Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

Post reply on HN
Print view View original

201–210 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#201

Post by mmcclure »

blubb-fish wrote: post #196
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

> I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I would consider myself pretty "technical". And yet, I am not willing to spend more effort than absolutely necessary for setting up my Linux OS. Just b/c I am a programmer and even love to use zsh and Git from the CLI does not imply that I have any patience for fiddling with drivers and kernels. In the "Linux Communit…

So, so, so much this. I did a full-stop switch to Mint for ~2 months and, for the most part, quite enjoyed it. What finally killed it for me was when I was back in an "office" setting where I wanted to use a monitor and bluetooth peripherals. After a few days of struggling through various bluetooth drivers and CLI management tools, I gave up.

To make things worse, the general response I've heard from other folks that use Linux full time was, "oh yeah, why weren't you just using USB peripherals?" The general feeling I got was that I was a n00b for even trying to use a BT mouse and keyboard in the first place.

I genuinely wanted to make the switch work, and it's a shame that it just didn't (for me). Honestly, the last thing I need sprinkled into every few working days is 45 minutes trying to get some driver re-installed.

Re: Linux Mint downloads (briefly) compromised

#202

Post by blubb-fish »

mmcclure wrote: post #201
blubb-fish wrote: post #196

Earlier quoted context omitted.

> I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I would consider myself pretty "technical". And yet, I am not willing to spend more effort than absolutely necessary for setting up my Linux OS. Just b/c I am a programmer and even love to use zsh and Git from the CLI does not imply that I have any patience for fiddling with drivers and kernels. In the "Linux Communit…

So, so, so much this. I did a full-stop switch to Mint for ~2 months and, for the most part, quite enjoyed it. What finally killed it for me was when I was back in an "office" setting where I wanted to use a monitor and bluetooth peripherals. After a few days of struggling through various bluetooth drivers and CLI management tools, I gave up. To make things worse, the general response I've heard from other folks that…

I also faced various issues ... as it is anyway inevitable with Linux apparently (yes, the closed source drivers ...).

But I managed to solve almost all of them thanks to lots of very kind, to the point and fast responding pros on forum.linuxmint.com.

Re: Linux Mint downloads (briefly) compromised

#203

Post by pimeys »

joshgachnang wrote: post #199
blubb-fish wrote: post #196

Earlier quoted context omitted.

> I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I would consider myself pretty "technical". And yet, I am not willing to spend more effort than absolutely necessary for setting up my Linux OS. Just b/c I am a programmer and even love to use zsh and Git from the CLI does not imply that I have any patience for fiddling with drivers and kernels. In the "Linux Communit…

I think that's why a lot of people wind up on OSX. You get the CLI environment you're used to with Linux, but rarely lose half a day because a driver upgrade broke your desktop.

Funny, because I've been using Arch Linux now almost 5 years on my work computer without any problems. Same desktop (xmonad), same editor (emacs) and same terminal (xterm) with the most awesome configuration stored in Github. The only problems I've heard here are coming from the OSX users, who face difficulties when upgrading the OS into a new version, which breaks homebrew or something...

Re: Linux Mint downloads (briefly) compromised

#204

Post by baldfat »

auxym wrote: post #82
baldfat wrote: post #65

Earlier quoted context omitted.

Don't want to be that evangelist guy BUT OpenSUSE really deserves a second looks and it is non-technical family member friendly. They are super stable and provide one-click install off the web like Mint, but it install them as a regular repo which makes updating them a breeze. On the technical I love OpenSUSE for zypper, build (Any software you need is probably on there and it will even build for other distros), roll…

OpenSUSE is great, YAST is the best "control panel" app I've seen in any distro, you can configure antyhing without ever opening a terminal or vim. Zypper has also been more robust for me than apt (I've seen apt-get hell once or twice). That said, stay away from Tumbleweed (rolling release). In my experience it's been even less stable than Arch or Sid. In the past I've had kernel updates making the machine unbootable…

When was the last time you tried Tumbleweed? It has improved a ton and especially with this latest LEAP release.

Re: Linux Mint downloads (briefly) compromised

#205

Post by ChrisClark »

bitL wrote: post #126
DonHopkins wrote: post #119

Earlier quoted context omitted.

