[SOLVED] Update manager showing "3rd-Party Update" - is this safe?

[Fuzzy]

I normally install all updates (at least I did in LMDE2, and have so far in LMDE3). However, today, I have two updates recommended to me for two popular packages, but instead of the usual update priority number displaying in Update Manager, I see a "globe" icon. When I mouse over the globe it simply says, "3rd-Party Update" then goes on to say "Unofficial Multimedia Packages".

Would I be safe (in the context of non-malicious software) in installing these updates, or are they unverified? (I'm confused about the globe icon, so any suggestions would be appreciated.)

Thanks,
Fuzzy

[gm10]

It means these don't come from the Debian or Mint repositories, but from a third-party repository that is configured, in this case that would be http://www.deb-multimedia.org.

[Fuzzy]

Thanks gm10,

Ah, ok! So, in Synaptic, if the little orange logo (which means, "This application is supported by the distribution") doesn't show up next to the specific software pacakge, any updates for that piece of software will show as "3rd-party" updates in update manager?

Fuzzy

[smurphos]

3rd party will show up for anything that comes from an additional repository that you have added to your sources (and in Main edition any PPAs added). It's not specifically related to the supported or not status.

Hopefully you made a decision on the trustworthiness of the source prior to adding the repository and installing the software in the first place..

Note that some deb installations will install the application's repository so you may not have explicitly added it your-self but the act of installing a downloaded deb file will have set up the repository.

Use Software Sources to identify any additional repositories added to the system. Use Synaptic in 'Origin' view to look at what packages comes from them.

[Fuzzy]

Thanks Smurphos,

I had checked my sources earlier, and only see the stretch and cindy repos listed...nothing additional. That's why I was surprised to see the "3rd-party" thing. I initially installed both packages via Synaptic listings.

Fuzzy

[smurphos]

Interesting - deb http://www.deb-multimedia.org stretch main non-free is present in a default LMDE install. I guess it is an extra added by the Mint team. Technically it is third-party as it's not curated by either Debian or the Mint team, but I guess the Mint team are satisfied that is is trustworthy if they've included it by default. Definitely room for confusion....

[smurphos]

but I guess the Mint team are satisfied that is is trustworthy if they've included it by default.

Mmm - the inclusion of this repo has provoked controversy in the past. Not sure if this remains an issue. It's included to provide non-free codecs for video playback etc

viewtopic.php?f=242&t=226646

https://wiki.debian.org/DebianMultimedi ... ith_dmo.3F

[Fuzzy]

Thanks Smurphos!

I can't begin to tell you how happy I am that you stuck with this question and provided those links!

I also can't begin to tell everyone how discouraged I am that I had installed those stupid updates!

It looks like Fred Barclay posted a LMDE2 "work-around" to the issue, and I might just try it and see if it works for LMDE3...but it will probably be a week or so before I have time to mess with it. I never had this issue with LMDE2 - even though I used the same two packages; so I'm still a bit perplexed on why/how this issue presented itself, but I'll see if I can get things cleaned up and away from the dmo files.

I'll leave this topic open long enough to report back the success/failure of my attempt, and include the link(s) to Fred's original post if it works in LMDE3.

Thanks again!
Fuzzy

[gm10]

I also can't begin to tell everyone how discouraged I am that I had installed those stupid updates!

Why? I didn't see you mention they caused any issues? Just because someone linked you an issue someone else had with a different LMDE release that doesn't mean that has anything to do with you...

[Fuzzy]

Hi gm10,

From what I gleaned in the forum topic linked to by Smurphos, in LMDE2 there were potential security issues in using the dmo versions. Perhaps something has changed in how the Debian/software-specific security updates are implemented in LMDE3? I realize the specific exploits linked to in the other thread are two years old, but it would make sense to me that a similar situation could present itself now too, involving dmo and LMDE3.

There's always the chance I'm missing something obvious, though...if so, I'd welcome having the flaws in my logic pointed out so that I might fix them.

I came to Linux Mint as a "quick replacement for Windows" - and as a result, I became a "software user" and didn't gain/need much understanding of how Linux Mint actually worked. So, as I have had various issues pop up, I find gaping holes in my understanding of how some basic things work in Mint (or even Linux for that matter.) I'm trying hard to remedy that now.

Thanks,
Fuzzy

[gm10]

From what I gleaned in the forum topic linked to by Smurphos, in LMDE2 there were potential security issues in using the dmo versions. Perhaps something has changed in how the Debian/software-specific security updates are implemented in LMDE3? I realize the specific exploits linked to in the other thread are two years old, but it would make sense to me that a similar situation could present itself now too, involving dmo and LMDE3.

There's always the chance I'm missing something obvious, though...if so, I'd welcome having the flaws in my logic pointed out so that I might fix them.

I'm not advocating one way or another, but suddenly panicking because you installed an update that the LMDE3 creators thought you should have seemed a bit surprising, that's all. You are free not to use dmo but you'll lose access to certain features/functionality. Just looking at vlc, it seems the dmo version uses ffmpeg 4.0.2 whereas the debian version uses ffmpeg 3.2.12. Stuff like that. Also all the non-free apps/codecs from dmo that aren't in the Debian repos.

As to security issues, just looking at the dmo changelog, that version the guy in the other thread had installed had received an update months prior to his post already, so I take it there was some technical or configuration issue that prevented the upgrade in his case, but we'll never know now.

[Fuzzy]

gm10,

Thanks for the details! Quick question - how does a person go about finding the versions being offered by the various repos (dmo vs Debian)?

When I look in Synaptic, it showed the dmo version at "10:3.3.9", and doesn't show me a non-dmo version - I'd be happy to be pointed to a man file/webpage that explains this topic...I don't mean to impose on you. I'd love to be able to quickly compare version numbers being offered by the various repos.

Thanks again for your insight.

You've both helped me gain a better understanding. I'll go ahead and mark this topic as "solved."

Fuzzy

[gm10]

Thanks for the details! Quick question - how does a person go about finding the versions being offered by the various repos (dmo vs Debian)?

When I look in Synaptic, it showed the dmo version at "10:3.3.9", and doesn't show me a non-dmo version - I'd be happy to be pointed to a man file/webpage that explains this topic...I don't mean to impose on you. I'd love to be able to quickly compare version numbers being offered by the various repos.

This should show you all available versions:

Code: Select all

apt list -a pkgname

Since I'm not on LMDE3 I checked externally:
https://packages.debian.org/source/stretch/vlc
http://www.deb-multimedia.org/dists/str ... ackage/vlc

[Fuzzy]

gm10,

apt list -a pkgname

Perfect! Thanks - that's just what I was looking for! Makes it super easy! (Thanks for the explanation of how to find the versions for a different distro too!)

Fuzzy

[gm10]

No problem. By the way, for more details on where each version comes from you might like this one, should have mentioned that as well:

Code: Select all

apt policy pkgname