0

I'm completely new user of Ubuntu OS, so at first learning some total basics.

One of the first things to do - installing Chrome browser, made me already confused. I found a big topic about that (How to install Google Chrome), and next to the answer suggesting download .deb file directly from google I read such two comments:

1 - "If you install things the Windows way, you get viruses"

2 - (reply to the first one) "Right, users should be extremely cautious when installing software this way and do it only exceptionally."

Can you explain me why installing software this way is so "danger" according to these two comments? Is it so indeed? If yes, then how can I make it more safe?


update: thanks to @guiverc answer is now for me clear, what technical issues one might get by using .deb to install software. But to completely answer my question I would also like to know, what about those "viruses". It's clear for me that installing .deb from non trustful sources might bring this kind of risks, but should I be worried about that also when I install from known sources (like google in this case)? If yes, then why?

I am a little bit paranoic when it comes to security topics, that's why I'd like to completely understand this aspect as well.

funchal
  • 11

1 Answers1

1

Canonical (employees of company behind Ubuntu 'main' repo.) & Ubuntu members/people/community have tested everything in the repos for the specific release of Ubuntu they are available for.

If you download a .deb from elsewhere, any validation & testing performed on it may be of a lesser standard than that required for inclusion in Ubuntu repositories. One quick difference may be just the validation of what packaging rules it follows (eg. they may use debian standards; fine for debian, but may create problems with ubuntu or another distribution) , the ABI/API's it expects were tested/untested by whomever developed/packaged it & may work with specific libs (Qt or GTK+ releases) so again it's what @SergiyKolodyazhnyy covered in the 'trust' statement in ensuring it matches your system. A wrongly packaged install may create problems that show in other correctly packaged software - ie. you must ensure it's suitable.

An quick example using packaging rules - apt & deb packaging tools (dpkg etc) will upgrade by version; so a poorly packaged version may use a different standard. eg. a coder grabs ver 2.2.2 code, makes a few changes and marks it 2.3 so it'll replace the 2.2.2 files. The next release comes out marked 2.2.3 but it won't replace anyone's 2.3 release as 2.3 < 2.2.2. This is a [dumb] simple example of issues just in packaging as groups follow standards that makes sense to them, having lots to choose from and not all 'play' well with others. More serious issues though are API/ABI changes which are hidden inside packages (and not my simple naming/versioning example)

Larger companies with tech savvy people tend to be a little more aware (ie. do some homework), however their bosses commonly still watch the clocks (ie. $s) so don't want to package a debian version, a ubuntu version, mint version etc. so create one that they believe won't create issues for any. With open source packages, you can sudo apt source to view & review the source code yourself if you don't trust the review process used by Canonical or Ubuntu repository software. For PPA's or 3rd party sources this review isn't required, but at least source code is still available meaning you can do it yourself (please note: some PPA's do have reviewed code). You have even less chance of review if only binaries (.deb) are provided; involving more trust.

For stand alone programs like a browser (your question on chrome), it's interaction with the system is minimal & mostly simple eg. save downloaded files, so the chance of causing issues elsewhere may be somewhat reduced in contrast to a possibly a gnome-extension (that if crashes, causes the user to be logged out when gnome-shell crashes), but each non-official package needs it's own assessment on 'risks' (what release of GTK+ or Qt toolkits does it expect; are you running etc).

If you use the Ubuntu repositories - all this 'homework' has been done for you to ensure the system remains as stable as possible, and matches other repository tested packages.

guiverc
  • 33,561