Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

Post reply on HN
Print view View original

191–200 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#191

Post by _yy »

whyoh wrote: post #106
izacus wrote: post #19

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Hmm, that was actually one of major selling points for Mint around me - it was the distro that "worked", with relevant software,…

OTOH, it's exactly what pushed me away from Mint. I remember not long ago Mint included just about every browser media plugin ever made, including RealMedia, WindowsMedia etc., stuff that was obsolete 15 years ago. Maybe it still does. All that stuff doesn't just mean bloat, but also significant security risks. You can somewhat get away with it because desktop Linux isn't a major target (yet), but it's just very bad…

> I remember not long ago Mint included just about every browser media plugin ever made, including RealMedia, WindowsMedia etc., stuff that was obsolete 15 years ago. Maybe it still does.

Weren't those just VLC wrappers?

Re: Linux Mint downloads (briefly) compromised

#192

Post by auxiliation »

onlycommenting wrote: post #6

There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast. There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be…

Gentoo handles this by categorizing packages into a format like app-editors/vim. This way packages in different categories can share the same name:

dev-lang/crystal (The Crystal Programming Language) games-mud/crystal (The crystal MUD client) x11-themes/crystal (Crystal decoration theme for KDE4.x)

When installing packages, if a package having a unique name across all categories, a simple "emerge vim" will install it. Otherwise, the category can be specified with "emerge dev-lang/crystal".

Re: Linux Mint downloads (briefly) compromised

#193

Post by feld »

weavie wrote: post #120
m00dy wrote: post #3

Whos using Mint these days anyway ?

Me... I had been using Arch and FreeBSD for a time because I felt it was what serious programmers had to use. Then one day after FreeBSD refused to boot up again I figured I was bored of messing about in recovery mode yet again so I just thought I would give Mint ago. 20 minutes later everything was up and running. Since then I haven't been able to find the time or the will to spend a whole evening setting up my mach…

Genuinely curious how you managed to make FreeBSD fail to boot up? :-)

Re: Linux Mint downloads (briefly) compromised

#194

Post by jhasse »

DonHopkins wrote: post #177
kedean wrote: post #139

Earlier quoted context omitted.

They mean from a usability perspective. Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks. It's like a tiny music player in your task bar. That said, no it should not excuse poor security.

I've written a similar thing for the Mac, using NSStatusBar [1]. It's no big deal, or reason for a Linux distribution to be "famous". There are zillions of apps in the Mac store that do stuff like that. Does Linux have a standard API for surfacing interactive icons and menus in the menu bar? An ICCCM extension, perhaps -- set some properties on the root window and cross you fingers? Or would you have to do it differe…

> Or would you have to do it differently for every different Linux desktop environment or window manager that supported such a feature?

Exactly. Unity has libappindicator, KDE has Plasma, GNOME Shell also has its own plugin API and there's still the old tray API in Gtk+ and Qt.

Re: Linux Mint downloads (briefly) compromised

#195

Post by BuckRogers »

I see a lot of people asking for alternatives. I spent 12 months trying almost every distro I could get my hands on and have some recommendations for those interested.

This was my shortlist at the end of all my adventurism and testing.

1. Linux Mint

2. Ubuntu MATE

3. Antergos Cinnamon

Pretty short list but those are what I found I settled on as possible choices for my own use. If the goal is getting down to business and getting work done rather than fiddling with the system I think those 3 would fit most people's needs. I was a longtime Xubuntu user prior to this adventurism, and IMO there are just better alternatives though it would probably be #4 if I had one, but I'm just not a fan any longer. MATE man handles XFCE.

I leave Mint at the top because other than these security concerns, it remains the best distro for me. I love their LTS update policy, continually delivering updates to Mint during the entire support span of Ubuntu LTS. Their desktop env is also just better IMO than alternatives.

Ubuntu MATE is pretty good and for the type of person like myself who is drawn to Mint, would be a really good alternative. It's missing a few features of Cinnamon, which is superior in general for me to MATE. But overall this is what I'll install if I decided to ditch Mint.

Antergos is just Arch with a nice installer. I didn't spend a long time testing this but it would be my choice for a rolling distro. Many people I know want that and they offer Cinnamon as a main, supported environment. Might be the best of every world for some. I prefer the slower updates of LM and UM, and install newer packages through PPAs or compiling it.

As an aside, I have completely given up installing other desktop environments onto distros that didn't originally ship with them. I see people recommending that, and it may work out but it's a mess if you want to switch back in my experience. I prefer to pick a distro that ships with the DE of your choice. I would not run for example, 'sudo apt-get install cinnamon-desktop-environment', anywhere at any point. :)

Hopefully this helps someone out there looking to migrate off of Mint. I'm still using it (on 17.2 here) but may move to UbuntuMATE or Antergos Cinnamon, depending on Clem's response.

Re: Linux Mint downloads (briefly) compromised

#196

Post by blubb-fish »

jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

> I've used Mint in the past, and it was my go-to distro for family members who aren't so technical.

I would consider myself pretty "technical".

And yet, I am not willing to spend more effort than absolutely necessary for setting up my Linux OS.

Just b/c I am a programmer and even love to use zsh and Git from the CLI does not imply that I have any patience for fiddling with drivers and kernels.

In the "Linux Community" there only seems to exist the hacker (who loves to spend ages tinkering with config files and debugging hardware issues) and the technically incompetent user (who most likely uses Windows anyway).

There is a lot in between.

Re: Linux Mint downloads (briefly) compromised

#197

Post by toast0 »

versteegen wrote: post #43
snarfy wrote: post #24

I remember installing it when it was relatively new and people were gushing over it. A few weeks later a new version came out. I tried upgrading when I found there was no upgrade path. Upgrading Mint means reinstalling Mint. I remember the days before apt-get when there was only dpkg. Before Debian I used Slackware so I'm all too familiar with package management (or lack of). The idea that someone would release a new…

I'm sorry for the rant, it's a bit off topic and not called for, but would like to say my experience is sort of the opposite: I've been a Slackware-current user for most of a decade, and I love that it's so easy to upgrade the OS using slackpkg. I can (and do) often only upgrade a subset of packages, and never even need to reboot afterwards, not even after replacing the kernel (although, obviously...). A simple packa…

Slackpkg is relatively new, it was part of the slackware 9.1 release. A lot of people, myself included, remember experiences with older releases without a real package manager.

Re: Linux Mint downloads (briefly) compromised

#199

Post by joshgachnang »

blubb-fish wrote: post #196
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

> I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I would consider myself pretty "technical". And yet, I am not willing to spend more effort than absolutely necessary for setting up my Linux OS. Just b/c I am a programmer and even love to use zsh and Git from the CLI does not imply that I have any patience for fiddling with drivers and kernels. In the "Linux Communit…

I think that's why a lot of people wind up on OSX. You get the CLI environment you're used to with Linux, but rarely lose half a day because a driver upgrade broke your desktop.

Re: Linux Mint downloads (briefly) compromised

#200

Post by flurpitude »

snarfy wrote: post #24

I remember installing it when it was relatively new and people were gushing over it. A few weeks later a new version came out. I tried upgrading when I found there was no upgrade path. Upgrading Mint means reinstalling Mint. I remember the days before apt-get when there was only dpkg. Before Debian I used Slackware so I'm all too familiar with package management (or lack of). The idea that someone would release a new…

>I tried upgrading when I found there was no upgrade path. Upgrading Mint means reinstalling Mint.

I don't think that's true any more. I think they allow you to upgrade in place.

Post reply on HN