3 ms·
> Those services I mentioned -- COPR/OBS, they can be the trusted sources by your users. But there's nothing trusted about them is the point, you can ship a de
by masklinn 4y ago
> Those services I mentioned -- COPR/OBS, they can be the trusted sources by your users.
But there's nothing trusted about them is the point, you can ship a deb or rpm with all sorts of scripts running at installation, this is no safer than curl | sh.
If anything it's worse, when you "curl | sh" and it requests sudo you can go "mmm no we're not doing this I will happily risk compromising all my user data but it stops at my system integrity".
rpm or deb you're already running as root.
> If you trust the developer/maintainer, you can trust these services.
And you can also trust their site which you're curl-ing from.
- bravetraveler 4y agoIf we assume the worst of the maintainer/packager, of course it's no better. I'm assuming some adherence to these guidelines, otherwise they should be removed from the service: https://docs.fedoraproject.org/en-US/packaging-guidelines/#_no_files_or_directories_under_srv_usrlocal_or_homeuser https://docs.fedoraproject.org/en-US/packaging-guidelines/#_... A package adhering to this guideline modifying system files, as designed, is not a problem. They are explicitly prohibited from modifying user data. My point with managers vs scripts is that managers provide some sanity. Not perfection. I trust: - a versioned package - built to the linked standards - from upstream sources in an offline environment Far more than I do curl | bash. There is far less ambiguity and I can actually reproduce this exact environment at some point.