Re: Do not unpack or run TBB as root.
Originally Posted by
Paqman
Stick to normal GUI ways of doing stuff like this in future and it'll be less risky.
Whilst this advice may not be wrong per se, I would avoid discouraging people from learning to use the terminal instead of "normal GUI". But that's just me. It's not bad for people who want to learn to use the CLI to do it for everyday tasks in order to become more comfortable and familiar with it. My version of that advice would be, "Be conscientious about what commands you issue as root (or with sudo) in the future, and it'll be less risky."
But I do second the rest of what Paqman said. Provided Tor's developers didn't create a security vulnerability that has already been exploited, there isn't any irreparable damage. Unpacking as root means the files unpacked will be owned as root, instead of the normal user. Running as root means the application could do literally anything to your system. (Of course, in theory someone could write an application with malicious intent so that if you run it as root it automatically trashes your system. Given that the Tor devs specifically told you not to unpack or run as root, I doubt that's the case.)
In addition to the aforementioned advice, I would also suggest that, whenever possible, you stick to using software from the repositories and PPAs you know you can trust. In the repositories, the software will not have malicious intent, security vulnerabilities are corrected when they are found, and bug fixes are sometimes issued. In a PPA from a source you trust, you should enjoy the same benefits (though the reviews probably won't be by the Ubuntu devs.) But I'm not saying never download and unpack archives to install software. I'm only saying it's often not the best way.
In the case of Tor, the devs recommend using one of their PPAs instead of the Universe repo, because "In the past [the packages in the repo] have not reliably been updated. That means you could be missing stability and security fixes." Following option two or three at https://www.torproject.org/docs/debian is probably the best way of installing Tor. (Of course, this is assuming you trust the developers at the Tor project.)
Jane, stop this crazy thing!
Bookmarks