1

I wonder what the policy is on answers involving ppa's.

This question came to my mind, especially after reading many answers on Tor-Browser related questions. In most of these answers, like this tor browser install ubuntu 14.04 a ppa is recommended. Yet in the comment to the accepted answer my problem with these solutions is clearly stated.

Is there any policy you folks have already developed?

To me - thinking about quality on this page - it appears to be a problem, when there are answers - especially regarding security critical software - that involve ppas.

What are your thoughts or solutions?

3
  • We have a Q&A somewhere on the safety of PPAs. We rely on people to either warn that PPAs aren't necessarily secure, or for people to already know that. It's perfectly acceptable to use PPAs as part of an answer. It is recommended that a warning be put in.
    – TheWanderer
    Commented Nov 11, 2016 at 3:30
  • Yes, i stumbled over this Q&A and I already know about (in)safety of PPAs. Yet I think in regard to safety an answer like the one mentioned above is more than dangerous. So your proposed position would be to add comments to these answers pointing out, why it is not wise to do things like this - especially if the upstream project has a own updating process? Plus wouldn't it be wise to have a flag for insecure answers, so things could be corrected in the afterwards on closed/solved questions?
    – d1bro
    Commented Nov 11, 2016 at 3:56
  • @db429 the answer isn't insecure - webupd8 is known PPA , and second it has to be proven to some extend to be insecure, so that flag is likely to be declined.
    – Sergiy Kolodyazhnyy
    Commented Nov 11, 2016 at 4:03

2 Answers 2

Reset to default
8

I like to point to this page when referring to PPAs:

I put this warning everytime I add a PPA to an answer, not because I believe they are malicious (after all, the world hasn't ended in the last decade or so they've been around), but mostly because no one is out there testing the different combinations of different PPAs. I just kind of put it at the bottom and let the user decide what they want to do. People get confused doing upgrades or maybe a developer of a PPA bails and it ends up being stale or it 404's for the latest release or whatever.

Their original intent of PPAs was to enable developers to get code out fast to tighten the development feedback loop between testers and developers. But over time they ended up being user-facing things due to people wanting newer software than Ubuntu could provide.

Thankfully snappy is being designed with all of this in mind, so people can finally get the latest software they want without having to worry if an upgrade will break their computer, which is a good thing!

2

First of all, PPA's are perfectly acceptable as answers here. Sure, it may involve risks, but there's risks of getting malware or at least have vulnerabilities slip through even in official repositories of Ubuntu. So I consider this somewhat of a redundancy to consider PPAs dangerous or forbid them from site.

To me - thinking about quality on this page - it appears to be a problem, when there are answers - especially regarding security critical software - that envolve ppa's.

Tor, first of all, isn't security critical to Ubuntu itself - it is a 3rd party software. It would be different story if this was official Ubuntu package of sorts. Second, tor license is GPL , so they're OK with its distribution, which is what the PPA does.

To quote your original comment that you're referring to:

I'm sure webupd8team updates their packages very consistently and quickly, however I would note that if you install Tor Browser Bundle the way @purbleguy suggests instead, the browser will update itself very soon after an update is available. For someone needing to retain their anonymity, this could be critical. This also removes the need to trust that webupd8team has not made any bad changes to the software (not that they would, but removing trust is always a good idea in this field)

The thing is webupd8 has been around for quite a while, there are numerous software packages there. Removing trust form someone who holds quite decent reputation in the community is kind of . . . don't want to say absurd but that's how it feels. Second, how can you trust tor project itself not to make a baited software, with potential backdoors ?

In conclusion, security sure has always been a trade-off with usability, but it's a trade-off that users should probably make themselves and be conscious about it. I don't mind your comment at all, but requiring every single post on the site to say "disclaimer: PPAs may be bad for your health" is somewhat like listening to those medical commercials - yes we ,know there might be side-effects, yada yada yada - it defeats its own purpose.

So what I am trying to say here, just let the PPAs be.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .