1

This is a list of risks when using external repositories I found.

Quality:

  • Conflict between packages from external repositories and stable packages in system.

  • Conflict between external repositories each others.

  • The system may not support packages from external repositories.

  • Unofficial repositories can contain trial or unstable packages. This is not really good for the system.
  • Using too many repositories can make the process work slowly.
  • Packages from external repositories can be changed in the future, affect the system.

Security:

  • Malicious users can access and draw malwares into packages on open external repositories. You may install packages like this.

Legalization:

  • Some external repositories may not be legal (typically because of export restrictions) to be enabled in some countries.
  • Some open external repositories may contain packages' source code without license or copyright pushed by some careless users.

Do you have any solutions for these risks? This is a big server system. I want to use specifically repositories such as docker or kubernetes. Can I encounter these risks? And what should I do to avoid them?

P/s: If there are any spell or grammar mistakes, edit it. Thank you! Every improvement is welcome!

1

You are forgetting 1 important thing: what is your system used for?

Do you have any solutions for these risks?

If the system has private data that needs to be kept safe never ever consider to add 3rd party packages on that system unless you audit every bit of software you install and every update you plan to do for these packages. Simply not really do-able. And even then you can face backdoors like what happened with the Open SSL problem a few years back. Or with the meltdown problem.

If the system you are using is just a regular desktop system I would trust anything coming from Launchpad (where most PPAs are hosted) as long as there is no evidence that they can not be trusted. A regular backup procedure should allow for a fix to any problems you face when using 3rd party software.

  • This is a big server system. I want to use specifically repositories such as docker or kubernetes. Can I encounter these risks? And what should I do to avoid them? – user856325 Aug 7 '18 at 9:04
  • Both should be fine. As long as you don't open docker up for root and keep with sudo ;) BTW: I would consider that comment important enough to mention in the Q as a general idea on how you came to this Q ;) – Rinzwind Aug 7 '18 at 9:13
  • "never ever consider to add 3rd party packages on that system unless you audit every bit of software you install". I think this statement is neither correct nor realistic in any company in the world. In the end, very single package is 3rd party to your company. Millions of companies use software from 3rd parties be it Canonical, Microsoft, SAP, whatever.... If you trust Docker Inc. enough due to some reason, you can trust their software and repository the same as when you trust Microsoft and use Exchange just as example. – RoVo Aug 7 '18 at 9:23
  • Thanks! I edited it by following your comment. What about using other repositories for my system? @Rinzwind – user856325 Aug 7 '18 at 9:25
  • @RoVo Repositories above are what I want to use. What about other repositories? I heard that some trusted repositories still encountered attacks like: Fedora Web Site Hacked, But the Servers Undamaged ! Malicious Software Packages Found On Arch Linux User Repository Malware Found in Arch Linux AUR Package Repository. So, how can I detect and avoid these risks from them immediately? – user856325 Aug 7 '18 at 9:36

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy