Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

Post reply on HN
Print view View original

1–10 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#6

Post by onlycommenting »

There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast.

There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be it's name space? Give the user an option to still use- they're example- xedit while having another xedit installed along side?

I can see how this could also get messy. Just spit balling here.

Re: Linux Mint downloads (briefly) compromised

#8

Post by JupiterMoon »

onlycommenting wrote: post #6

There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast. There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be…

Check out NixOS

Re: Linux Mint downloads (briefly) compromised

#9

Post by embik »

> Secondly, they are mixing their own binary packages with binary packages from Debian and Ubuntu without rebuilding the latter. This creates something that we in Debian call a "FrankenDebian" which results in system updates becoming unpredictable

This is interesting because Debian itself encourages derivative projects to use their binary packages[1]:

> For those derivatives that re-use Debian binary packages, add some source packages and modify some source packages, where possible we encourage them to use standard Debian mirrors and add a second repository containing only the source and binary packages that have been added or modified.

Or maybe they don't encourage that behaviour but still give guidelines in case you want your derivative to work that way? I'm not 100% sure.

[1] https://wiki.debian.org/Derivatives/Guidelines

Re: Linux Mint downloads (briefly) compromised

#10

Post by asb »

embik wrote: post #9

> Secondly, they are mixing their own binary packages with binary packages from Debian and Ubuntu without rebuilding the latter. This creates something that we in Debian call a "FrankenDebian" which results in system updates becoming unpredictable This is interesting because Debian itself encourages derivative projects to use their binary packages[1]: > For those derivatives that re-use Debian binary packages, add so…

I believe the problem is the mixing of Debian and Ubuntu binaries rather than the fact they're not recompiling everything. Ubuntu doesn't just take Debian and add a few extra packages - it's a complete recompile with package versions likely don't match any Debian release.
Post reply on HN