-1

I'm completely new user of Ubuntu OS, so at first learning some total basics.

One of the first things to do - installing Chrome browser, made me already confused. I found a big topic about that (How to install Google Chrome), and next to the answer suggesting download .deb file directly from google I read such two comments:

1 - "If you install things the Windows way, you get viruses"

2 - (reply to the first one) "Right, users should be extremely cautious when installing software this way and do it only exceptionally."

Can you explain me why installing software this way is so "danger" according to these two comments? Is it so indeed? If yes, then how can I make it more safe?


update: thanks to @guiverc answer is now for me clear, what technical issues one might get by using .deb to install software. But to completely answer my question I would also like to know, what about those "viruses". It's clear for me that installing .deb from non trustful sources might bring this kind of risks, but should I be worried about that also when I install from known sources (like google in this case)? If yes, then why?

I am a little bit paranoic when it comes to security topics, that's why I'd like to completely understand this aspect as well.

  • 1
    It comes down to trust. If you trust the deb package creator and source ( where you got it from, link or ppa repository ) - it is safe. Otherwise, it is not. Same goes for windows. – Sergiy Kolodyazhnyy Apr 26 '19 at 23:12
  • @SergiyKolodyazhnyy yes, this is exactly what I thought at first moment and that would be clear for me. But since the topic and answer was only about installing chrome directly from google website (it was not general question about the ways how to install software on ubuntu), I understood it like even in this case it might be risky. Would that mean google should not be considered as a trusftul source or maybe I'm missing sth else? – funchal Apr 26 '19 at 23:23
  • Canonical/Ubuntu have tested everything in the repos for the specific release of Ubuntu they are available for. If you download a .deb from elsewhere, the validation of what packaging rules it follows (eg. they may use debian standards; fine for debian, but may create problems with ubuntu or something else) , the ABI/API's it expects were tested/untested by whomever developed/packaged it and again you must take on trust & ensure it's suitable for your system. A wrongly packaged install may create problems that show in other correctly packaged software - ie. you must ensure it's suitable. – guiverc Apr 26 '19 at 23:36
  • eg. on packaging rules - apt & deb packaging tools will upgrade by that version; so a poorly packaged version may be ver 2.2.2 (with a few changes) so was marked 2.3; but later fixes come out marked as 2.2.3 which include what the coder added to the '2.3 package but without additional fixes in the correctly 2.2.3 package - but systems with 2.3 installed won't upgrade/install the 2.2.3 correct package as it's version is less than 2.3. This is a simple example of issues just in packaging as groups follow standards that makes sense to them, and there are many 'standards'. – guiverc Apr 26 '19 at 23:43
  • Larger companies with tech savvy people tend to be a little more aware (ie. do some homework), however their bosses commonly still watch the clocks (ie. $s) so don't want to package a debian version, ubuntu version, mint version etc. so create one that they believe won't create issues for any. With open source packages, you can sudo apt source to view & review the source code used, if you don't trust the review process used by Canonical or Ubuntu repository software; for PPA's or 3rd party sources this maybe a a step not even done; likewise potentially for google (what do they say?) – guiverc Apr 26 '19 at 23:47
  • @guiverv Your 3 comments really should be an answer ;) – Sergiy Kolodyazhnyy Apr 26 '19 at 23:58

1 Answers1

1

Canonical (employees of company behind Ubuntu 'main' repo.) & Ubuntu members/people/community have tested everything in the repos for the specific release of Ubuntu they are available for.

If you download a .deb from elsewhere, any validation & testing performed on it may be of a lesser standard than that required for inclusion in Ubuntu repositories. One quick difference may be just the validation of what packaging rules it follows (eg. they may use debian standards; fine for debian, but may create problems with ubuntu or another distribution) , the ABI/API's it expects were tested/untested by whomever developed/packaged it & may work with specific libs (Qt or GTK+ releases) so again it's what @SergiyKolodyazhnyy covered in the 'trust' statement in ensuring it matches your system. A wrongly packaged install may create problems that show in other correctly packaged software - ie. you must ensure it's suitable.

An quick example using packaging rules - apt & deb packaging tools (dpkg etc) will upgrade by version; so a poorly packaged version may use a different standard. eg. a coder grabs ver 2.2.2 code, makes a few changes and marks it 2.3 so it'll replace the 2.2.2 files. The next release comes out marked 2.2.3 but it won't replace anyone's 2.3 release as 2.3 < 2.2.2. This is a [dumb] simple example of issues just in packaging as groups follow standards that makes sense to them, having lots to choose from and not all 'play' well with others. More serious issues though are API/ABI changes which are hidden inside packages (and not my simple naming/versioning example)

Larger companies with tech savvy people tend to be a little more aware (ie. do some homework), however their bosses commonly still watch the clocks (ie. $s) so don't want to package a debian version, a ubuntu version, mint version etc. so create one that they believe won't create issues for any. With open source packages, you can sudo apt source to view & review the source code yourself if you don't trust the review process used by Canonical or Ubuntu repository software. For PPA's or 3rd party sources this review isn't required, but at least source code is still available meaning you can do it yourself (please note: some PPA's do have reviewed code). You have even less chance of review if only binaries (.deb) are provided; involving more trust.

For stand alone programs like a browser (your question on chrome), it's interaction with the system is minimal & mostly simple eg. save downloaded files, so the chance of causing issues elsewhere may be somewhat reduced in contrast to a possibly a gnome-extension (that if crashes, causes the user to be logged out when gnome-shell crashes), but each non-official package needs it's own assessment on 'risks' (what release of GTK+ or Qt toolkits does it expect; are you running etc).

If you use the Ubuntu repositories - all this 'homework' has been done for you to ensure the system remains as stable as possible, and matches other repository tested packages.

guiverc
  • 30,396
  • fyi: the toolkit ABI/API issues are not OS dependent; though Qt/GTK+ is probably noticed more in GNU/Linux like Ubuntu because we see all versions. eg. https://doc.qt.io/qt-5/supported-platforms.html covers linux, windows, osx, android, ios, winrt .. Paid for platforms tend to skip releases having less-frequent releases to the public (meaning fewer chances for api/abi breakages issues) – guiverc Apr 27 '19 at 01:53