When I install software in Ubuntu software center, I have to type my password for the installation. But we do not have to do it in the app store on Deepin. Why? And, what is the advantages and disadvantages?


These are different choices in Deepin and Ubuntu regarding security vs usability vs stability. Installing software requires administrative privileges. Ubuntu prompts for your password for anything that requires administrative privileges, Deepin doesn't. In both cases, your account has to be registered as authorized to gain administrative privileges in this way.

The way this works under the hood is that programs gain administrative privileges because they're started by sudo. Sudo checks that the account that runs sudo is authorized to do it, and it may require some additional checks. Sudo asks for the password of the user that invokes it unless it's been configured otherwise (NOPASSWD directive in the configuration file) or unless the user has already recently typed their password.

The reason sudo asks for the user's password is to check that they're at the keyboard. If you left your machine unattended without a screen locker, someone could walk up and mess with your account, but they couldn't mess with the system configuration without rebooting the machine. (This is valuable even with a single-user machine because administrative access makes it possible to hide one's traces completely, whereas messing up with a single user's configuration leaves traces.) A rogue program running on your account likewise couldn't directly gain administrative privileges.

However this security protection is of limited impact. A malicious passerby or program could hide something on your account and piggyback on the next time you gain administrative privileges to do something.

Ubuntu keeps the password prompt for the small amount of security it gives, and perhaps to signal to the user that they're about to do something potentially dangerous (mess with the system configuration). I don't know what the exact rationale was in Deepin's case, but presumably they wanted to remove this hurdle in order to keep the interface simpler (simpler to do stuff, but also simpler to mess up).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.