what happens with a faked repository

[OpSecShellshock]

Correct, you won't get malicious, unsigned packages to install without being warned first. But moving a level up (or down if you're really nerdy) when folks advise against doing anything sensitive or critical on a network outside your own control, I would think package management or software installation would be considered one of those things anyway.

[kurt18947]

I did what SeijiSensei recommended. I changed my repository to a university nearby though mainly to reduce the load on Ubuntu's servers and data pipes. It sure seems like there are quite a few safeguards to circumvent or defeat to be able to create a functional fake repository.

[cwsnyder]

Functional & fake repository still would depend on user not paying attention. That is one of the major differences between Windows and Linux. The only exploits which got through Linux's basic controls are those which use social engineering and get by, usually, new users only.