaches (i.e. native packages with hosted build systems) are getting mingled with flatpak and/or snap sandboxing objectives. You can distribute open source software via flatpak or snap. And you can create a build system that takes open source software as a source and creates a flatpak or snap distribution. It's totally possible to hide a backdoor in an open source software. A working sandbox will prevent certain attacks to your system, whether it was built from an open source or not. This already works on most (all?) mobile operating systems.
  - cies 6y ago
    i was responding to the sandboxing part. not having a sandbox is less of a problem when you run FLOSS (in the context of PPAs that's relevant i think)
    - alanfranz 6y ago
      > not having a sandbox is less of a problem when you run FLOSS (in the context of PPAs that's relevant i think) I disagree. Source auditing is irrelevant for day-to-day software use.
- Xylakant 6y ago
  when was the last time you fully audited a ppa? Like the source, that it builds from the canonical source, all patches it applies, all install scripts it packages and all changes it actually does? The trustworthiness of the ppa author. I know that I at best do cursory checks based on the reputation the author or the source linking to the PPA have, but I'm aware that this is a honor based system, and open source is practically irrelevant to that.
  - cies 6y ago
    good point. i never checked it.
aesh2Xa1 6y ago
PPA (personal package archive) is the Ubuntu name, but other distributions make it possible to do the same. The system is a way to distribute packages through the package manager, and repository metadata is hosted centrally. Fedora has such repositories (RPM Fusion, Copr). Arch does, too (AUR). Other distributions, including Debian, can use them as well, so long as there exists a community.
- m4rtink 6y ago
  I would not really call RPM Fusion a PPA - it's basically a repo with packages that are inherent not open source or patent encumbered and can't thus be in regular Fedora repos (and Copr actually). Otherwise the community maintains it to a very similar standard as the regular Fedora repos. Compared to that Copr is a real PPA where you can build stuff into personal repo (as long as its built from source, licensing is fine & the thing is not patent encumbered).
husam212 6y ago
It is a completely different approach, instead of sandboxing potentially malicious software, prevent it from getting into your machine, this approach works for open-source only. Most popular distors provide similar stuff to PPA, the AUR in Arch for example.
- viraptor 6y ago
  This is the perfect and not possible territory. Even with full access to the source, you can't be sure if it's malicious, or if it can be made malicious at runtime.
viraptor 6y ago
For rpms the alternative would be Fedora COPR. (https://copr.fedorainfracloud.org/ https://copr.fedorainfracloud.org/) It is rpm-specific, but not Fedora-specific.

cies 6y ago

> Also, PPAs do absolutely nothing about sandboxing. It's a different kind of concern. Therefor we use opensource. Anything you dont trust is even hard to run safely in a sandbox. BTW +1 for PPA culture.

zaarn 6y ago
OpenSource doesn't prevent CVEs that allow attackers to take over anyway. What If you install script has a bug that lets an attacker place arbitrary SUID binaries? Or it has a bug that deletes your entire system (Steam had this bug and the script was open and available, they weren't the only ones either).
alanfranz 6y ago
It's a totally different concern. I don't understand how PPAs and similar distribution approaches (i.e. native packages with hosted build systems) are getting mingled with flatpak and/or snap sandboxing objectives. You can distribute open source software via flatpak or snap. And you can create a build system that takes open source software as a source and creates a flatpak or snap distribution. It's totally possible to hide a backdoor in an open source software. A working sandbox will prevent certain attacks to your system, whether it was built from an open source or not. This already works on most (all?) mobile operating systems.
- cies 6y ago
  i was responding to the sandboxing part. not having a sandbox is less of a problem when you run FLOSS (in the context of PPAs that's relevant i think)
  - alanfranz 6y ago
    > not having a sandbox is less of a problem when you run FLOSS (in the context of PPAs that's relevant i think) I disagree. Source auditing is irrelevant for day-to-day software use.
Xylakant 6y ago
when was the last time you fully audited a ppa? Like the source, that it builds from the canonical source, all patches it applies, all install scripts it packages and all changes it actually does? The trustworthiness of the ppa author. I know that I at best do cursory checks based on the reputation the author or the source linking to the PPA have, but I'm aware that this is a honor based system, and open source is practically irrelevant to that.
- cies 6y ago
  good point. i never checked it.

aesh2Xa1 6y ago

PPA (personal package archive) is the Ubuntu name, but other distributions make it possible to do the same. The system is a way to distribute packages through the package manager, and repository metadata is hosted centrally. Fedora has such repositories (RPM Fusion, Copr). Arch does, too (AUR). Other distributions, including Debian, can use them as well, so long as there exists a community.

m4rtink 6y ago
I would not really call RPM Fusion a PPA - it's basically a repo with packages that are inherent not open source or patent encumbered and can't thus be in regular Fedora repos (and Copr actually). Otherwise the community maintains it to a very similar standard as the regular Fedora repos. Compared to that Copr is a real PPA where you can build stuff into personal repo (as long as its built from source, licensing is fine & the thing is not patent encumbered).

husam212 6y ago

It is a completely different approach, instead of sandboxing potentially malicious software, prevent it from getting into your machine, this approach works for open-source only. Most popular distors provide similar stuff to PPA, the AUR in Arch for example.

viraptor 6y ago
This is the perfect and not possible territory. Even with full access to the source, you can't be sure if it's malicious, or if it can be made malicious at runtime.

viraptor 6y ago

For rpms the alternative would be Fedora COPR. (https://copr.fedorainfracloud.org/ https://copr.fedorainfracloud.org/) It is rpm-specific, but not Fedora-specific.