What is the policy concerning external deb-packages?

Question

In this question a deb-package was linked without any hint to the potential danger of bypassing Ubuntu's package management. I know that in the Window's world setup.exe are quite common, but common does not mean secure and also does not mean advisable.

So I was wondering:

• Should we never link to external deb-packages?
• Should we only use packages from trusted sources? What are trusted sources?
• Should we add them but always add a "be careful what you download"-hint?

Answer 1

JRG has asked a question you can link to, now you can do this:

• If you see a question referencing a random .deb from the internets, edit it and add this notice:

  Note: Installing packages from untrusted sources may harm your computer. Please consider finding an alternative, trusted source if you have to install this package.

• If you know of one, definitely add a comment pointing to a more trusted source, such as an officially endorsed PPA (by the vendor) or the Ubuntu repositories themselves.

• If you're sure your new source doesn't harm the quality of the answer, replace it altogether rather than adding a notice.

---

Please remember, this is only an "official policy" if you actually start doing it. Until then, I merely post this for the purpose of discussion.

But I'm championing this solution. Even though a couple of users will get disgruntled at the suggestion that their package is 'harmful', in the long term it'll help keep Ubuntu secure.

Answer 2

We don't (yet) have a real policy concerning this. If you see a link to a .deb package and the same version of the same program is available from the repositories, you can of course edit the answer.

The german Ubuntu wiki - for instance - adds this notice whenever they use a standalone .deb:

Notice

External packages may harm your system

If you want to add this notice to an answer, you can do so. But you should find a better link than this google-translated page explaining why.

Chrome also warns you if you're trying to download a .deb:

I suggest you ask a question like "How can external packages harm my system?" and link to that, once it has an answer. Then you can add this notice every time you see a link to a deb and it will make sense to the user (who potentially has no choice but to download and install it in order to fix their problem).