Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #234051

Re: ubuntu/snap future

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Vi, 09 apr 21, 06:34:32, riveravaldez wrote:
> On 4/9/21, tomas@tuxteam.de <tomas@tuxteam.de> wrote:
> >
> > Is it really unavoidable? Or just a tad less convenient?
> 
> Well, that's a pretty subjective issue, to be honest... ;)
> 
> > Can you pose one concrete use case where it is unavoidable?
> 
> Not sure if *unavoidable* but I didn't found a better solution at the
> time:
> A client for which laptop I'd installed Debian was in job-need of
> using Skype and Zoom. Her employers wouldn't use anything
> else, so, I was looking for the better/safer way to install such damn
> closed-source pieces of soft (in particular I hate Zoom, but that's
> another subjective issue...) in a for anything else fully libre/secure
> perfectly working Debian system.
> I have no idea what the official .deb packages from Skype/Zoom
> do, so, to minimize exposition and control-lost looked for an easy
> way to 'enclose' what those programs could do, and opted finally
> for Flatpak just to avoid any Canonical late-inconvenience...

Just a general reminder: dpkg will execute all maintainer scripts 
contained in the package as root.

Packages can also contain various other files that can have a big impact 
on system security, like system .service files, cron jobs/timers running 
as root, SUID binaries, etc., even if the program itself is (meant to 
be) run only as a regular user.

If you care about the security of your system inspecting the .deb before 
'dpkg -i' is always a good idea (e.g. with mc or so).

If you are adding foreign repositories you are also trusting them for 
all package updates, for *any* package on your system.

By default APT doesn't care from which repository a particular package 
is coming from, as long as it has the higher version, and that is easy 
enough to manipulate (e.g. with an epoch). A trusted repository could 
then easily substitute *any* package on your system (kernel, init, 
shell, etc.) via package upgrades.

The repository doesn't even have to be evil, as it could always be 
hijacked by a bad actor.


Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

ubuntu/snap future George Shuklin <george.shuklin@gmail.com> - 2021-04-03 18:40 +0200
  Re: ubuntu/snap future "Andrew M.A. Cater" <amacater@einval.com> - 2021-04-03 19:00 +0200
  Re: ubuntu/snap future Paul Johnson <baloo@ursamundi.org> - 2021-04-06 02:00 +0200
    Re: ubuntu/snap future Peter Ehlert <peter@sdi-baja.com> - 2021-04-06 03:10 +0200
    Re: ubuntu/snap future Yoann LE BARS <yoann@le-bars.net> - 2021-04-06 11:30 +0200
      Re: ubuntu/snap future Brian <ad44@cityscape.co.uk> - 2021-04-06 13:50 +0200
        Re: ubuntu/snap future Celejar <celejar@gmail.com> - 2021-04-06 14:30 +0200
        ubuntu/snap future riveravaldez <riveravaldezmail@gmail.com> - 2021-04-07 05:30 +0200
          Re: ubuntu/snap future Dan Ritter <dsr@randomstring.org> - 2021-04-07 12:20 +0200
            Re: ubuntu/snap future riveravaldez <riveravaldezmail@gmail.com> - 2021-04-09 09:20 +0200
              Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 09:30 +0200
                Re: ubuntu/snap future riveravaldez <riveravaldezmail@gmail.com> - 2021-04-09 11:40 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 13:00 +0200
                Re: ubuntu/snap future Joe <joe@jretrading.com> - 2021-04-09 15:00 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 15:30 +0200
                Re: ubuntu/snap future Andrei POPESCU <andreimpopescu@gmail.com> - 2021-04-09 19:50 +0200
                Re: ubuntu/snap future Brian <ad44@cityscape.co.uk> - 2021-04-09 20:30 +0200
                Re: ubuntu/snap future George Shuklin <george.shuklin@gmail.com> - 2021-04-10 16:10 +0200
                Re: ubuntu/snap future riveravaldez <riveravaldezmail@gmail.com> - 2021-04-29 02:20 +0200
                Re: ubuntu/snap future Yoann LE BARS <yoann@le-bars.net> - 2021-04-09 13:10 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 13:40 +0200
                Re: ubuntu/snap future Yoann LE BARS <yoann@le-bars.net> - 2021-04-09 13:50 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 14:50 +0200
                Re: ubuntu/snap future Joe <joe@jretrading.com> - 2021-04-09 15:10 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 15:40 +0200
                Re: ubuntu/snap future Stefan Monnier <monnier@iro.umontreal.ca> - 2021-04-09 17:10 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 19:00 +0200
                Re: ubuntu/snap future Yoann LE BARS <yoann@le-bars.net> - 2021-04-09 18:10 +0200
                Re: ubuntu/snap future Andrei POPESCU <andreimpopescu@gmail.com> - 2021-04-09 19:30 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 19:30 +0200
                Re: ubuntu/snap future Celejar <celejar@gmail.com> - 2021-04-09 14:10 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 15:00 +0200
                Re: ubuntu/snap future Celejar <celejar@gmail.com> - 2021-04-09 15:30 +0200
                Re: ubuntu/snap future tomas@tuxteam.de - 2021-04-09 15:40 +0200
                Re: ubuntu/snap future The Wanderer <wanderer@fastmail.fm> - 2021-04-09 15:50 +0200
                Re: ubuntu/snap future <tomas@tuxteam.de> - 2021-04-09 16:20 +0200
                Re: ubuntu/snap future Charles Curley <charlescurley@charlescurley.com> - 2021-04-09 16:20 +0200
                Re: ubuntu/snap future Celejar <celejar@gmail.com> - 2021-04-09 16:30 +0200
                Re: ubuntu/snap future Celejar <celejar@gmail.com> - 2021-04-09 16:20 +0200
                Re: ubuntu/snap future Yoann LE BARS <yoann@le-bars.net> - 2021-04-09 18:20 +0200
                Re: ubuntu/snap future Andrei POPESCU <andreimpopescu@gmail.com> - 2021-04-09 19:50 +0200
                Re: ubuntu/snap future Celejar <celejar@gmail.com> - 2021-04-09 20:40 +0200
                Re: ubuntu/snap future Linux-Fan <Ma_Sys.ma@web.de> - 2021-04-09 21:40 +0200
                Re: ubuntu/snap future Celejar <celejar@gmail.com> - 2021-04-09 22:10 +0200
              Re: ubuntu/snap future Celejar <celejar@gmail.com> - 2021-04-09 14:10 +0200
        Re: ubuntu/snap future George Shuklin <george.shuklin@gmail.com> - 2021-04-10 16:10 +0200

csiph-web