Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #197963

Re: trusting .deb packages

Show all headers | View raw

‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
On July 24, 2018 9:43 AM, Dan Ritter <dsr@randomstring.org> wrote:

> On Tue, Jul 24, 2018 at 10:45:38AM -0500, Anil Duggirala wrote:
>
> > I am thinking about installing the Mega.nz app on my Debian Stretch installation. They provide a .deb package. Is there anything I can do to ensure this is a safe package? To know that this package will not create a security vulnerability on my system? What is the minimum security procedure to follow when installing third party provided .deb packages?
>
> Do you trust the people who wrote it?
>
> Do they provide the source?
>
> Do they give you instructions on how to build the source into a
> package?
>
> Are you competent to read and understand the source?
>
> What do you stand to lose if you place your trust in them and it
> turns out that they were incompetent or evil?
>
> -dsr-

In addition to this, be sure not to break Debian:

https://wiki.debian.org/DontBreakDebian
https://wiki.debian.org/DebianSoftware#Footnotes

Personally, I have a low degree of trust for Mega.nz, so caveat emptor.

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

trusting .deb packages Anil Duggirala <anilduggirala@fastmail.fm> - 2018-07-24 17:50 +0200
  Re: trusting .deb packages Dan Ritter <dsr@randomstring.org> - 2018-07-24 18:50 +0200
    Re: trusting .deb packages Anil Duggirala <anilduggirala@fastmail.fm> - 2018-07-24 20:00 +0200
    Re: trusting .deb packages john doe <johndoe65534@mail.com> - 2018-07-24 20:40 +0200
      Re: trusting .deb packages Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-07-25 07:50 +0200
        Re: trusting .deb packages john doe <johndoe65534@mail.com> - 2018-07-25 11:40 +0200
    Re: trusting .deb packages Matthew Crews <mailinglists@mattcrews.com> - 2018-07-24 23:50 +0200
      Re: trusting .deb packages Rick Thomas <rbthomas@pobox.com> - 2018-07-25 04:40 +0200
        Re: trusting .deb packages Matthew Crews <mailinglists@mattcrews.com> - 2018-07-25 04:40 +0200
          Re: trusting .deb packages Gene Heskett <gheskett@shentel.net> - 2018-07-25 05:20 +0200
          Re: trusting .deb packages Ben Caradoc-Davies <ben@transient.nz> - 2018-07-25 05:40 +0200
        Re: trusting .deb packages Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-07-25 07:50 +0200
      Re: trusting .deb packages Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-07-25 08:00 +0200
        Re: trusting .deb packages Darac Marjal <mailinglist@darac.org.uk> - 2018-07-25 16:00 +0200
          Re: trusting .deb packages Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-07-25 17:40 +0200
            Re: trusting .deb packages Brian <ad44@cityscape.co.uk> - 2018-07-25 17:50 +0200
  Re: trusting .deb packages Ben Caradoc-Davies <ben@transient.nz> - 2018-07-25 00:00 +0200
    Re: trusting .deb packages Ben Caradoc-Davies <ben@transient.nz> - 2018-07-25 02:30 +0200
      Re: trusting .deb packages Anil Duggirala <anilduggirala@fastmail.fm> - 2018-07-25 03:10 +0200
        Re: trusting .deb packages Ben Caradoc-Davies <ben@transient.nz> - 2018-07-25 03:40 +0200

csiph-web