security risk of universe in practice

[ubuntu_demon]

How much of a security risk is using universe/multiverse packages in practice ?

I'm using at the moment things like :

amsn (I want to be able to easily switch between "see all contacts that are online" and "groups" and I don't think that's possible with gaim)
firestarter (easy firewall)
vncserver
xdiskusage
mozilla-mplayer
flashplayer-mozilla
acroread
abiword
grubconf
gftp
uligo
gnugo

Also is hoary going to have a bigger main repository ? And what about after hoary ?

[jdong]

Universe packages aren't monitored as closely for security updates as Main. Actually, I don't think they receive security updates period.

[ubuntu_demon]

I knew that already. I think my question wasn't very clear.

I want to know more about how everyone(the users) is handling this (practical advice and experiences). How big of a security risk am I taking by using these packages ? What choices is everyone making ?

And I want to know what ubuntu is going to do in the future about it. Ubuntu is great but I think the main repository has a bit too less packagages.

[jdong]

I knew that already. I think my question wasn't very clear.

Sorry for the misunderstanding

I want to know more about how everyone(the users) is handling this (practical advice and experiences). How big of a security risk am I taking by using these packages ?

I try to avoid universe daemons/servers. Universe desktop apps are fine for me, but not universe daemons.

How much of a security risk depends on which packages you're specifically referring to. The ones you listed are more of clients -- I associate little/no risk with those.

What choices is everyone making ?

I already touched on that. In addition, I regularly monitor security sites for possible flaws...

And I want to know what ubuntu is going to do in the future about it. Ubuntu is great but I think the main repository has a bit too less packagages.

Definitely there's going to be more packages supported in the future. How many? I can't tell you... and I don't think the devs are telepathic either!

You have to remember that this is a first release by a team vastly smaller than Debian's. And you have to remember how long it takes Debian to get new releases out due to their large number of packages to support!

[jdodson]

more packages would rock. i think they are going to add in more, i would really love that if they did.

[ubuntu_demon]

Yeah it would rock!

And Jdong I think you're right when you are talking about services/deamons I would never run those out of universe/multiverse.

[quixotic-cynic]

I think it also matters whether it is a net-facing app with ports open to outside. As such, I try to keep web browsers, jabber clients, e-mail clients etc within main - or pay attention to the developer's site for security updates.

[MJN]

Holy smoke quixotic-cynic, are you stuck in some sort of time warp? This thread is nearly 3 years old!

(it did seem a little strange reading the first post from a forum staff member with 4000+ beans asking a relatively-newbie question... but of course it makes sense now as when they wrote it back in '04 they obviously were!)

Mathew

[netlogic]

It is a good idea. It seems like the same questions are repeating every 2months now. It is good to recycle. It isn't easy to make a shampoo that cleans Python and C

[MJN]

Eh?!

Your posts keep sounding like the randomly-generated spam I keep getting - it's certainly English but doesn't quite seem to make sense!

Mathew