Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

171–180 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#171
post #3

Whos using Mint these days anyway ?

The poor saps who have it recommended to them or installed for them. It's a desktop environment theme at best, and could be packaged as such. Maintaining a distro for general consumption (it's pitched to new users as "Windows like"), is very hard work and carries a lot of responsibility.

> "It's a desktop environment theme at best"

Cinnamon is more than just a desktop theme, and Mint is more than just Cinnamon. Worth looking into it further.

Re: Linux Mint downloads (briefly) compromised

#172
post #3

Whos using Mint these days anyway ?

I am. I've tried dozens of Linux distributions (sadly, this isn't an exaggeration) and Mint is likely the easiest and fastest one to set up and start being productive with.

When my daughter asked what Linux distro she should install on her laptop, I didn't hesitate in recommending Mint.

Re: Linux Mint downloads (briefly) compromised

#174
post #106
post #19

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Hmm, that was actually one of major selling points for Mint around me - it was the distro that "worked", with relevant software,…

OTOH, it's exactly what pushed me away from Mint. I remember not long ago Mint included just about every browser media plugin ever made, including RealMedia, WindowsMedia etc., stuff that was obsolete 15 years ago. Maybe it still does. All that stuff doesn't just mean bloat, but also significant security risks. You can somewhat get away with it because desktop Linux isn't a major target (yet), but it's just very bad…

There are still sites where those plugins are very useful. I'd like a distro that shipped them all.

Re: Linux Mint downloads (briefly) compromised

#175
post #99

As a super happy user of Linux Mint - guys, please keep doing what you are doing! Thank you so much for giving us a proper desktop Linux! You have my (financial) support! Don't get pressured by some random loud Internet criticism and change for worse! Please don't do Win7->Win8 or iOS6->iOS7 regression in Mint as well because of a few unhappy voices trying to acquire power over you!

I'm going to back you up on this. I'm sorry to hear there are problems, but I won't be switching OS's. Mint has been rock solid for me.

Re: Linux Mint downloads (briefly) compromised

#176
post #32

Earlier quoted context omitted.

The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the…

I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.

The user interface/experience of PGP/GPG is not great, and that could do with fixing. However if you already understood how to use PGP (and granted that's unlikely for the users Mint targets), then you would not have been caught out by this.

Re: Linux Mint downloads (briefly) compromised

#177
post #139

Earlier quoted context omitted.

How bad must desktop Linux in general be, if people are so busy rejoicing about a volume icon that works, that they accept poor security?

They mean from a usability perspective. Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks. It's like a tiny music player in your task bar. That said, no it should not excuse poor security.

I've written a similar thing for the Mac, using NSStatusBar [1]. It's no big deal, or reason for a Linux distribution to be "famous". There are zillions of apps in the Mac store that do stuff like that.

Does Linux have a standard API for surfacing interactive icons and menus in the menu bar? An ICCCM extension, perhaps -- set some properties on the root window and cross you fingers? Or would you have to do it differently for every different Linux desktop environment or window manager that supported such a feature?

[1] https://developer.apple.com/library/mac/documentation/Cocoa/...

Re: Linux Mint downloads (briefly) compromised

#178
post #5

Could [Linux] be added before Mint? I thought it was about Mint.com

Original page title is more communicative (so I suspect dang will fix it when he notices): Linux Mint downloads (briefly) compromised

Note that this suggested title is outdated as Mint was compromised twice. Meaning, it is not so brief anymore. The comment itself is more about the security practices.

More ontopic: Having your Wordpress instance compromised is rather expected with the amount of security bugs Wordpress gets.

Re: Linux Mint downloads (briefly) compromised

#179

There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast. There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be…

AppFS ( http://appfs.rkeene.org/ ) solves this (and all other packaging and distribution problems) by dividing the namespace along DNS lines.

That is you can run both:

     /opt/appfs/linuxmint.com/mdm/platform/latest/bin/mdm
and

     /opt/appfs/debian.org/mdm/platform/latest/bin/mdm
They are both always accessible (in other packaging systems you would refer to them as a "installed" since all their files may be read).

Re: Linux Mint downloads (briefly) compromised

#180

Every once in a while, I get difference error in /etc/issue*. I really hate all of these. I use Mint only because I like its GUI interface. I really cannot stand Ubuntu desktop for a moment

I also use Mint mostly because of its interface and i hate Ubuntu desktop too. Given this, what are the best alternatives to Mint GUI that offer the same level of comfort?

Ubuntu Gnome - works VERY well - if you enable the "window list" plugin for shell, it works as well as cinnamon. You can also use some other distro like debian or fedora that also provides cinnamon.
Post reply on HN