[kwlug-disc] Going outside the repository

[B.S.]

Thus the Ubuntu PPA's which handle the signing, and so on. Let alone 
aptitude update/upgrade auto advise of new versions available. 
https://help.launchpad.net/Packaging/PPA

And since they do the hosting, your, or your organization's bandwidth is 
preserved.

Don't recall what, if anything, sourceforge is/n't doing - I think 
md5's, but I don't recall keys.


On 14-11-10 01:08 PM, Chris Frey wrote:
> On Sat, Nov 08, 2014 at 11:05:13AM -0500, Khalid Baheyeldin wrote:
>> This is why Debian repositories, as fantastic as they are, are not
>> suitable for fast moving, complex projects, with lots of add-ons, and
>> built in update mechanisms.
>>
>> I install everything from the repositories, but make exceptions where
>> they make sense.
>>
>> Drupal is one such exception. Having it frozen in time in the
>> repositories means you don't get security updates quickly enough. You
>> are better off without debian repos here.
>>
>> Again, those are the exceptions, not the rule.
>
> The main downside to going outside the Debian repositories is that
> it often seems that package signing is suddenly an afterthought.
>
> With Debian, I can do a system upgrade on an untrusted network with
> relative comfort.
>
> Package signing seems so fundamental to me, but often it is non-existent
> when folks cook up their own package system.  Even Gentoo went for years
> without package signing in their emerge system.  I had to skip the
> rsync and download the nightly archives to get some semblance of
> signing.  I don't know if they even have it yet.
>
> How does Drupal stack up?
>
> Ruby, as one example, posts MD5 sums of their source tarballs on their
> website.  This is worse than useless, since 1) there is no PGP key to
> check against, 2) MD5 has been cracked for years, and 3) it therefore
> gives a false sense of security.
>
> - Chris
>
>
>
> _______________________________________________
> kwlug-disc mailing list
> kwlug-disc at kwlug.org
> http://kwlug.org/mailman/listinfo/kwlug-disc_kwlug.org
>