Alpha - One Click Install for Ubuntu Packages

[scenestar]

No offense, but this is kinda redundant and not very spectacular at all.

What you are are trying to do can be easily be achieved using shell scripts and zenity.

It is however a nice way to handle all those

apt-get install foo

boxes on the forums, but really it isn't groundbreaking development.

[scenestar]

And in addition I would like to add the following.

Browsing through the alpha test I imidiately saw that the protocol is installed by a regular user.

Doesn't anyone see the potential for a SERIOUS security hole?

just imagine a user browsing to a www.example.com/malacious/ffox0day.

All the attacker has to do is replace the install:// handler with his own and users can easily be tricked into installing non official (trojanised) binaries.

As I'm assuming that this "feature" will be aimed at more casual "non-techy" users, who will fail to check if the packages are indeed verified.

Please do not release these alpha's so publicly in order to "protect the innocent"

[Lord Illidan]

It seems handy. However, Klik already seems to the job. Good thinking, though.

[KillerKiwi]

And in addition I would like to add the following.

Browsing through the alpha test I imidiately saw that the protocol is installed by a regular user.

Doesn't anyone see the potential for a SERIOUS security hole?

just imagine a user browsing to a www.example.com/malacious/ffox0day.

All the attacker has to do is replace the install:// handler with his own and users can easily be tricked into installing non official (trojanised) binaries.

As I'm assuming that this "feature" will be aimed at more casual "non-techy" users, who will fail to check if the packages are indeed verified.

Please do not release these alpha's so publicly in order to "protect the innocent"

Im not going to claim this is fool proof at the moment but it does check to see if the passed parameter is a valid package name in the existing repo list before doing anything with it... Also all the packages actually install through synaptic this is just an easy way or selecting a package

[KillerKiwi]

No offense, but this is kinda redundant and not very spectacular at all.

What you are are trying to do can be easily be achieved using shell scripts and zenity.

It is however a nice way to handle all those



boxes on the forums, but really it isn't groundbreaking development.

Ground breaking no, helpful to newbies? I think it would be

btw shell scripts and zenity is exactly how klik handles this, although this is differnt to klik as it does not link to any third party binarys

[manicka]

Ground breaking no, helpful to newbies? I think it would be

btw shell scripts and zenity is exactly how klik handles this

so am I understanding this correctly, this script is a front end for klik.

I don't think you can get any easier than clicking on a deb and requesting it to be opened with gbebi

[KillerKiwi]

No offense, but this is kinda redundant and not very spectacular at all.

What you are are trying to do can be easily be achieved using shell scripts and zenity.

It is however a nice way to handle all those



boxes on the forums, but really it isn't groundbreaking development.

so am I understanding this correctly, this script is a front end for klik.

I don't think you can get any easier than clicking on a deb and requesting it to be opened with gbebi

No!, this script is JUST a front end for synaptic simiar to how gnome-application-install works.

Klik actually downloads binary from the web where as this just triggers synaptic to do its usual thing.

[neymac]

Linspire (former Lindows) does some like this, if you pay for their services.
They call it CNR (click n' run).
You can see at http://www.linspire.com/products_cnr_whatis.php

[scenestar]

Im not going to claim this is fool proof at the moment but it does check to see if the passed parameter is a valid package name in the existing repo list before doing anything with it... Also all the packages actually install through synaptic this is just an easy way or selecting a package

As a hacker I am going to say this once.

Do it right or don't bother at all.

I don't give a **** how easy it is.

You are allowing others to compromise linux systems.

Fscking end this ******** or people are going to get pwned

[3rdalbum]

Great idea, and for such a young project it is well implemented (as far as I can see). I don't see the security risk in installing something from the official Ubuntu repositories, as long as the user is told the actual package name that is being installed.