How can I identify a PPA is safe or not?

Question

I observed many posts on internet suggests to add PPA's to install an application.

Is it safe to add the PPA's? The answer is : No (wrt this)

My question:

Is there any way to know whether the PPA's are safe or not?

If it's not possible to know safe/not, what should I observe about the PPA before adding it to system.

Which internet sources can I trust that suggests PPA installation.

Answer 1

The only way to be absolutely certain is by reading the code and checking if it is not malicious.

If you can't read code or don't have the time to do so (almost no one does :p) you can verify how safe it is by:

• Use a search engine to get more information about the ppa.
• Check if there are articles describing the ppa (if a ppa has a lot of hype around itself, there is a good change someone did check how safe it is).
• The amount of contributors. If there are a lot of different people working on a project, it gets really hard to implement malicious features (unless they work together on the malicious features of course) without getting noticed by the other contributors.

If besides all these options you still don't trust a ppa, you could install it in a virtual machine and test it there yourself. That way, the program(s) can not access your harddrive or hardware, and thus do no real damage.

But to repeat:

The only way to be absolutely certain is by reading the code and checking if it is not malicious.