Linked by vodoomoth on Fri 2nd Jul 2010 09:03 UTC
Thread beginning with comment 432312
To view parent comment, click here.
To read all comments associated with this story, please click here.
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[7]: Be careful on ubuntu/debian!
by joekiser on Sun 4th Jul 2010 12:25
in reply to "RE[6]: Be careful on ubuntu/debian!"
Still you're missing the point. The point is not that opera adds itself to apt and tells the system that I trust their repo with all my packages, but that it does so without my explicit permission. If you really can't see this difference and the gravity of their actions I don't think there is any point in continuing this discussion.)
But if Opera were to design their own glibc and serve it through the repo, wouldn't the package manager tell you there is a conflict and ask what you want to do when updating? I don't know apt that well, but this seems to be the case with yum and pacman. If the package system is overwriting packages with similar names and no user input, that is a design problem with apt, not Opera.
All of this is purely speculative, btw. If you don't want Opera messing with system files, stop running everything as root. The FreeBSD version of the 10.6 beta gave me the option to install in my ~/ directory.
RE[8]: Be careful on ubuntu/debian!
by msundman on Sun 4th Jul 2010 18:42
in reply to "RE[7]: Be careful on ubuntu/debian!"
"The point is not that opera adds itself to apt and tells the system that I trust their repo with all my packages, but that it does so without my explicit permission. If you really can't see this difference and the gravity of their actions I don't think there is any point in continuing this discussion.)
But if Opera were to design their own glibc and serve it through the repo, wouldn't the package manager tell you there is a conflict and ask what you want to do when updating? I don't know apt that well, but this seems to be the case with yum and pacman. If the package system is overwriting packages with similar names and no user input, that is a design problem with apt, not Opera. "
No. If opera software serves a package with the same name and a higher version number then the existing (official) package will be replaced by that package during the next update. It's not overwritten, but replaced as if there was a newer one on the official repo. Of course you could put some filters in the apt-preferences to limit what kind of packages are installed/upgraded from opera's repo, but opera doesn't do.
However, you are right in that the (pre|post)(inst|rm)-scripts are a design flaw in apt, and it's those that opera use to do its shenanigans. Still, opera software wasn't forced to do what they did like they did, they chose it.




Member since:
2005-07-06
Err. How is that even remotely similar to a repository? They don't get your keys, they don't know what software you have installed, they don't monitor you. Do explain, I am all ears. "
The fact that they don't know what software I have installed is irrelevant. They can make extremely educated guesses about it. They don't have to monitor me, since they have told my computer to monitor their repository where they (e.g. a disgruntled employee, or a cracker after a security breach) could place a bunch of popular packages that would reach well over 99% of their user base using those opera packages. (This kind of communication is quite similar to "phone home" viruses/malware.)
Again, they don't have your key, you have their key. "
They do get the keys to my system, since they have told my system that I trust their repository completely and utterly for any and all possible packages, although I don't. (And they did so behind my back.)
No different from me making copies of all house keys I copy, not just yours. It'd certainly be noticed if I broke into hundreds of houses whose owners have made key copies at my booth.
Still, you're missing the point. The point is not that opera adds itself to apt and tells the system that I trust their repo with all my packages, but that it does so without my explicit permission. If you really can't see this difference and the gravity of their actions I don't think there is any point in continuing this discussion.
(Mac users are of course used to this kind of shenanigans, but some of us are still trying to hold on to the illusion of still having some control over one's own computers.)