Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

161–170 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#161

I've been using Mint for the past month or so, should I be using something else?

Given the grave lapses that are described here, I hope it's obvious to you that absolutely yes, you should be using something else. I'll guess that Ubuntu might be your cup of tea.

Yeah you're right. Downloading Ubuntu now.

Re: Linux Mint downloads (briefly) compromised

#162
post #57

Is there a way for me to get the Mint Cinnamon experience with Ubuntu under the hood? The last time I tried I couldn't get it to work in a painless/reliable way.

What do you need Ubuntu for? I loved the Cinnamon experience and was used to dpkg/apt-get, so wanting a rolling release with up to date software, Debian was the easy choice. Choose Cinnamon in the installer and basically you're set.

Re: Linux Mint downloads (briefly) compromised

#163
post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

I put my parents on Xubuntu about 5 years ago on a whim, then moved them over to Mint about 2 years later. About a year-ish ago, I saw that Xubuntu was using whisker-menu (main UI menu with a search box like Windows) I put them back on it and went back, myself.

Re: Linux Mint downloads (briefly) compromised

#164
post #121
post #32

Earlier quoted context omitted.

The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the…

"If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly." I believe you're confusing a PGP public key with a PGP signature for a particular file (made using said public key).

Thank you, that was indeed a typo I wrote as I rushed to get out the door earlier. I obviously meant to write "if you're downloading the public key" (indeed, I referred to "download the public key of the signer" in two paragraphs up, so I suspect that was clear to most people reading). The hashes for each new version are what are signed, obviously (with the private key of the maintainer).

My sentence about "trusted signature" could have been clearer, too. You have a public key that you trust, that you leverage to verify any new materials signed by the package/distro maintainer. So by extension, you can trust the signed hashes.

I've been using PGP/GPG on a regular basis since 1998, so I'm pretty used to the workflow by now and not at all confused about key pairs and signatures (although I will admit that I sometimes got confused about the point of subkeys until I read this a few years ago: https://alexcabal.com/creating-the-perfect-gpg-keypair/)

Re: Linux Mint downloads (briefly) compromised

#165

Earlier quoted context omitted.

Given the grave lapses that are described here, I hope it's obvious to you that absolutely yes, you should be using something else. I'll guess that Ubuntu might be your cup of tea.

Yeah you're right. Downloading Ubuntu now.

Don't have to believe everything on the Internet, including me, but I wouldn't be so fast. Ubuntu's interface is so annoying, I've seen many people turned away from Linux because of it and that's just a shame.

Re: Linux Mint downloads (briefly) compromised

#166

Earlier quoted context omitted.

A lot of people according to http://distrowatch.com/dwres.php?resource=popularity . I was surprised to see Mint take the first spot.

I really don't see how distrowatch indicates anything, why would people using a system go to that site in particular? The latest wikimedia statistics from the middle of 2015 have: * Linux Other 2,170 M 0.84% * Linux Ubuntu 1,238 M 0.48% * Linux Fedora 53.6 M 0.02% * Mac PowerPC 49.7 M 0.02% * Linux Mint 6.4 M 0.00% * Linux Mips 4.6 M 0.00% * Linux SUSE 3.9 M 0.00% * Linux Debian 3.1 M 0.00% etc http://stats.wikimedia…

Those stats are very unreliable. Most Linux web browsers (including Chrome) do not send the specific distro they're being used on. Ubuntu patches Firefox to include Ubuntu in its User-Agent, but most other major distros do not.

Re: Linux Mint downloads (briefly) compromised

#167

Earlier quoted context omitted.

Ubuntu is just too dated for development work IMO - I need to rebuild everything from source or find 3rd party PPA for anything remotely recent - I'm fine with compiling deps for production but for development the distro really shouldn't be getting in my way of trying new stuff out. That said I've had many performance issues on GNOME - I like the way it looks and the "feel" and I got used to the UI over the last year…

LTS or the other versions? Any distro with a release schedule is going to have caveats about not having prebuilt packages for the latest XYZ. The only things I can think of that might give you a faster update schedule than Ubuntu (in terms of newer versions, not just point releases) would be Fedora, Arch, or Gentoo.

Even the standard releases are too stale, in LTS dev tools and compilers are ancient.

I've forgot to mention I've moved to Fedora a year or two back for this reason - got tired of rebuilding/PPA hunting for every part of my OS when I want to use the latest version of tool/lib X.

And once dependencies are too old (very often) prepare to be rebuilding 5+ custom libs and figuring out the differences between debian package/path layout and what the library build uses ... so much wasted time.

Re: Linux Mint downloads (briefly) compromised

#168

Earlier quoted context omitted.

I use Fedora and I truly do love it. I find it to be far more stable than other distros I've tried, and it really does "just work." I know I've been suggesting it to people who are considering Linux for the first time, with the caveat of disabling SElinux. With that said, I'm not sure if it is good for non-technical people or people who aren't interested in learning about it. Getting certain things installed can be a…

> I also view it from the perspective of not knowing how to use any graphical installers (do they exist?) Yes, it exists and works pretty good when I installed it. Set up encrypted LUKS, EFI just fine and I found it reasonably pleasant to use.

I think he meant graphical package managers, not Anaconda.

Re: Linux Mint downloads (briefly) compromised

#169

Earlier quoted context omitted.

Ubuntu with a post install script that grabs flash etc? EDIT Write the post install script yourself don't use one of the many flawed ones that a search will show up. I really don't see why the downvote? The OP wants an easy to use distro that their grandmother can use but seems happy to install it them-self.

flash? isn't that what the chrome cage is for?

Maybe the OP wants to use Firefox?
Post reply on HN