12

In this question a deb-package was linked without any hint to the potential danger of bypassing Ubuntu's package management. I know that in the Window's world setup.exe are quite common, but common does not mean secure and also does not mean advisable.

So I was wondering:

  • Should we never link to external deb-packages?
  • Should we only use packages from trusted sources? What are trusted sources?
  • Should we add them but always add a "be careful what you download"-hint?
11

JRG has asked a question you can link to, now you can do this:

  • If you see a question referencing a random .deb from the internets, edit it and add this notice:

    Note: Installing packages from untrusted sources may harm your computer. Please consider finding an alternative, trusted source if you have to install this package.

  • If you know of one, definitely add a comment pointing to a more trusted source, such as an officially endorsed PPA (by the vendor) or the Ubuntu repositories themselves.

  • If you're sure your new source doesn't harm the quality of the answer, replace it altogether rather than adding a notice.


Please remember, this is only an "official policy" if you actually start doing it. Until then, I merely post this for the purpose of discussion.

But I'm championing this solution. Even though a couple of users will get disgruntled at the suggestion that their package is 'harmful', in the long term it'll help keep Ubuntu secure.

  • @k0pernikus Oops. Sorry. I just saw this on meta and went for it. :P – jrg Jan 23 '12 at 14:12
7

We don't (yet) have a real policy concerning this. If you see a link to a .deb package and the same version of the same program is available from the repositories, you can of course edit the answer.

The german Ubuntu wiki - for instance - adds this notice whenever they use a standalone .deb:

Notice

External packages may harm your system

If you want to add this notice to an answer, you can do so. But you should find a better link than this google-translated page explaining why.

Chrome also warns you if you're trying to download a .deb:

enter image description here

I suggest you ask a question like "How can external packages harm my system?" and link to that, once it has an answer. Then you can add this notice every time you see a link to a deb and it will make sense to the user (who potentially has no choice but to download and install it in order to fix their problem).

  • Can I suggest this become our policy? Can we have a question on "safe strange .deb practice" or something, like we have PPA warning signs? – jrg Jan 22 '12 at 19:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .