6

For a number of reasons:

  1. We should never recommend extra steps that aren't necessary to solve the problem. Concision is important.

  2. There is a finite number of PPAs that a user can add (more accurately GPG Keys). If they don't need a PPA to solve the problem, don't make them use up one of their slots.

  3. PPAs are potentially dangerous. Training folks that aren't knowledgeable to enter in Terminal commands that require root priveleges and add PPAs that are maintained by unverified (read: potentially malicious) authors is not a thing we should be doing.

| |
  • 2
    I agree with all of that and I add another point, PPA quality is not evaluated. Some ppa's have unneeded modified packages from official repo (with higher version), they gonna be installed on any update without you even notice that. Some packages can create unresolved dependency problems. It could be hard to figure out if it was added a long time ago. – user.dz Dec 7 '15 at 22:45
6
  1. Fair enough. But that applies to everything - not really just the "adding a ppa".

  2. I'd be interested in a source for this? I can't find this referenced anywhere, and if there is a maximum I assume it is around 65k - which is more than anyone could ever need 40, which isn't many but as you discourage them being added, it's quite a redundant argument - along the lines of "people should never save a file, there's a limited number of files they can save".

  3. This is true. But life is about balancing risk:

    • Do I trust this ppa?

    If 1000+ users say they use this ppa and it's good, should I trust it. What if it is the ppa:libreoffice ppa?

    • Do I need this ppa, and does the benefit outweigh the risk?

    Maybe the Libre Office team could go evil and start a massive linux botnet. Maybe. But the benefits of having Libre Office are massive - I can edit word and ODT documents for free, wherever I am.

"Do Not instruct people to add PPAs unless it is necessary" is very subjective and fairly not-useful advice.

What is "necessary"? Is it to get the version they want or (i.e. 5.0 over 4.0, 4 is in repositories 5 isn't) or is it if there is no other program that will work. Is "necessary" = "I really want" or is "necessary" just code for "never do this, there is always a better option"?

What is the alternative to a ppa - a .deb file?

  1. Finally, does the benefit of any security flaws being fixed and updated soon outweigh some of the risk. Just downloading a .deb file is a different security flaw that hasn't been considered here. Open Source software does contain bugs. That's been shown time and time again?

    So isn't it better to know you are safe against these bugs because your programs are all updated?


Are PPA's safe to add to my system and what are some “red flags” to watch out for?


Maybe what you mean is not "Do Not instruct people to add PPAs unless it is necessary" but it really "Do Not instruct people to add PPAs unless it is a trustworthy source" and those two are very different suggestions.

| |
  • 2
    If someone specifically asks how to get the latest version of something and there is a known trusted PPA (like the official libreoffice PPA) then of course that's the answer to the question. But I'm talking about a situation where the question is fully solved without adding a PPA or manually installing a deb file. Actual thing that happened: Someone asked how to crop a photo and someone else answered with "Add this ppa..." – Daniel Foré Nov 18 '15 at 22:38
  • 1
    @DanielForé that's a fair response. However, the point of SE is to collect many answers - there is no need to have a flat ban on any answer that uses a ppa and doesn't need it. That's what community voting is for. Otherwise there is only one solution - and while that solution works for OP, it may not for future visitors. – user3 Nov 18 '15 at 22:40
  • 1
    I don't think anyone is suggesting the answer will be deleted or anything. Just that it's not good practice – Daniel Foré Nov 19 '15 at 4:49
  • @DanielForé No, that's the point - multiple answers is the whole point of Stack Exchange, not just one right answer. And by saying that all answers with this in are bad, it's kinda limited what answers you want to accept? – user3 Nov 19 '15 at 12:40
  • 1
    The point is that it doesn't answer the question. It's like if I began every answer with "Download an antivirus". It's not relevant to what OP is asking and in this case it's potentially destructive. – Daniel Foré Nov 19 '15 at 19:04
  • @DanielForé no, that's the issue. It does answer the question - how can I do X, oh you can do Y to do X. That's an answer - even if it isn't a "do X like this" it 100% does answer the question. If I ask "how can I edit this svg file" there are two options - "install inkscape 0.42 with sudo apt-get install inkscape and then open it" or "add this ppa to install inkscape 0.91 with ...". They both answer the question 100%... What's the issue, other than security? Nobody is going to die from adding a ppa, and they could get some good out of it [cont] – user3 Nov 19 '15 at 23:40
  • 1
    [cont] Life is about risk balancing and a flat ban on PPAs is really ott. Make a meta post pointing out the risks - or even a main site post that weights up the pros and cons. But a flat ban from a non moderator, without any community input, is not appropriate and not how SE works. If you had asked here "Should we ban PPAs?" and the community discussed it, I'd be much less... frustrated by this post. Consider asking a new question? – user3 Nov 19 '15 at 23:42
  • 2
    Again nobody has used the word "ban". Calm down dude. Being as I founded elementary and I have the highest rep on this site, I think it's fully appropriate that I make a suggestion about the kinds of things we tell elementary users. Keep in mind that my job security relies on user happiness, so I'm very interested in keeping them safe and keeping their systems stable. You are fully within your rights to disagree and make counter points as you've done here. I don't see what the massive problem is that you're upset about. – Daniel Foré Nov 20 '15 at 2:28
  • 1
    @DanielForé That's not the way SE works. You owning eOS has nothing to do with this site, or your opinions here. Your question is clearly a "we will do this" which is not appropriate considering you are not a moderator here. Neither of those points you make are relevant to the running of this site. Maybe SE is not what you need for your support forum? – user3 Nov 20 '15 at 17:44
1

Very good suggestion @DanielFore,

Let me explain my opinion:

  1. "extra steps that aren't necessary"-

    Sorry: I don't understand by "aren't necessary", I think they are alternatives. Alternatives are always useful.

    For example, If the particular application is available in software center, providing command to install it via terminal is not a mistake.

  2. "If they don't need a PPA to solve the problem, don't make them use."

    I personally agree.

  3. Generally PPA's are used to get latest version, If newer version is not available in repositories. Your point might be (not always ) correct.

    Most importantly suggesting OP about use of PPA's and providing him steps to install PPA's is not bad.

| |
0

With the more recent official stance of standing behind Flatpak, developing Sideload, adding Flatpak support to AppCenter, and more distantly disabling PPA support out of the box, I think this is fair—but not specific enough.

In my opinion, we should never recommend the use of a PPA unless:

  1. It is strictly for hardware compatibility; for example, System76 maintains a PPA for their hardware drivers, or
  2. Installing from the system repositories or Flatpak is recommended first

and the risks of using a PPA are clearly spelled out in the answer.

Honestly, the third point is probably the most important: adding a PPA gives the maintainer of the PPA, the author of the software in the PPA, and anyone who could possibly access the account of the PPA maintainer root access to the user's system when installing or updating apps. This is extremely high privileged access and should be avoided nearly at all costs.

| |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .