3 ms·

> Also, PPAs do absolutely nothing about sandboxing. It's a different kind of concern. Therefor we use opensource. Anything you dont trust is even hard to run

by cies 6y ago

> Also, PPAs do absolutely nothing about sandboxing. It's a different kind of concern. Therefor we use opensource. Anything you dont trust is even hard to run safely in a sandbox. BTW +1 for PPA culture.

zaarn 6y ago
OpenSource doesn't prevent CVEs that allow attackers to take over anyway. What If you install script has a bug that lets an attacker place arbitrary SUID binaries? Or it has a bug that deletes your entire system (Steam had this bug and the script was open and available, they weren't the only ones either).
alanfranz 6y ago
It's a totally different concern. I don't understand how PPAs and similar distribution approaches (i.e. native packages with hosted build systems) are getting mingled with flatpak and/or snap sandboxing objectives. You can distribute open source software via flatpak or snap. And you can create a build system that takes open source software as a source and creates a flatpak or snap distribution. It's totally possible to hide a backdoor in an open source software. A working sandbox will prevent certain attacks to your system, whether it was built from an open source or not. This already works on most (all?) mobile operating systems.
- cies 6y ago
  i was responding to the sandboxing part. not having a sandbox is less of a problem when you run FLOSS (in the context of PPAs that's relevant i think)
  - alanfranz 6y ago
    > not having a sandbox is less of a problem when you run FLOSS (in the context of PPAs that's relevant i think) I disagree. Source auditing is irrelevant for day-to-day software use.
Xylakant 6y ago
when was the last time you fully audited a ppa? Like the source, that it builds from the canonical source, all patches it applies, all install scripts it packages and all changes it actually does? The trustworthiness of the ppa author. I know that I at best do cursory checks based on the reputation the author or the source linking to the PPA have, but I'm aware that this is a honor based system, and open source is practically irrelevant to that.
- cies 6y ago
  good point. i never checked it.

by cies 6y ago

zaarn 6y ago

OpenSource doesn't prevent CVEs that allow attackers to take over anyway. What If you install script has a bug that lets an attacker place arbitrary SUID binaries? Or it has a bug that deletes your entire system (Steam had this bug and the script was open and available, they weren't the only ones either).

alanfranz 6y ago

It's a totally different concern. I don't understand how PPAs and similar distribution approaches (i.e. native packages with hosted build systems) are getting mingled with flatpak and/or snap sandboxing objectives. You can distribute open source software via flatpak or snap. And you can create a build system that takes open source software as a source and creates a flatpak or snap distribution. It's totally possible to hide a backdoor in an open source software. A working sandbox will prevent certain attacks to your system, whether it was built from an open source or not. This already works on most (all?) mobile operating systems.

cies 6y ago
i was responding to the sandboxing part. not having a sandbox is less of a problem when you run FLOSS (in the context of PPAs that's relevant i think)
- alanfranz 6y ago
  > not having a sandbox is less of a problem when you run FLOSS (in the context of PPAs that's relevant i think) I disagree. Source auditing is irrelevant for day-to-day software use.

Xylakant 6y ago

when was the last time you fully audited a ppa? Like the source, that it builds from the canonical source, all patches it applies, all install scripts it packages and all changes it actually does? The trustworthiness of the ppa author. I know that I at best do cursory checks based on the reputation the author or the source linking to the PPA have, but I'm aware that this is a honor based system, and open source is practically irrelevant to that.

cies 6y ago
good point. i never checked it.