2

I am setting up a Debian Wheezy server for my domain name. I am not sure where I can find a community that reviews those packages for safety. I am looking for postfix package, as an example. Which websites can I rely on for safe reviews of such packages?

1 Answer 1

3

You should trust the actual Debian repos for this purpose. This is all about open source software and the community. There are thousands of companies and individuals that trust Debian with its data. If a package misbehaves on purpose (like someone injected a malicious code in there), it is very hard that this goes unnoticed. Even it gets past their testing process, which is also held by the community. Once it causes a problem somewhere, this will be big news and the community will quickly correct the problem. Think about it as a more robust version of Wikipedia, if we can make this analogy ...

If you are really concerned and don't want to follow such a model, you can go for a paid linux distro with actual maintenance and support, if this makes you feel more confident. Redhat being a good example for that.

4
  • Are Debian repos are any/all packages that I simply get by executing apt-get packageName install command? Apr 20, 2015 at 4:04
  • As long as you didn't edit your /etc/apt/sources.list and added external repos, then the answer is yes.
    – Bichoy
    Apr 20, 2015 at 4:05
  • And how can I verify safe repos other than the original Debian? Apr 20, 2015 at 4:14
  • Again, it is a matter of trust ... For example, if you are going to use Google repos, then these are trusted. But, say you find a software that asks you to add an unknown repo from unknown community, then better stay away from that. Usually, Debian repos are the largest and has almost everything you will need.
    – Bichoy
    Apr 20, 2015 at 4:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.