In light of the many misunderstandings about Linux, software repositories and installation of packages, part one of this season's Mandriva Linux 2006 review includes an extensive background article about it. It explains why the nature of Free Software leads to a more userfriendly software installation setup for Linux distributions in general, as compared to proprietary systems such as the current desktop market leader. The process is illustrated with Mandriva Linux tools. This first part of the Mandriva Linux 2006 review also contains information on the installation and benchmark figures against previous Mandriva/Mandrake products, amongst other things.
To view parent comment, click here.
To read all comments associated with this story, please click here.
Member since:Do you really think that all packages in the repository has undergone security audit by the packagers?
No, but the fact is that they all come from the same developers, that they pass through lots of distro, that a lot of companies do security audits on lots of these software, and all that thanks to 2 things : GPL and source code available. So in the end, it's still far better than any closed source app. Apart for experiment (gcc hack), I still never heard of any open source software with malware.
DO you think they have time to check the code line-by-line? You're seriously misinformed then. I could easily sneak malware in 100 packages and nobody would notice
You are plain wrong. Your zealotry is not reality. The fact is that you could not do that with official repositories. Taking Mandriva, you would have to sneak in the new package, then manage to create a MD5 and SHA1 (think it's SHA1) for all the packages, which is already hard to defeat. But you would have to infect all the repositories too. Some people already tried what you talk about for some distro, and it was quickly detected. So, for someone like you that does not even understand the power of the Linux distro repositories, that don't even know how they work, I can confidently say we have nothing to fear from you.
The only repositories you would have a chance of infecting are the one from easyrpmi, which are not signed or have no MD5.
In most cases, you have to TRUST upstream anyway, so it's no different from the case when I download software from the developer's site.
WRONG ! Trusting ONE upstream you got the system from (Mandriva) is not comparable with trusting any random provider on the internet. There is a reason why distro don't always provide the latest version of packages, but you could not understand that.
Member since:2005-10-18
No, but the fact is that they all come from the same developers
yes they do by definition, whether in a repository or not :-)
that they pass through lots of distro
...that also do not analyse most of the software for security that closely, because it is a really daunting task. That slightly increases coverage though, because different distro have different specialization. But no one of them does comprehensive analysis of all software.
that a lot of companies do security audits on lots of these software
on a limited set of software - mostly core one
and all that thanks to 2 things : GPL and source code available
which are a given whether or not an app is in a repository :-)
So in the end, it's still far better than any closed source app.
who spoke about closed source, buddy? :-)
I still never heard of any open source software with malware.
That IS the truth! And this is true not because of repos, but because of the availability of the source code.
The fact is that you could not do that with official repositories. Taking Mandriva, you would have to sneak in the new package, then manage to create a MD5 and SHA1 (think it's SHA1) for all the packages, which is already hard to defeat.
Hey, and why do I have to do that with repositories? I'll infect source that all repositories take. So that you could receive your malware properly signed :-)
WRONG ! Trusting ONE upstream you got the system from (Mandriva) is not comparable with trusting any random provider on the internet.
Dude, this provider IS the upstream! By definition. When a distro packages an app it hasn't thouroughly checked for security (which, as I said before, is the case for the most part of 17000 Mandriva packages), it means that they trust the author. And by installing this app from a repo, you implicitly trust him/her, too!
Oh, and why you are calling me a zealot is beyond me. Unless, of course, you define zealot as "having a different opinion on the general usefulness of repositories" :-)
Member since:{Do you really think that all packages in the repository has undergone security audit by the packagers? DO you think they have time to check the code line-by-line? You're seriously misinformed then. I could easily sneak malware in 100 packages and nobody would notice. In most cases, you have to TRUST upstream anyway, so it's no different from the case when I download software from the developer's site.}
ROFLMAO.
The security audit is done in the fact that the packages are open source.
Being open source, programmers who did not author the code get to see the code, and having seen it they still use the package.
It is not possible to sneak malware in. To put a package in a repository it has to be open source. As soon as anyone used the package and had a bad experience with it there would be complaint, the source would be examined, your malware-containing package would be out of the repository and you would never be allowed to submit anything ever again.
