Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“This version of XScreenSaver is very old. Please upgrade”

bugs.debian.org

Post reply on HN
Print view View original

11–20 of 105 posts

Re: “This version of XScreenSaver is very old. Please upgrade”

#11

Post by digi_owl »

johnchristopher wrote: post #10

I can't find it on his website at the moment but he has an excellent explanation of why gnome-screensaver is inherently insecure. If I remember correctly it boils down to something like: `nobody can guarantee that gnome-screensaver is secure because it relies on GTK which nobody can prove or guarantee that it's 100% secure because there's too much code to check.`. edit: found it: I am as close to certain as I can be…

Then again he got egg on his face recently because the xscreensaver lock screen would crash if the display output was switched (or some such).

Re: “This version of XScreenSaver is very old. Please upgrade”

#12

Post by odinduty »

digi_owl wrote: post #11
johnchristopher wrote: post #10

I can't find it on his website at the moment but he has an excellent explanation of why gnome-screensaver is inherently insecure. If I remember correctly it boils down to something like: `nobody can guarantee that gnome-screensaver is secure because it relies on GTK which nobody can prove or guarantee that it's 100% secure because there's too much code to check.`. edit: found it: I am as close to certain as I can be…

Then again he got egg on his face recently because the xscreensaver lock screen would crash if the display output was switched (or some such).

Was that a security issue or just a crash?

Re: “This version of XScreenSaver is very old. Please upgrade”

#13

Post by digi_owl »

odinduty wrote: post #12
digi_owl wrote: post #11

Earlier quoted context omitted.

Then again he got egg on his face recently because the xscreensaver lock screen would crash if the display output was switched (or some such).

Was that a security issue or just a crash?

It would lead to the screen becoming unlocked, iirc.

Edit: Just to add a bit more detail. xscreensaver locks the screen by putting a window across it that grabs ownership of input devices. Thus if it crashes, the window goes away and the inputs released.

Re: “This version of XScreenSaver is very old. Please upgrade”

#15

Post by tinco »

castratikron wrote: post #14

Huh. Ran into this behavior yesterday, coincidentally. I also think there's another bug with xscreensaver where it will capture and "hang on" to your keyboard after you've unlocked the machine. Maybe it's time to switch...

... to another distro that actually ships up to date software?

Re: “This version of XScreenSaver is very old. Please upgrade”

#16

Post by sp332 »

captainmuon wrote: post #9

After skimming the thread, I'm tempted to say: tell jwz "tough luck" and keep xscreensaver, with the message patched out, just out of spite. After all, he put it under a permissive license, so he should not be surprised that people actually use that license to do whatever they want.

He admits as much in the post, so you don't really have any cause for spite. Respecting his request would improve everyone's experience.

Re: “This version of XScreenSaver is very old. Please upgrade”

#18

Post by Jasper_ »

johnchristopher wrote: post #10

I can't find it on his website at the moment but he has an excellent explanation of why gnome-screensaver is inherently insecure. If I remember correctly it boils down to something like: `nobody can guarantee that gnome-screensaver is secure because it relies on GTK which nobody can prove or guarantee that it's 100% secure because there's too much code to check.`. edit: found it: I am as close to certain as I can be…

But why can he vouch that libX11 is any more secure? The library that runs complex input method code on every key-press, that has had CVEs in it? [0] [1]

[0] https://cgit.freedesktop.org/xorg/lib/libX11/tree/modules/im... [1] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-20...

Not to mention that I can still write a keylogger that bypasses jwz's xscreensaver. [2]

[2] https://github.com/magcius/keylog

Re: “This version of XScreenSaver is very old. Please upgrade”

#19

Post by castratikron »

tinco wrote: post #15
castratikron wrote: post #14

Huh. Ran into this behavior yesterday, coincidentally. I also think there's another bug with xscreensaver where it will capture and "hang on" to your keyboard after you've unlocked the machine. Maybe it's time to switch...

... to another distro that actually ships up to date software?

Not a chance! Debian is the only sane Linux distro. Xubuntu would by alright if they ever decide to switch to systemd.

Re: “This version of XScreenSaver is very old. Please upgrade”

#20

Post by sanbor »

Here in Argentina it's common to find people that works dealing with customers or in the street that are very rude and kind of sociopaths. For what I have read in threads like this one, software developers that have to deal with many users/developers like Linus Torvalds, Theo de Raadt, and Jamie Zawinski end up suffering the same symptom.
Post reply on HN