Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

Post reply on HN
Print view View original

41–50 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#41

Post by mschuster91 »

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US.

Seriously, with the rotten-ness of the US patent/copyright/political system, it's better for mankind to just say "ok, US users can't get this, but everyone else can".

E.g. many European banks do this for "US persons" - they simply cannot get accounts because the legal risks are just too high.

Edit: It's not just banks. E.g. BMW Group (and likely other huge non-US corps with US subsidiaries) refuse to allow US persons to look at financial statements, again due to regulatory hassle.

Re: Linux Mint downloads (briefly) compromised

#42

Post by venomsnake »

jnbiche wrote: post #32
venomsnake wrote: post #27

Earlier quoted context omitted.

GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give your signature and key fingerprint.

The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the…

I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.

Re: Linux Mint downloads (briefly) compromised

#43

Post by versteegen »

snarfy wrote: post #24

I remember installing it when it was relatively new and people were gushing over it. A few weeks later a new version came out. I tried upgrading when I found there was no upgrade path. Upgrading Mint means reinstalling Mint. I remember the days before apt-get when there was only dpkg. Before Debian I used Slackware so I'm all too familiar with package management (or lack of). The idea that someone would release a new…

I'm sorry for the rant, it's a bit off topic and not called for, but would like to say my experience is sort of the opposite:

I've been a Slackware-current user for most of a decade, and I love that it's so easy to upgrade the OS using slackpkg. I can (and do) often only upgrade a subset of packages, and never even need to reboot afterwards, not even after replacing the kernel (although, obviously...). A simple package system without dependency tracking has had many advantages for me. But installing stuff not in the standard system is more of a pain; there are third party repos but no where near as convenient as Debian/Ubuntu. I compile a couple SlackBuilds (packages) per week. I admit I've spent a huge amount of time learning how to do things like that manually and wouldn't recommend Slackware to those who won't want to learn sysadmin.

On the other hand my experience with upgrading between Ubuntu releases is terrible. A number of things have broken, permanently, every time, and I can't trivially upgrade from Ubuntu 14.10, because they purposefully break the package manager in old releases by breaking URLs. Also other pain points, like it not allowing installing both 32 and 64 bit devel libraries. I need those! The package manager is too complex and clever for me. (Honestly, I don't want to spend time learning how to override it.) I'm planning to format the drive and reinstall from scratch because it seems easier than fixing it.

Re: Linux Mint downloads (briefly) compromised

#44

Post by DanBC »

purpled_haze wrote: post #40
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

I'm curious- what do you think of Fedora? It's in the top 5 distros along with OpenSUSE, Ubuntu, Debian, and Mint, and yet I hardly ever hear people talk about it. I had personally given up on Fedora years ago, but recently was told I should give it a second look and I've not had time to try it out.

Fedora isn't for non technical family members. Here's a bit of mild whinging that's only relevant if you want to give it to non-technical people.

There's a move to give stuff generic names, rather than the obscure names they had in the past. For example, Nautilus has been renamed to Gnome Files, or just Files. When a non technical person needs to search for hep this new name makes it impossible for them to create a useful search term.

[files foo bar] is going to be different from [nautilus foo bar]. Frustratingly the old name works for searching, but it's not in any titlebars or about boxes or menu items, so the non-technical person has to just know that files is also sometimes called Nautilus.

Fedora 20 has an appstore. This has something like 4 different names - in the menu, in the title bar, in the about box, in the icon.

For what it is (a rapidly released testing distro) it's lovely - nice community (from what I could tell) and lots of activity.

Re: Linux Mint downloads (briefly) compromised

#45

Post by smt88 »

purpled_haze wrote: post #40
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

I'm curious- what do you think of Fedora? It's in the top 5 distros along with OpenSUSE, Ubuntu, Debian, and Mint, and yet I hardly ever hear people talk about it. I had personally given up on Fedora years ago, but recently was told I should give it a second look and I've not had time to try it out.

Fedora's latest release rocks. Fedora used to have stability issues here or there because it's the cutting-edge version of RHEL, but I think it's unlikely you'd run into those in everyday usage with mainstream hardware. It shouldn't be less stable than Ubuntu.

Re: Linux Mint downloads (briefly) compromised

#46

Post by jnbiche »

purpled_haze wrote: post #40
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

I'm curious- what do you think of Fedora? It's in the top 5 distros along with OpenSUSE, Ubuntu, Debian, and Mint, and yet I hardly ever hear people talk about it. I had personally given up on Fedora years ago, but recently was told I should give it a second look and I've not had time to try it out.

I used to use Fedora with KDE 5 or so years ago. I liked it fine. The only think I lacked was the convenience of deb packages since so many projects offer debs, and using alien to install debs with yum was painful (they've changed package managers now, if I'm not mistaken).

Probably, if I move away from the convenience of a Debian derivative these days, it will be to FreeBSD.

Re: Linux Mint downloads (briefly) compromised

#47

Post by mhw »

Hmm; I'm puzzled by a contradiction between this and another recent article. From this article we learn that we shouldn't do this:

"Secondly, they are mixing their own binary packages with binary packages from Debian and Ubuntu without rebuilding the latter. This creates something that we in Debian call a "FrankenDebian" which results in system updates becoming unpredictable " rel="nofollow">https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_Frank.... With the result, that the Mint developers simply decided to blacklist certain packages from upgrades by default thus putting their users at risk because important security updates may not be installed."

while from " rel="nofollow">https://news.ycombinator.com/item?id=11131081>:

"Nobody else requires that you rebuild every package before you can redistribute it in a modified distribution - such a restriction is a violation of freedom 2 of the Free Software Definition, and as a result the binary distributions of Ubuntu are not free software."

I appreciate that the latter one is discussing a hard requirement as a result of Canonical's IP licensing. But the former seems to indicate that it would be bad practice to just copy all of Ubuntu's (or Debian's) binary packages and build a new derivative distribution on top of it. Is the latter piece arguing in part for a freedom that would be a really bad idea in practice?

Re: Linux Mint downloads (briefly) compromised

#48

Post by dineshp2 »

red_admiral wrote: post #26

Starting a post with "I know this is voluntary work, pitch in or shut up and all that ..." doesn't make the quote you're attacking untrue. For what I'm paying for Mint ($0.00) and what I get out of it in terms of productivity, I find it quite a decent distribution.

Accepting poor security practices from the Linux mint developers cannot be justified just because you are not paying anything.

Open source projects need to be held to the very highest security standards.

How these security breaches are handled today set a precedent for how such security breaches are handled in the future. So it's a good idea to learn and improve from such security breaches and set a positive precedent.

Re: Linux Mint downloads (briefly) compromised

#49

Post by mintplant »

sokoloff wrote: post #5
icebraining wrote: post #2

Could [Linux] be added before Mint? I thought it was about Mint.com

Original page title is more communicative (so I suspect dang will fix it when he notices): Linux Mint downloads (briefly) compromised

The linked page is actually a comment on an LWN article with that title. Changing the submission title to that wouldn't reflect the content being highlighted here.

Re: Linux Mint downloads (briefly) compromised

#50

Post by creshal »

izacus wrote: post #19

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Hmm, that was actually one of major selling points for Mint around me - it was the distro that "worked", with relevant software,…

It's user friendly, yes, but also reckless. The distro won't "work" any more if it gets sued into oblivion by Oracle, Adobe, Nvidia, AMD and whoever else feels like kicking puppies.
Post reply on HN