You seriously misunderstand open source and the way in which repositories work.
Guaranteed free of malware.
"So in summary... Google has pulled the plug on support on a protocol they've helped popularize, after years of promising interoperability, for reasons that are dubious at best, and in a way that leaves people who don't jump to the new Hangouts app unable to talk to their contacts without any feedback that their IMs aren't getting through... And they've done that with no warning to anyone. I imagine there's a bunch of people out there wondering where some of their buddies have gone, or why their messages aren't getting responses, because this isn't documented anywhere." Google really messed this up. Such a dick move.
The Tizen Greek Community has some screenshots of a very recent build of Tizen running on a Samsung GT-i8800. It looks wholly unremarkable.Joint statement to The Next Web from Microsoft and Google: "Microsoft and YouTube are working together to update the new YouTube for Windows Phone app to enable compliance with YouTube's API terms of service, including enabling ads, in the coming weeks. Microsoft will replace the existing YouTube app in Windows Phone Store with the previous version during this time." Good to know these children stopped acting like little pricks. Can we have full Google support in Windows 8 now, please?
Yahoo is acquiring Tumblr, the microblogging and social networking website, for $1.1 billion USD. Tumblr offers little revenue but lots of eyeballs if Yahoo can monetarize them. Now Yahoo is bidding for Hulu, the streaming video service. After years of ineffective responses while Google, Facebook, and others took large chunks of the online advertising market, Yahoo is fighting back. Can Yahoo reignite the momentum it had at the turn of the century? What do you think?
"Sources have described iOS 7 as 'black, white, and flat all over'. This refers to the dropping of heavy textures and the addition of several new black and white user interface elements." I couldn't be happier.
"Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues."
"Google is facing a new antitrust probe by the U.S. Federal Trade Commission into whether the company is using its leadership in the online display-advertising market to illegally curb competition, people familiar with the matter said." Sucks to be Google today, apparently."In the midst of the major press blitz surrounding its annual I/O Conference, Google dropped some unfortunate news about its instant messaging plans. In several places around the web, the company is replacing the existing 'Talk' platform with a new one called 'Hangouts' that sharply diminishes support for the open messaging protocol known as XMPP (or sometimes informally Jabber), and also removes the option to disable the archiving of all chat communications. These changes represent a switch from open protocols to proprietary ones, and a clear step backward for many users." That's why I always say: only suckers trust companies."The wave of departures is a sign of internal struggle, but amidst all the bad news, there is a glimmer of hope. According to an anonymous HTC executive cited by WSJ, the crucial HTC One is selling 'pretty good so far'. The executive revealed that HTC sold about five million One units since launch, a performance that is deemed encouraging. However, sales have been limited by the persisting supply issues that still plague the production of the HTC One." Finally some good news for HTC. Five million units amidst supply constraints is very impressive.
"Sony gave the PS4 50% more raw shader performance, plain and simple (768 SPs @ 800MHz vs. 1152 SPs & 800MHz). Unlike last generation, you don't need to be some sort of Jedi to extract the PS4's potential here. The Xbox One and PS4 architectures are quite similar, Sony just has more hardware under the hood. Weâll have to wait and see how this hardware delta gets exposed in games over time, but the gap is definitely there. The funny thing about game consoles is that itâs usually the lowest common denominator that determines the bulk of the experience across all platforms. On the plus side, the Xbox One should enjoy better power/thermal characteristics compared to the PlayStation 4. Even compared to the Xbox 360 we should see improvement in many use cases thanks to modern power management techniques." AnandTech does its usual in-depth thing.
Member since:
2005-10-18
"guaranteed free of malware"
Do you really think that all packages in the repository has undergone security audit by the packagers? DO you think they have time to check the code line-by-line? You're seriously misinformed then. I could easily sneak malware in 100 packages and nobody would notice. In most cases, you have to TRUST upstream anyway, so it's no different from the case when I download software from the developer's site.