Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

Post reply on HN
Print view View original

51–60 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#51

Post by berdario »

jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

They provide gpg signed sha hashes, it's apparently just not documented:

https://micahflee.com/2016/02/backdoored-linux-mint-and-the-...

Re: Linux Mint downloads (briefly) compromised

#52

Post by creshal »

akerro wrote: post #16

I had to quit using Mint because a lot of packages in their repo are really, really, old. Just to give example that made me install Manjaro on friends PC is ownCloud client for file syncing. It's a few years old, contains a lot of security bugs and doesn't work with HTTPS. You need to add repo with opensuse in URL address. Mint developers were contacted by ownCloud developers to resolve the issue, a few years ago, an…

Manjaro, really? The one distribution with a worse security track record than Mint? "Our SSL certificate expired, please change your computer clocks one year back" Manjaro?

Re: Linux Mint downloads (briefly) compromised

#53

Post by smt88 »

mschuster91 wrote: post #41

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Seriously, with the rotten-ness of the US patent/copyright/political system, it's better for mankind to just say "ok, US users ca…

> "ok, US users can't get this, but everyone else can"

Setting aside for a minute that this isn't possible, it's like saying you won't release your app on iOS because of Apple's walled gardens. Sure, the walls suck, but the users inside are numerous and spend lots of money. Most product creators don't have the option to exclude US users.

Re: Linux Mint downloads (briefly) compromised

#54

Post by berdario »

venomsnake wrote: post #42
jnbiche wrote: post #32

Earlier quoted context omitted.

The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the…

I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.

You can use gpg on windows or macosx as well to verify the signed hashes.

As linked in the blog post in my other comment, tails explains things quite well:

https://tails.boum.org/download/index.en.html#verify

Re: Linux Mint downloads (briefly) compromised

#55

Post by smt88 »

izacus wrote: post #19

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Hmm, that was actually one of major selling points for Mint around me - it was the distro that "worked", with relevant software,…

Most people install some packages as soon as they install an OS. A distro could be very nearly as user-friendly by creating a wizard that takes users through the steps of installing these proprietary things in a legal way.

Re: Linux Mint downloads (briefly) compromised

#56

Post by izacus »

creshal wrote: post #50
izacus wrote: post #19

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Hmm, that was actually one of major selling points for Mint around me - it was the distro that "worked", with relevant software,…

It's user friendly, yes, but also reckless. The distro won't "work" any more if it gets sued into oblivion by Oracle, Adobe, Nvidia, AMD and whoever else feels like kicking puppies.

Hmm, why would they be. Mint already offers a special version for people living in countries where they can be sued for installing a video decoder or a video driver - it's called a "No codecs" version and it's meant for users in USA and Japan.

Suing in the rest of the world would be a rather wasted effort right now.

Re: Linux Mint downloads (briefly) compromised

#58

Post by lottin »

VarunAgw wrote: post #28

Every once in a while, I get difference error in /etc/issue*. I really hate all of these. I use Mint only because I like its GUI interface. I really cannot stand Ubuntu desktop for a moment

If Mint is just really a GUI interface, do they really need to put out a whole new distribution? Why not focus on the GUI and let the distros do the distribution?

Re: Linux Mint downloads (briefly) compromised

#59

Post by smt88 »

JupiterMoon wrote: post #8
onlycommenting wrote: post #6

There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast. There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be…

Check out NixOS

I absolutely love the concept of NixOS, but I haven't tried it out. Is it well-supported enough to use day-to-day as a developer? Do you often have to build things from source?

Re: Linux Mint downloads (briefly) compromised

#60

Post by jnbiche »

venomsnake wrote: post #42
jnbiche wrote: post #32

Earlier quoted context omitted.

The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the…

I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.

If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows:

1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers.

Even if you haven't previously established trust, GPG can be an extremely valuable ally.

Post reply on HN