Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

Post reply on HN
Print view View original

121–130 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#121

Post by pferde »

jnbiche wrote: post #32
venomsnake wrote: post #27

Earlier quoted context omitted.

GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give your signature and key fingerprint.

The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the…

"If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly."

I believe you're confusing a PGP public key with a PGP signature for a particular file (made using said public key).

Re: Linux Mint downloads (briefly) compromised

#122

Post by akerro »

creshal wrote: post #52
akerro wrote: post #16

I had to quit using Mint because a lot of packages in their repo are really, really, old. Just to give example that made me install Manjaro on friends PC is ownCloud client for file syncing. It's a few years old, contains a lot of security bugs and doesn't work with HTTPS. You need to add repo with opensuse in URL address. Mint developers were contacted by ownCloud developers to resolve the issue, a few years ago, an…

Manjaro, really? The one distribution with a worse security track record than Mint? "Our SSL certificate expired, please change your computer clocks one year back" Manjaro?

Yea, I know, I expected this answer. I needed something quick to install, not deb... and with latest versions of packages. I was thinking about Arch, but it's too long to install, I had ~20 minutes. Manjaro is ok to people how know what they're doing and who know how to setup basic features of OS.

Re: Linux Mint downloads (briefly) compromised

#123

Post by JupiterMoon »

Crespyl wrote: post #94
viperscape wrote: post #86

Earlier quoted context omitted.

Have you given Arch a try yet? Their are also some family friendly projects like Antergos. Arch wiki is my all time favorite for great documentation, even when not using arch, go figure.

Personally, I wouldn't recommend Arch (even the "friendly" variants like Antergos) to the less technically inclined. You don't need a to be extremely familiar with Linux to get started with Arch, but you do need to be comfortable at the command line and are expected to be able to read the (excellent) docs and debug things yourself. It's a very educational experience, but not really something the "average grandmother"…

Ubuntu with a post install script that grabs flash etc?

EDIT Write the post install script yourself don't use one of the many flawed ones that a search will show up.

I really don't see why the downvote? The OP wants an easy to use distro that their grandmother can use but seems happy to install it them-self.

Re: Linux Mint downloads (briefly) compromised

#124

Post by torkins »

smt88 wrote: post #59
JupiterMoon wrote: post #8

Earlier quoted context omitted.

Check out NixOS

I absolutely love the concept of NixOS, but I haven't tried it out. Is it well-supported enough to use day-to-day as a developer? Do you often have to build things from source?

I use it day-to-day as do some others in my company, and we also use it for all our cloud deployments. You have to relearn a number of things, like setting configs and so on, but on the other hand for nix pkgs it is nearly always a completely hands-off process regardless of whether you need to build from source or not (Nix handles that as part of the build, retrieving binaries from a remote cache is an optimization). I recommend giving it a shot!

Re: Linux Mint downloads (briefly) compromised

#125

Post by ableal »

jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

Thanks for the Ubuntu Mate heads up. Over the last 10+ years, and from Apple OS X to MS Windows, the Ubuntu Gnome 2 desktop was the most pleasant for me to use.

Re: Linux Mint downloads (briefly) compromised

#126

Post by bitL »

DonHopkins wrote: post #119
teekert wrote: post #35

An yet, it just works, looks nice, is fast on old hardware, mounts everything out of the box, controls your audio from the volume icon and gets out of your way in general. 17.3 is one the best out of box experiences imo.

How bad must desktop Linux in general be, if people are so busy rejoicing about a volume icon that works, that they accept poor security?

Poor security in what sense? That something can be spoofed by an attacker with unlimited resources? How many of your desktop users are actually at risk? How about Win 10 telemetry? Or whatever OS X is sending back to Apple? Happy about it?

Re: Linux Mint downloads (briefly) compromised

#129

Post by agumonkey »

jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

Mint is having its Manjaro (archlinux based prepackaged desktop distro) crysis. They had the same problem and backlash. They ironed out many security issues and practices since then. Mint will probably do so too, Clem did a lot of work, it's probably just a new territory for him and his team.

Re: Linux Mint downloads (briefly) compromised

#130

Post by _yy »

viperscape wrote: post #86
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

Have you given Arch a try yet? Their are also some family friendly projects like Antergos. Arch wiki is my all time favorite for great documentation, even when not using arch, go figure.

All of the Linux Mint application work well on Arch Linux (Cinnamon, Mate), too!
Post reply on HN