Clem's excellent comment on best secruity practices, including being aware of FOSS application impersonations

[Gitoffthelawn]

The following is part of the current top-post on the Linux Mint blog. It was written by Clem, without whom Linux Mint would not exist. I couldn't agree with his words more. Due to their applicability to the Scoop project, I am posting them here for all to discuss (in relation to Scoop):

While we’re talking about security, I’d also like to take the opportunity to mention project impersonations.

https://www.fullstory.com/blog/inside-a-global-campaign-hijacking-open-source-project-identities/

Malicious people are making fake websites which impersonate FOSS applications. Their goal is money, whether that’s just by generating web traffic, selling personal data, or infecting you with viruses and ransomware.

Look at Warpinator.com and hypnotix.org for example. We can’t take these down. If the host cares, they get hosted somewhere else. If we take the domain down, they get a new one.

We’ve had secure and centralized repositories since the 90s, since the very start of the Debian project. I know some of you are new to Linux and coming from Windows. Despite the fact that smartphones have used centralized software stores for decades as well now, I know a lot of people who think the best way to install something is to search for a download link and click whatever comes up. This isn’t the best way to install software. This is the best way to install malware.

NEVER, ever download an application from a website you don’t fully trust. If you do, make sure to check its authenticity with the developers. It doesn’t matter if you know the software, it doesn’t matter if it’s open-source.

source: The Linux Mint Blog - https://blog.linuxmint.com/?author=1