Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

On what can I base my trust towards specific PPA? Is there some method for gaining information on which I can base my trust? From top of my mind, for example, how many people downloaded the package, what is their feedback, vote, vouch or something? Browsing forums to see if the author has trust of others is not good enough (and lengthy); looking at author's websites whether they look legit is silly imho.

To have an example,
there is a WebUpd8 APP by Alin Andrei that seems to have a good reputation. Their Lanchpad site shows details about the package including updates. That's useful, alright. I think I need more to get confidence the software is qualit enough and without malicious intentions. For example, how can I see how many people actively use it or what problems they experienced?

The obvious problem
with packages coming from third party is that they might be unintentionally bugged or otherwise imperfect and cause problems (possibly hard to solve for a newbie user especially) or intentionally containing malicious software. Now we are a community so how do we cover this risk? I'd expect some sensible system, as is usually the case with unix, but so far when this question was asked the answers did not mention any method for a trust verification.
I'm afraid of hackers who gain credibility and one day flip to the dark side and include some listening backdoor malware into the packages they distribute. Is this beyond healthy paranoia? (-:

Possible Duplicates:
There are good reasons why to regard this question as a duplicate. I'll try to provide good reasons why is this question distinctive. In short, the other answers didn't provide solution to the problem described here.
This question was already vaguely answered here:
- Are “PPA's” safe to add to my system, and what are some “red flags” to watch out for?
- Should I trust these packages and ppas?
People answer like "these are cool" and "this PPA's fine and legit" and "in the end it's your choice". The answers don't provide any tool or method with which I could verify or quantify the trust myself. I don't have enough reputation to comment there, so I'm asking separate question. I'm after some method of collecting evidence on which I can base my opinion whether to trust a certain PPA or not. Checking the website for looking legit and browsing forum to read that some person thinks "it's ok" doesn't feel right enough.

A question that seeks some kind of method was already asked.
- How to find out the package download count from a PPA?
The answer there is not usable for me right awat as I don't know how to work with such a script. And again, I don't have 50 reputation points needed to write there so. So I'm asking myself a new explicit question.

share|improve this question
    
For download numbers see: askubuntu.com/questions/296197/… –  Takkat Dec 26 '13 at 20:52
    
@foxdog: I would suggest you to post this on Ask Ubuntu Meta.. Edit this question to only reflect what your actual question is and what you have already tried... Post on meta to provide arguments for reopening the question - why is this incorrectly closed/why the duplicates don't answer your question... This would be best, because we can discuss things out... Personally, I can't make a judgement based on how things are presented as of now... –  Aditya Dec 27 '13 at 15:34
    
But just an advance: the trust something that nobody but you can decide. If you trust a tool to make your judgement you are doing it wrong. Ultimatelly is your own desition to trust some or other repository based in the information available and the sources. –  Braiam Dec 27 '13 at 18:05
add comment

marked as duplicate by Mateo, minerz029, mikewhatever, Eric Carvalho, Alvar Dec 27 '13 at 0:38

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Browse other questions tagged or ask your own question.