Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Ubuntu Still Trying To Lock Down Third-Party Debs

  1. #1
    Join Date
    Jan 2007
    Posts
    15,133

    Default Ubuntu Still Trying To Lock Down Third-Party Debs

    Phoronix: Ubuntu Still Trying To Lock Down Third-Party Debs

    In the name of security, Ubuntu developers are looking at ways to lock-down or verify the way third-party Debian packages are handled on Ubuntu Linux...

    http://www.phoronix.com/vr.php?view=MTA5ODg

  2. #2
    Join Date
    Mar 2011
    Posts
    222

    Default

    Here's my proposal:

    When a user downloads a third-party .deb from an unverified source and tries to run it, the following dialog box is displayed:



    It's been around for a while.

  3. #3
    Join Date
    Dec 2011
    Posts
    148

    Default Don't

    I say don't. if the user wants to use third party apps, let them, and let them face the consequences. For not included apps, do something like Chakra has done with bundles (installs as normal user, runs in "sort of a" jail. Tweaking should stop being sugarcoated : you get a system, you screw it up with third parties, your problem. Most uses I see for third-party repos are updates without updating the system (then I get a call to repair everything that f***ed up), apps not in the USC are usually pretty specific use cases though, so an OBS-like system to create package for USC would help there.

  4. #4
    Join Date
    Dec 2010
    Location
    MA, USA
    Posts
    1,386

    Default

    dpkg and gdebi already do this for you. if you try installing something that is obsolete or already in the repositories, the program warns you. the only difference is the user would have already wasted their time downloading the package.

    i think a more realistic problem to fix is preventing people from downloading packages such as .rpm when ubuntu (by default) doesn't support them.

  5. #5
    Join Date
    Mar 2011
    Posts
    222

    Default

    Quote Originally Posted by schmidtbag View Post
    dpkg and gdebi already do this for you. if you try installing something that is obsolete or already in the repositories, the program warns you. the only difference is the user would have already wasted their time downloading the package.
    Exactly. No need to make my life (or anyone else's) any harder than that.

    My proposed solution is elegant because of its flexibility: inexperienced users will be warned of the possible dangers while power users who understand the risks (and usually know exactly what the installer does) are free to do their thing. Making people's life more difficult is hardly a solution.

    Quote Originally Posted by schmidtbag View Post
    i think a more realistic problem to fix is preventing people from downloading packages such as .rpm when ubuntu (by default) doesn't support them.
    And don't you dare try to prevent me from downloading what I want.

  6. #6
    Join Date
    Dec 2010
    Location
    MA, USA
    Posts
    1,386

    Default

    Quote Originally Posted by M1kkko View Post
    And don't you dare try to prevent me from downloading what I want.
    well I don't mean literally prevent it, just as another warning that encourages preventing. So for example you go to download a package and as soon as a .rpm file is detected in your downloads folder, a background process will create a popup message warning the user that what they're downloading is not intended to be used in ubuntu and could otherwise cause problems.

  7. #7
    Join Date
    Dec 2011
    Location
    UK
    Posts
    19

    Default System Restore

    Why not integrate some sort of system restore feature where if the package does mess up the system or anything else then you can just "restore" back before you installed package xyz.

    This should be included anyways by default and should be part of the recovery menu at boot, this would help sell ubuntu even more.

    However this could in turn make people want to install untrusted software even more because they feel they will be safe in the event something goes wrong.

  8. #8
    Join Date
    Jun 2008
    Location
    Perth, Scotland
    Posts
    440

    Default

    Quote Originally Posted by acrazyplayer View Post
    Why not integrate some sort of system restore feature where if the package does mess up the system or anything else then you can just "restore" back before you installed package xyz.
    With btrfs/LVM snapshots, this is actually surprisingly easy to implement, at least on a sequential basis, which is just as good as Windows Restore.

  9. #9
    Join Date
    Dec 2007
    Posts
    677

    Default

    As if anything will change... I'll go out on a limb to say that when most users will want to get something, and USC doesn't provide it: they'll still want to get it.

  10. #10
    Join Date
    Dec 2011
    Location
    UK
    Posts
    19

    Default

    Chewi:

    With btrfs/LVM snapshots, this is actually surprisingly easy to implement, at least on a sequential basis, which is just as good as Windows Restore.
    Ext4 could have the same features as well which would make things even easier.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •