What is the risk in adding an unknown PPA?

Question

Whenever i add a new repository ppa, i get a warning asking me if i trust it. Ubuntu doesnt catch any virus or malware since it asks password for each and everything, What is the risk in adding an unknown ppa?

Answer 1

It isn't just a matter of malware, as has already been said. It is also that some of the software might really still be in the testing stage and not ready for production use. If you install it and rely upon it to get work done, you might find that it is buggy, unreliable, and can crash - leaving you without the work you have done.

Some of it might also not get along well with other aspects of Ubuntu, such as Unity or Gnome, causing problems that are difficult to trace, and perhaps even making your system unstable.

This is not because the software is bad, but because it has perhaps not yet been fully tested, or because it was made available so that people could test it, but not yet intended to be generally released as production software. So you should use caution, although some of it is really quite good.

A number of months ago I installed a recommended package from a particular PPA, and it trashed my system enough that I had to reinstall Ubuntu. I was a new user and didn't know what else to do; with a bit more knowledge I might have been able to solve the problem and restore it without doing a reinstall (although that, too, was useful to me in learning Ubuntu, but if I had worked saved on my machine I would have lost it).

So be careful, ask questions, make frequent backups (!!!), and know that malware is unlikely (though not impossible).

Answer 2

The packages on PPA's aren't checked for things like malware. So while someone might be packaging something like XBMC for you, they could very easily also be adding some spyware/malware as well. This is why you shouldn't just add any random PPA.

Answer 3

When you add ppa and install a program through it.

Basically you give permission to reside that program in allowed executable area (/bin/ /sbin/ /usr/bin/).

Now if program itself is/has somehow a malware then system won't complain about it as you are the one who added ppa considering its trustworthy.

When program comes from canonical (Ubuntu repositories) they are first checked (I would like to say thoroughly but I don't know :P) so those from Ubuntu repositories are free of malware/spywares for sure.

For any other ppa its upto you/user to decide whether to trust it or no.