Fedora Atomic Silverblue 44
I installed ProtonVPN-CLI using the instructions provided by Proton, I noticed that 130 new packages were downloaded due to dependencies.
My question is, did I weaken my OS security by installing that many new packages? I am concerned too that once I uninstall Protonvpn-cli the packages/dependencies installed will remain and could be used for future exploits as they are not part of the official Fedora Atomic.
And I know distrobox is safer but I wanted a good integration in the OS with the killswitch that is why I did not use distrobox.
Firstly, please post text as pre-formatted </> text - pictures of text are exceptionally suboptimal, we can’t copy/paste it, search it, index it and others won’t be able to find it.
Yes - you definitely did weaken your OS security, as now a defect in anyone of those packages, their supply chains or anything that they touch is potentially an issue. You’ve added at least 2 different compilers, a lexer, a pile of libraries and utilities, many python packages and other stuff we can’t see as you posted screenshots of it rather than the text itself.
On the other hand, you need all of that (apparently) to run this VPN, so like everything, it’s a trade-off. More functionality for more exposure. I’d not worry too much about if I were you - when you uninstall this VPN software you can also remove unrequired dependencies assuming nothing else in the meantime required them.
If you ever want to compile anything yourself, many of those packages will be required by the tooling you use, so you’re going to get them anyway.
