maemo.org - Talk

maemo.org - Talk (https://talk.maemo.org/index.php)
-   Applications (https://talk.maemo.org/forumdisplay.php?f=41)
-   -   Why is devel so dangerous?! (https://talk.maemo.org/showthread.php?t=48841)

Matan 2010-03-31 13:48

Re: Why is devel so dangerous?!
 
Quote:

Originally Posted by zehjotkah (Post 589790)
No, because apps in extras have been tested before. They have to go through a quality testing process.
And such programs never would be approved.
But to devel everyone can upload, without testing.

There are many bugs which will not be found by the extras "QA" process, or by Nokia's QA process for OVI. Certainly, intentional bad behaviour can easily slip through. Promising security for extras is akin to selling snake oil.

For example. The program can start sending lots of SMS only two weeks after installation.

zehjotkah 2010-03-31 13:51

Re: Why is devel so dangerous?!
 
Quote:

Originally Posted by Matan (Post 589801)
There are many bugs which will not be found by the extras "QA" process, or by Nokia's QA process for OVI. Certainly, intentional bad behaviour can easily slip through. Promising security for extras is akin to selling snake oil.

For example. The program can start sending lots of SMS only two weeks after installation.

Okay, that would be possible. But in my opinion unlikely.

Diavoli 2010-03-31 13:52

Re: Why is devel so dangerous?!
 
I personally am an end user and have taken to the warning of not installing any devel or extras applications, I'll patiently wait for SNES, PSX, N64, Genesis Emulators when they are ready to be downloaded from here. I have been tempted but I trust the community to test everything out first before it comes to a user such as myself who wouldn't be familiar with root commands etc...

Thanks Community again! Keep up the good work.

Matan 2010-03-31 13:53

Re: Why is devel so dangerous?!
 
Quote:

Originally Posted by nax3000 (Post 589791)
Hey could you tell my what does the dist-update command does?

There is no such command dist-update.

The update command updates the packages lists from repository.

The upgrade command upgrades packages currently installed on the system, but does not install new packages.

The dist-upgrade command is like upgrade, but allows new packages. Example:

If you have version 1.0 of package a which depends on package b, then obviously you have package b already installed. If the repository has version 2.0 of package a, which depends on packages b and c (which you don't have installed), then apt-get upgrade will not upgrade package a, since it requires installing package c. apt-get dist-upgrade, on the other hand, will install c and upgrade a.

Texrat 2010-03-31 13:53

Re: Why is devel so dangerous?!
 
Quote:

Originally Posted by Matan (Post 589801)
There are many bugs which will not be found by the extras "QA" process, or by Nokia's QA process for OVI. Certainly, intentional bad behaviour can easily slip through. Promising security for extras is akin to selling snake oil.

The problem is that Maemo is now drawing in large numbers of average users who, for whatever reason, can or will not handle well the sort of disasters that immature packages can inflict. And yes, while some have few if any issues with -devel apps, others have not been so fortunate.

So the safest thing for the rank and file to do is be forewarned and proceed with caution. There's certainly no harm in more advanced users mining -devel gold ore and helping shine it up... nor is there any harm at all in cautioning the general public.

volt 2010-03-31 13:55

Re: Why is devel so dangerous?!
 
Quote:

Originally Posted by Diavoli (Post 589812)
I personally am an end user and have taken to the warning of not installing any devel or extras applications
(...)

Extras? Maybe you mean extras-testing, I would not hesitate to use extras.

Quote:

Originally Posted by Diavoli (Post 589812)
I'll patiently wait for SNES, PSX, N64, Genesis Emulators when they are ready to be downloaded from here.

May not ever happen. Just saying.

Matan 2010-03-31 13:57

Re: Why is devel so dangerous?!
 
Quote:

Originally Posted by zehjotkah (Post 589809)
Okay, that would be possible. But in my opinion unlikely.

This opinion is stupid. If this is done intentionally, maybe with monetary gain for the perpetrator in mind, then obviously gaining the wider audience by having the package in extras is a desired goal. And since the extras process has no chance of stopping this program, if there will be such a program in extras-devel, it will also be in extras.

zehjotkah 2010-03-31 14:02

Re: Why is devel so dangerous?!
 
Quote:

Originally Posted by Matan (Post 589825)
This opinion is stupid. If this is done intentionally, maybe with monetary gain for the perpetrator in mind, then obviously gaining the wider audience by having the package in extras is a desired goal. And since the extras process has no chance of stopping this program, if there will be such a program in extras-devel, it will also be in extras.

I said unlikely, because it's working for linux repositorys, too.
So why should there be someone intentionally code malware for maemo, a platform which is relatively small?
Then you could argument the same for the appstore. Apple is only checking if the program doesn't violate rules for their software.
Or the Android market. Same thing.

volt 2010-03-31 14:05

Re: Why is devel so dangerous?!
 
It would have to get sent through to extras-testing first, and then again to extras. Not saying that it's impossible, but quite a bit of programs seem to stay in devel and never get any further. To get through they'd either have to have an attractive horse around their soldiers, or manipulate the system on a bigger scale. Which ought to draw attention.

volt 2010-03-31 14:08

Re: Why is devel so dangerous?!
 
Quote:

Originally Posted by zehjotkah (Post 589838)
So why should there be someone intentionally code malware for maemo, a platform which is relatively small?

I can think of two reasons. While overall small, Maemo is one of the biggest linux platforms where an application has access to SMS and similar functionality. And while large at that, it probably has one of the smallest bases of paranoid users that will spend time on checking other people's code for hidden functionality.


All times are GMT. The time now is 22:37.

vBulletin® Version 3.8.8