How bad must desktop Linux in general be, if people are so busy rejoicing about a volume icon that works, that they accept poor security?

Poor security in what sense? That something can be spoofed by an attacker with unlimited resources? How many of your desktop users are actually at risk? How about Win 10 telemetry? Or whatever OS X is sending back to Apple? Happy about it?

Did you read the article? Mint blocks many security patches because of the mish-mash of packages it has, makes updating impossible.

Re: Linux Mint downloads (briefly) compromised

#206

Post by zanny »

viperscape wrote: post #86
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

Have you given Arch a try yet? Their are also some family friendly projects like Antergos. Arch wiki is my all time favorite for great documentation, even when not using arch, go figure.

As an Arch user, the lack of MAC in any well supported form throughout Arch and its derivatives is a deal breaking turn off to me. I cannot imagine telling someone who is not technically literate to start using a Linux distro without being able to trust that arbitrary software cannot read all their documents and steal their passwords.

Re: Linux Mint downloads (briefly) compromised

#207

Post by INTPenis »

purpled_haze wrote: post #40
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

I'm curious- what do you think of Fedora? It's in the top 5 distros along with OpenSUSE, Ubuntu, Debian, and Mint, and yet I hardly ever hear people talk about it. I had personally given up on Fedora years ago, but recently was told I should give it a second look and I've not had time to try it out.

As a sysadmin Fedora is my go to distro. I can't say if regular users could manage but I think they would since it's mostly vanilla Gnome 3.

My reason for choosing Fedora is because of its maturity, major player backing and SElinux implementation.

It works great, I feel like a modern Linux user in Fedora.

Re: Linux Mint downloads (briefly) compromised

#208

Post by orangeshark »

DonHopkins wrote: post #177
kedean wrote: post #139

Earlier quoted context omitted.

They mean from a usability perspective. Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks. It's like a tiny music player in your task bar. That said, no it should not excuse poor security.

I've written a similar thing for the Mac, using NSStatusBar [1]. It's no big deal, or reason for a Linux distribution to be "famous". There are zillions of apps in the Mac store that do stuff like that. Does Linux have a standard API for surfacing interactive icons and menus in the menu bar? An ICCCM extension, perhaps -- set some properties on the root window and cross you fingers? Or would you have to do it differe…

It depends on the desktop environment. Most desktop environments provide a way to extend the desktop with extensions which can be written in various languages. In the case of Cinnamon for Linux Mint, being based on Gnome, it uses JavaScript to extend the desktop with extensions, applets (extensions that display on the menu bar), and desklets (extensions that display on the desktop). In fact, a good portion of Cinnamon[1] is actually written in JavaScript.

[1]: https://github.com/linuxmint/cinnamon

Re: Linux Mint downloads (briefly) compromised

#209

Post by c22 »

annnnd wrote: post #62
venomsnake wrote: post #42

Earlier quoted context omitted.

I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.

True, but the site has to be compromised at the moment you are downloading the keys (not anytime later!), and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Ideally, the keys should be distributed in safe fashion too, so this whole question should be moot.

> ...and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore.

Though perhaps more trivial when the attacker has helpfully provided your operating environment.

Re: Linux Mint downloads (briefly) compromised

#210

Post by INTPenis »

dizzystar wrote: post #73
purpled_haze wrote: post #40

Earlier quoted context omitted.

I'm curious- what do you think of Fedora? It's in the top 5 distros along with OpenSUSE, Ubuntu, Debian, and Mint, and yet I hardly ever hear people talk about it. I had personally given up on Fedora years ago, but recently was told I should give it a second look and I've not had time to try it out.

I use Fedora and I truly do love it. I find it to be far more stable than other distros I've tried, and it really does "just work." I know I've been suggesting it to people who are considering Linux for the first time, with the caveat of disabling SElinux. With that said, I'm not sure if it is good for non-technical people or people who aren't interested in learning about it. Getting certain things installed can be a…

I'm not even sure I would recommend a novice user to disable SElinux because the only times I configure SElinux are when setting up developer specific things.
Post reply on HN