Linked by vodoomoth on Fri 2nd Jul 2010 09:03 UTC
Thread beginning with comment 432309
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[6]: Be careful on ubuntu/debian!
by msundman on Fri 2nd Jul 2010 15:25
in reply to "RE[5]: Be careful on ubuntu/debian!"
"So if I run a booth that copies keys, and you come there to get a copy of your house key, should I keep a copy of your key, without telling you about it, and even installing my own fancy monitoring system that notifies me of when you change your locks?
Err. How is that even remotely similar to a repository? They don't get your keys, they don't know what software you have installed, they don't monitor you. Do explain, I am all ears. "
The fact that they don't know what software I have installed is irrelevant. They can make extremely educated guesses about it. They don't have to monitor me, since they have told my computer to monitor their repository where they (e.g. a disgruntled employee, or a cracker after a security breach) could place a bunch of popular packages that would reach well over 99% of their user base using those opera packages. (This kind of communication is quite similar to "phone home" viruses/malware.)
"And why would I want to use my secretly copied copy of your key for anything bad?
Again, they don't have your key, you have their key. "
They do get the keys to my system, since they have told my system that I trust their repository completely and utterly for any and all possible packages, although I don't. (And they did so behind my back.)
And in your [...] example you'd have access to a single house, whereas Opera's repo is accessed by thousands. If something was screwy it'd be noticed whereas if you broke to a single house it'd be noticed by only a handful of people and they wouldn't know who it was.
No different from me making copies of all house keys I copy, not just yours. It'd certainly be noticed if I broke into hundreds of houses whose owners have made key copies at my booth.
Still, you're missing the point. The point is not that opera adds itself to apt and tells the system that I trust their repo with all my packages, but that it does so without my explicit permission. If you really can't see this difference and the gravity of their actions I don't think there is any point in continuing this discussion.
(Mac users are of course used to this kind of shenanigans, but some of us are still trying to hold on to the illusion of still having some control over one's own computers.)
RE[7]: Be careful on ubuntu/debian!
by joekiser on Sun 4th Jul 2010 12:25
in reply to "RE[6]: Be careful on ubuntu/debian!"
Still you're missing the point. The point is not that opera adds itself to apt and tells the system that I trust their repo with all my packages, but that it does so without my explicit permission. If you really can't see this difference and the gravity of their actions I don't think there is any point in continuing this discussion.)
But if Opera were to design their own glibc and serve it through the repo, wouldn't the package manager tell you there is a conflict and ask what you want to do when updating? I don't know apt that well, but this seems to be the case with yum and pacman. If the package system is overwriting packages with similar names and no user input, that is a design problem with apt, not Opera.
All of this is purely speculative, btw. If you don't want Opera messing with system files, stop running everything as root. The FreeBSD version of the 10.6 beta gave me the option to install in my ~/ directory.





Member since:
2006-02-15
So if I run a booth that copies keys, and you come there to get a copy of your house key, should I keep a copy of your key, without telling you about it, and even installing my own fancy monitoring system that notifies me of when you change your locks?
Err. How is that even remotely similar to a repository? They don't get your keys, they don't know what software you have installed, they don't monitor you. Do explain, I am all ears.
And why would I want to use my secretly copied copy of your key for anything bad?
Again, they don't have your key, you have their key. Quite different. And in your (rather stupid) example you'd have access to a single house, whereas Opera's repo is accessed by thousands. If something was screwy it'd be noticed whereas if you broke to a single house it'd be noticed by only a handful of people and they wouldn't know who it was.
Your analogy is terrible.