3 ms·
Debian packages (and also RPMs) have pre and postinstall scripts that run with root privileges.
by FooBarWidget 13y ago
Debian packages (and also RPMs) have pre and postinstall scripts that run with root privileges.
- stormbrew 13y agoYes, and they're also signed by both the author and the package maintainers and have to go through a public review to be included in the package repository. Even for an upgrade. The whole point of that rigmarole is to provide some extra level of guarantee that they haven't been taken over by aliens. Gems, as an alternative example, can be updated by the author (or anyone with their authentication key) at any time. They can be signed, but even if they are there's no real way to verify the authenticity of the signer. I'm not even saying this is a bad thing. There's validity to both approaches because they prioritize different things.
- FooBarWidget 13y agoYes but we're not comparing distribution-official APT repositories with unsigned downloads, we're comparing potentially third party APT repositories with HTTPS downloads. When users add a third party repo they often don't check who the author is, who the key belongs to or whether they even obtained a legit key. In the HTTPS case, users don't check the HTTPS certificate. The end security is about the same.