4 ms·

I don't see how installing from an archive is safer than using a package, can you develop ? From my understanding, Chrome is obviously not chrooted, so a local

by arcatek 14y ago

I don't see how installing from an archive is safer than using a package, can you develop ? From my understanding, Chrome is obviously not chrooted, so a local root exploit will be required in either case to access to the other accounts (since it will run with your current privileges). And actually it seems easier to corrupt a chrome extracted in the home directory, since an intruder would not require root credentials to inject some code into your chrome (and replacing every bank front page with fishing pages, for example).

throwaway54-762 14y ago
RPMs / dpkgs require root to install to the machine-global database. Both package formats have mechanisms called "triggers" which allow the package to run arbitrary shell script at install or uninstall time. Since install/uninstall are run as root, this means arbitrary root code execution on install. Vs: a non-root user extracting a tgz and then running some file, root is never involved. I'm not in agreement with OP about this being a concern worth his or her mitigation strategy, but the logic is sound.