Re: Concerns about Security of packages in Debain OS and the Operating system itself.

On 23/05/2022 19:59, Adam McKenna wrote:
> You are talking about a deterrent though.  I think the question is, what
> if someone cares more about their political cause than retaining their
> uploader access?
>
> What if someone's keys are compromised and an attacker uploads a
> compromised package?

Debian Stable is not affected by this. All new packages are first coming
to experimental and unstable, then testing, only at the end packages are
landing in stable release. Sometimes many months later.

Exceptions to this are:
1. Security Team updates
2. General point-release updates
3. Backports.

All these three mechanisms are here to make sure all incoming code to
Stable is checked by many pairs of eyes before you run this code.

Now, compare that to Arch model and you see clearly which distro is more
exposed to sudden random hacks or malicious acts.

If you want best security, use Debian Stable and make sure you disable
bullseye-updates and bullseye-backports repositories.

Important note: Disabling bullseye-updates is actually causing
point-release updates to be delivered on one, predetermined date,
bundled all together. By disabling this entry you still get them all,
but in controlled fashion, you are not "beta tester" of these packages.

--
With kindest regards, Piotr.

⢀⣴⠾⠻⢶⣦⠀
⣾⠁⢠⠒⠀⣿⡁ Debian - The universal operating system
⢿⡄⠘⠷⠚⠋⠀ https://www.debian.org/
⠈⠳⣄⠀⠀⠀⠀