Is it mostly safe to install any software from default repos? ( "yum install" "apt-get install" , etc)

Question

Coming from the Windows world, where I'm in the habit of putting every new EXE or Installation file through something like Virustotal, or searching Stack Exchange/Reddit for reviews on the safety (no malware, no spyware, etc) of a particular piece of software before installing it.

With Linux, is it mostly completely safe to install any utility or software so long as I'm using the default repositories that come with new installs of the OS from vendor images?

If not, what is a general process for validating the safety of a particular Linux utility/program/application?

Answer 1

Short answer

Yes, it is 'mostly safe' to install any utility or software so long as you are using the default repositories that come with new installs of the OS. The default repositories contain software that is tested by the developers and/or maintainers of the Linux distro.

Example

There are levels of security. Take Ubuntu as an example:

• The Ubuntu developers/maintainers working at Canonical are fully responsible for the central program packages (the repository main etc) that are used in the server version and all flavours of Ubuntu desktop. In some cases they are developing these programs, but in many cases these programs are developed and packaged 'upstream' by other persons/groups, for example Debian. Regardless of the packages' origin, all packages in main benefit from full security support provided by Ubuntu itself.

• The functionality of the software in the repositories universe and multiverse is tested, but the software is developed and packaged by other people or groups of people, and Ubuntu cannot guarantee the security.

• Software from a PPA is not tested by the Ubuntu developers and/or maintainers. The quality and security depends of the developer/maintainer. (I'm responsible for one PPA, and I am using some other PPAs, but I know many people who stay away from them because of the security risk.)

All the software above are kept updated automatically.

• Software downloaded separately (like the typical case of Windows applications) are less secure (for example, you must check that they are up to date).

• Software that you compile yourself or even develop yourself may or may not be safe depending on your skill and what the software is dealing with.

These links describe the Ubuntu case in more detail:

• Which Ubuntu repositories are totally safe and free from malware?

• https://ubuntu.com/security

General conclusion

In similar ways other Linux distros have repositories that are more or less tested for function and security. You should check carefully the origin, reputation, and maintenance of more 'peripheral' software before you install it.

Before installing it is a good idea to test software in a separate 'test' system for example in a virtual machine or a live system or a second computer.

Answer 2

Packages from all major GNU/Linux distributions could be better compared to Windows Update. If you trust Microsoft not to release viruses through Windows Update, then you should trust your distributor as well. Even moreso, because most packages are Free software, with source code available to the general public.

Some distributions, like Arch Linux, have separate "official" repositories and "unofficial" user-generated one (AUR), with packages from official repositories supported by the distributor, and AUR having a caveat to users not to trust packages from it.

Answer 3

Think 'safe' is an oxymoron whether it is Unix, Linux, BSD or any other software distribution. The reason being, you are trusting other people with data. While I have been using Debian for around 10+ years without a major issue, there were a couple of problematic packages, but it was outside the distributor's control or knowledge. This is of few years ago, I do not remember the name of the package, but I do remember somewhat the functionality of the package.

This was before Firefox moved to this aggressive release process where it would have support for an addon n number of years. The package or addon was about checking security of a webpage/website. As we all know any site certificate involves number of things. And you would want to check the cipher strength of the certificate and the various things to know how good or bad that site is on security. Something similar to https://github.com/andreicristianpetcu/Base64CertificateViewer/ which I'm using atm. The only difference was that add-on was selling data (IP of the user using the addon, which sites the user was going to, etc. etc.) to a third-party or third-parties. People came to know about it almost 5-6 years afer the fact. There was lot of drama and at the end the add-on was taken off firefox store/addon page and they also did lot of changes to how much can an external addon view and show the certificate.

FWIW, the moment it was known, it was also removed from Debian's repository but the damage was done. I was the original requestor to ask for that package to be in Debian. And I did know that quite a few people who use Debian are in vulnerable position while some in powerful positions. If either of those groups used that addon from the repo. they made themselves more vulnerable.

Now such kind of data thefts, I doubt any store or anybody can predict. There have been similar such instances in many areas. For e.g. the drama at Freenode,

As far as social dynamics are concerned, you can't rule anything or anybody out.

Free software does attempt for people to do the right thing. Almost all software comes with one or more licenses and most were written with a specific need at a specific point in time. Most of these licenses need to add, modify the licenses so its add the data protections that we want also. The good news is, this can be done as most foss licenses are also hacky, the bad news is if there is a bad actor he may ignore the license one way or the other.

Answer 4

Usually (it is not an absolute rule) it is safe to install software from distribution core repository, because these software are build an monitored by the developers that maintain your distribution.

There could be a problem directly on the original code, but usually it is discovered before publishing, however inspecting code or making code review is always a good idea.

the main risk regarding this matter is when you as admin add a new repository, whenever it is from a ppa or yum repository the responsibility change from the distribution, to the devs of the special application you decide to add has a repository, and then there could be less attentions to the code reviews to this specific app then potentially more risk. You have to be careful for the quality of the code reviews when you add a repository.

last, there is also one more risky possibility when you add a software by downloading from source and compiling it on your system, because it become your responsibility to make code reviews and everyone is not has competent has it should be.

Answer 5

I would like to answer this from the viewpoint of someone who used to support and maintain some of these applications for FreeBSD.

Packages provided by open source system vendors tend to run a gamut from barely maintained to almost critical pieces of the system. There are differences in the way BSD variants handle their systems vs Linux as well, in Linux most of the user space tools--the shell, system startup, etc--aren't part of Linux itself, but rather packages layered on top of the Linux kernel.

Then we have packages, or ports as they are known in the BSD world. These are specific instructions to build applications from outside the core operating system, including such things as graphical workstation desktops, database and web servers, mail servers and clients, etc. The level of support for and care towards these types of applications tends to vary greatly from one package to another. Well-known packages with their own large development teams, PostgreSQL leaps to mind here, tend to be well supported, and the packages for them in open source OSen tends to be very good, with careful attention paid to security fixes from the upstream vendor.

At the other end of the spectrum are obscure packages like a SNOBOL compiler, or an ancient adventure game written in Fortran, which tend to hang out in package build directories long after their initial interest has waned, often until they will no longer build, when they are marked as broken and left as zombies.

So to fully understand the situation, you have to look at the application itself as well as the vendor/distro packaging. Is the application actively developed and maintained? Do they have a security officer, and respond to security alerts? Then we move to the distro packaging: is it kept up to date? Are security updates available for the version you intend to run? Is the package generally well maintained in the distro or vendor sources?