4 ms·

Why is this more dangerous than installing a deb, which can also run arbitrary code as root?

by Meekro 5y ago

anlar 5y ago
It is more about streamlined process of package management to which Linux users are used. At least with deb/rpm package I understand where package stuff goes and how to uninstall it (of course, packager could mess up this with arbitrary install scripts). And each 'curl https:// https://' packager has its own idea where his software should be installed. And many of them are not even providing automated way to delete their application.
walrus01 5y ago
a .deb at least went through some cursory level of examination by the people who downloaded the source, built it and are authorized by the debian project to submit new .deb files to the debian package servers. not just any random person can submit a .deb and have it go live on the gpg-key authenticated debian mirrors. https://wiki.debian.org/Packaging https://wiki.debian.org/Packaging https://www.debian.org/doc/manuals/debmake-doc/index.en.html https://www.debian.org/doc/manuals/debmake-doc/index.en.html curl into bash can be as quick as "ooh look shiny new thing on website, let's copy/paste this string of text into my shell"
- Meekro 5y ago
  I agree that debs that were audited and distributed in the package manager are better in that way. I guess my objection is that "curl https://getmic.ro https://getmic.ro | bash" often gets a hostile reaction here on HN whereas "wget https://github.com/zyedidia/micro/releases/download/v2.0.10/micro-2.0.10-amd64.deb https://github.com/zyedidia/micro/releases/download/v2.0.10/... && dpkg -i micro-2.0.10-amd64.deb" does not.
  - bscphil 5y ago
    The latter absolutely should get just as hostile a reaction. The only thing it provides you over the former is that it at least guarantees you that the author went to the trouble of creating a deb. Actually, it should probably get even more hostile a reaction, since installing it that way usually means you won't get any updates for it. If you absolutely must install software from a (trusted) source other than your distribution, adding a source and then using `apt` is the way to go.
- qbasic_forever 5y ago
  The reality is you need to install a random PPA or download a random deb from the author's website, github, etc. because the debian release is woefully out of date. So you're back to installing random binaries again.
  - bscphil 5y ago
    If you need the latest available versions of the software you use, you should probably use a distribution that has that as a goal. Debian is built with the intention of providing stability, under the assumption that most of its users can afford to go a couple of years without feature updates in the software they use.
- selfhoster11 5y ago
  If you need to install from the author's site, that means that there is no Deb available in the official repos, or that it's outdated. In both cases, you end up installing something that the author compiled.

Why is this more dangerous than installing a deb, which can also run arbitrary code as root?

by Meekro 5y ago

Why is this more dangerous than installing a deb, which can also run arbitrary code as root?

It is more about streamlined process of package management to which Linux users are used. At least with deb/rpm package I understand where package stuff goes and how to uninstall it (of course, packager could mess up this with arbitrary install scripts). And each 'curl https:// https://' packager has its own idea where his software should be installed. And many of them are not even providing automated way to delete their application.

walrus01 5y ago

a .deb at least went through some cursory level of examination by the people who downloaded the source, built it and are authorized by the debian project to submit new .deb files to the debian package servers. not just any random person can submit a .deb and have it go live on the gpg-key authenticated debian mirrors. https://wiki.debian.org/Packaging https://wiki.debian.org/Packaging https://www.debian.org/doc/manuals/debmake-doc/index.en.html https://www.debian.org/doc/manuals/debmake-doc/index.en.html curl into bash can be as quick as "ooh look shiny new thing on website, let's copy/paste this string of text into my shell"

Meekro 5y ago
I agree that debs that were audited and distributed in the package manager are better in that way. I guess my objection is that "curl https://getmic.ro https://getmic.ro | bash" often gets a hostile reaction here on HN whereas "wget https://github.com/zyedidia/micro/releases/download/v2.0.10/micro-2.0.10-amd64.deb https://github.com/zyedidia/micro/releases/download/v2.0.10/... && dpkg -i micro-2.0.10-amd64.deb" does not.
- bscphil 5y ago
  The latter absolutely should get just as hostile a reaction. The only thing it provides you over the former is that it at least guarantees you that the author went to the trouble of creating a deb. Actually, it should probably get even more hostile a reaction, since installing it that way usually means you won't get any updates for it. If you absolutely must install software from a (trusted) source other than your distribution, adding a source and then using `apt` is the way to go.
qbasic_forever 5y ago
The reality is you need to install a random PPA or download a random deb from the author's website, github, etc. because the debian release is woefully out of date. So you're back to installing random binaries again.
- bscphil 5y ago
  If you need the latest available versions of the software you use, you should probably use a distribution that has that as a goal. Debian is built with the intention of providing stability, under the assumption that most of its users can afford to go a couple of years without feature updates in the software they use.
selfhoster11 5y ago
If you need to install from the author's site, that means that there is no Deb available in the official repos, or that it's outdated. In both cases, you end up installing something that the author compiled.