Re: Thoughts on a vuln/CVE?

[Moritz Muehlenhoff <jmm () debian org>]

On Tue, Jun 18, 2013 at 12:44:09AM -0600, Kurt Seifried wrote:
> Also part of my thought process is that (for example) this would be a
> good configuration to check for and ensure is disabled, something for
> SCAP for example or the Debian security guide (e.g. a generic "make
> sure all enabled repos are actually working as expected").

Debian doesn't endorse any external repository. During package installation
the pre/post installation scripts run with root privs. As such, if you
enable a repository you trust the people behind that repository with
the equivalent to root access to your system anyway.

Cheers,
        Moritz