Linked by vodoomoth on Fri 2nd Jul 2010 09:03 UTC
Thread beginning with comment 432296
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Be careful on ubuntu/debian!
by msundman on Fri 2nd Jul 2010 13:34
in reply to "RE: Be careful on ubuntu/debian!"
It doesn't contact the server and ask for glibc et al. And you can check the repo yourself, there is nothing else than Opera-related packages, and as such none of the system packages are downloaded from there.
You are misunderstanding the problem. The problem is that there is nothing stopping opera software from placing glibc or openssh-server packages on their repo and then those opera's unofficial versions would be installed on all opera users' computers.
And I do understand how repos work. I'm running one myself. Heck, I even provide fixed opera packages on my repo, even though it's against opera's license agreement. (If they decide to show me the finger I decide to show them back.)
Edited 2010-07-02 13:36 UTC
RE[3]: Be careful on ubuntu/debian!
by WereCatf on Fri 2nd Jul 2010 14:24
in reply to "RE[2]: Be careful on ubuntu/debian!"
You are misunderstanding the problem. The problem is that there is nothing stopping opera software from placing glibc or openssh-server packages on their repo and then those opera's unofficial versions would be installed on all opera users' computers.
Indeed, they could. But why would they? Tell me even one good reason why would they start to maintain such packages when it provides them with no benefit whatsoever, only extra work to do? It's simply not in their best interest to do the extra work, make sure their packages are free of security holes, are patched properly, work in all the intended distros and then even keep them up-to-date when the distros themselves already have processes and people set up to do that work.





Member since:
2006-02-15
At least on deb based distros, such as ubuntu and debian, opera does some pretty nasty things. It adds the opera software repository to the system (so that all future upgrades you do will also contact opera's servers to see if they have some packages (say, libc or openssh-server) they'd like to "upgrade" on your computer).
It doesn't do it like that. The package manager just downloads a file list from the repository server and then checks the file list if there's the packages you need. It doesn't contact the server and ask for glibc et al. And you can check the repo yourself, there is nothing else than Opera-related packages, and as such none of the system packages are downloaded from there.
I think you have at some point misunderstood repositories and package managers. All the most commonly used package manager systems just download package list which consists of compressed text, names of packages and their versions. And repositories are just regular FTP/HTTP/HTTPS servers which you can browse with your web browser too if you so wish. The package manager never delivers a list of installed packages to the repository, it only downloads from there.