better apt security with 3rd-party sites

2004-01-12 Thread Ryan Underwood
Hi, I've often questioned the security of adding 3rd-party sites to my sources.list that are required for various non-free or other packages that aren't in Debian yet. Basically, I am putting the security of my system at the mercy of however secure their system happens to be, by allowing them to

better apt security with 3rd-party sites

2004-01-12 Thread Ryan Underwood
Hi, I've often questioned the security of adding 3rd-party sites to my sources.list that are required for various non-free or other packages that aren't in Debian yet. Basically, I am putting the security of my system at the mercy of however secure their system happens to be, by allowing them to

Re: better apt security with 3rd-party sites

2004-01-12 Thread Steve Kemp
On Mon, Jan 12, 2004 at 10:58:02AM -0600, Ryan Underwood wrote: > I've often questioned the security of adding 3rd-party sites to my > sources.list that are required for various non-free or other packages > that aren't in Debian yet. Basically, I am putting the security of my > system at the merc

Re: better apt security with 3rd-party sites

2004-01-13 Thread Ryan Underwood
On Mon, Jan 12, 2004 at 07:18:07PM +, Steve Kemp wrote: > > > Note that I ignore trojaned binaries/libraries. The reason is that, > > without setuid, you would have to purposefully run these as root, > > hopefully knowing the consequences for doing so; there are warnings > > everywhere that

Re: better apt security with 3rd-party sites

2004-01-12 Thread Steve Kemp
On Mon, Jan 12, 2004 at 10:58:02AM -0600, Ryan Underwood wrote: > I've often questioned the security of adding 3rd-party sites to my > sources.list that are required for various non-free or other packages > that aren't in Debian yet. Basically, I am putting the security of my > system at the merc

Re: better apt security with 3rd-party sites

2004-01-13 Thread Ryan Underwood
On Mon, Jan 12, 2004 at 07:18:07PM +, Steve Kemp wrote: > > > Note that I ignore trojaned binaries/libraries. The reason is that, > > without setuid, you would have to purposefully run these as root, > > hopefully knowing the consequences for doing so; there are warnings > > everywhere that