4 ms·

This doesn't mean that at all. This is the first time I've seen the domain that hosted a trustworthy repo go bye-bye.

J_Darnley 13y ago
So its really about trust then? You trust this website to provide what you want and nothing more. You may also trust other websites that provide up-to-date packages when your distro won't. You may also trust a website to provide software that your distro doesn't. Why is this any safer for the clueless user?
- Nursie 13y ago
  The clueless user won't be using debian. The clueless user who's somehow found themselves in possession of a debian system won't be adding third party repos to debian. The clueless user who's somehow found themselves with a debian system with third party repos installed will be informed when the repository keys change and warned not to install the software because it can't be verified. This is not a case of google->download->double click->virus like windows has had for so long.
  - dagw 13y ago
    I've met plenty of eager 'leet' computer geeks whom are perfectly willing and capable of installing Debian, blindly following howtos and copying and pasting text from forums until they have a working system, and still completely clueless when it comes to general computer security or any other big picture aspect of how Linux works. Hell if I'm to be perfectly honest I think I just described myself the first time I sat down with a spare computer and a big pile of Slackware floppies.
    - Nursie 13y ago
      Heh. I suppose we all had to start learning somewhere. There were no such things as repos when I started playing with debian... The key thing would still protect you though. If you don't have the right keys installed, apt will complain at you constantly. And if someone takes over a domain (like has happened here) and runs a malicious repo (no indication of that) you'll see the warnings again. Trusting the debian team and a community trusted repo, backed up by signing, is a lot different than downloading unsigned packages from a variety of sites all over the net. IMHO.

So its really about trust then? You trust this website to provide what you want and nothing more. You may also trust other websites that provide up-to-date packages when your distro won't. You may also trust a website to provide software that your distro doesn't. Why is this any safer for the clueless user?

Nursie 13y ago
The clueless user won't be using debian. The clueless user who's somehow found themselves in possession of a debian system won't be adding third party repos to debian. The clueless user who's somehow found themselves with a debian system with third party repos installed will be informed when the repository keys change and warned not to install the software because it can't be verified. This is not a case of google->download->double click->virus like windows has had for so long.
- dagw 13y ago
  I've met plenty of eager 'leet' computer geeks whom are perfectly willing and capable of installing Debian, blindly following howtos and copying and pasting text from forums until they have a working system, and still completely clueless when it comes to general computer security or any other big picture aspect of how Linux works. Hell if I'm to be perfectly honest I think I just described myself the first time I sat down with a spare computer and a big pile of Slackware floppies.
  - Nursie 13y ago
    Heh. I suppose we all had to start learning somewhere. There were no such things as repos when I started playing with debian... The key thing would still protect you though. If you don't have the right keys installed, apt will complain at you constantly. And if someone takes over a domain (like has happened here) and runs a malicious repo (no indication of that) you'll see the warnings again. Trusting the debian team and a community trusted repo, backed up by signing, is a lot different than downloading unsigned packages from a variety of sites all over the net. IMHO.