3 ms·
>You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them? Yea, I think this is silly. Apps have the power to updat
by shrimp_emoji 5y ago
>You don’t consider Mozilla trustworthy so you’ll use their browser but not if it’s packaged by them?
Yea, I think this is silly.
Apps have the power to update themselves out-of-band from the package manager, so, even if you only install it via the package manager, it can do whatever it wants while short-circuiting the maintainers' oversight.
- plonk 5y ago> Apps have the power to update themselves out-of-band from the package manager Isn't that disabled in Ubuntu's Firefox APT package?
- adhesive_wombat 5y agoWell, not directly: they'd need root to overwrite /usr/bin/firefox, which it wouldn't normally (hopefully) run as. They could have latent malicious code which gets packaged and that could download a payload and execute that (or already contains the attack). But a program without such a pre-existing ability won't be able to update itself to a version that does.