Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“This version of XScreenSaver is very old. Please upgrade”

bugs.debian.org

Post reply on HN
Print view View original

81–90 of 105 posts

Re: “This version of XScreenSaver is very old. Please upgrade”

#81

Post by jarcane »

dfc wrote: post #56
jarcane wrote: post #23

Frankly, this is a very good example why I inevitably give up on using Debian. It is not the software writers' fault that your distro can't be arsed to keep its package system up-to-date. Even the unstable branch is routinely multiple versions behind on software. The idea of linking end-user software versioning to the operating system version itself was always a dumb idea, but has become even more absurd over time. N…

> No other operating system but Linux (and possibly some > BSDs) does this to the extent that the distro model does. I am not sure this is the case. What other operating systems except Linux and the BSDs offer users a choice for which XYZ should be used? Is the window manager functionality in Windows Vista not provided by a specific version of that software component? I think the version of OpenSSH in OSX is tied to…

At the moment, the Racket package in the current stable release of Debian is using 6.1. That is an 8 month old package. Even unstable is only on on 6.3, which itself is almost 6 months old. The last time I used Debian was at most a year ago, and at that time the stable package for Racket was still 5.3, which came out in 2013.

And this same pattern repeated itself so often where programming tools were concerned that I eventually just gave up on using apt-get for developing and would wind up manually installing most languages, and then sometimes having to fight with conflicts because some package or other had already installed an out-of-date version, so now I either had to overwrite the package-installed version and risk breaking something, or just run it locally from some directory in /home.

Contrast to Windows or OS X, where all I have to do to run Racket is go to the website, download the latest version, and possibly run an automated installer. On OS X, I just have to drag one icon onto another icon, and if the app's been set up right this even handles my command-line paths for me.

Seriously, this is 2016. We have the internet now. We do not need to load every piece of software one would ever need onto a CD anymore like it's 1994 and the only reliable source of Linux software is Walnut Creek CD-ROMs.

It is a perfectly reasonable expected use case that someone desiring a piece of software should be able to just go and download the most recent version, install it, and should need arise, uninstall it just as cleanly.

Nowhere else is that process as broken as it is on Linux, especially under Debian's hopelessly slow update process.

Re: “This version of XScreenSaver is very old. Please upgrade”

#82

Post by castratikron »

tinco wrote: post #77
ferrari8608 wrote: post #75

Earlier quoted context omitted.

Having to rescue your system after every upgrade is either an exaggeration or you do weird things with your system. If the latter, quit that. I had my Arch system running for over a year, upgraded at least once a week. Only once did I need the rescue disk, and that was my own fault (some um... "clever" pacman command I dreamed up ended up uninstalling some pretty important things like all of base).

It's a joke about how Archlinux works. If you do a "pacman -Syu" without reading the changelogs there is a good chance your system won't boot. You just can't be negligent. They might change the location of libc, they might switch to systemd, they change whatever they need to to be the coolest operating system on the block, and that's why I love them. But if you weren't hip to it, your system won't boot.

>they might switch to systemd I remember that day. I was an Arch user at the time. For me, everything went without a hitch, but I know a couple of my friends had a lot of grief over the switch, especially since they had no idea the switch was happening until after things broke.

Re: “This version of XScreenSaver is very old. Please upgrade”

#83

Post by tinco »

ferrari8608 wrote: post #80
tinco wrote: post #77

Earlier quoted context omitted.

It's a joke about how Archlinux works. If you do a "pacman -Syu" without reading the changelogs there is a good chance your system won't boot. You just can't be negligent. They might change the location of libc, they might switch to systemd, they change whatever they need to to be the coolest operating system on the block, and that's why I love them. But if you weren't hip to it, your system won't boot.

Arch isn't a distro for people who take issue to reading up on what they're actually doing to their system with upgrades, package installations, and configuration. That's why they have one of the most amazing wikis around. It's expected that you read all of the things. I still don't agree with the unbootable bit though. That hasn't happened on any of my systems (two Arch machines, two Arch-based Antergos machines) in…

Please note that I ran Arch for over 5 years, upgrading perhaps once or twice a year. Rebooting only at power failures, and at particularly bad security issues. The hardware was a Pentium 4. This was years ago (when I was in college).

Re: “This version of XScreenSaver is very old. Please upgrade”

#84

Post by morb »

cyphax wrote: post #68
jhkaghjkga wrote: post #48

And at least OpenSuSE and Slackware just patched the warning out already -- probably after getting hit by it in the past. See for example the patch in Slackware: https://slackbuilds.org/mirror/slackware/slackware-current/s...

Oh wow, I didn't expect that from Slackware... I hadn't noticed that the message is gone, I guess. I can't help but to think it is kind of rude to keep using xscreensaver but not honor the request of its author. It's purely the principle of the thing because I agree that the message is ugly. That's not in true Slackware spirit imho (in the sense that this is a less-than-necessary patch). I am a little bit disappointe…

Yes, the nag text was removed, but at least xscreensaver gets updates, which was the whole point.

> patches/packages/xscreensaver-5.34-i486-1_slack14.1.txz: Upgraded. I promised jwz that I'd keep this updated in -stable when I removed (against his wishes) the nag screen that complains if a year has passed since that version was released. So, here's the latest one.

Personally I don't get the point of screesavers at all, since we have monitors that can be sent sleep/standby mode when they're not used.

Re: “This version of XScreenSaver is very old. Please upgrade”

#85

Post by digi_owl »

Jasper_ wrote: post #18
johnchristopher wrote: post #10

I can't find it on his website at the moment but he has an excellent explanation of why gnome-screensaver is inherently insecure. If I remember correctly it boils down to something like: `nobody can guarantee that gnome-screensaver is secure because it relies on GTK which nobody can prove or guarantee that it's 100% secure because there's too much code to check.`. edit: found it: I am as close to certain as I can be…

But why can he vouch that libX11 is any more secure? The library that runs complex input method code on every key-press, that has had CVEs in it? [0] [1] [0] https://cgit.freedesktop.org/xorg/lib/libX11/tree/modules/im... [1] https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-20... Not to mention that I can still write a keylogger that bypasses jwz's xscreensaver. [2] [2] https://github.com/magcius/keylog

Didn't know that screen locks were supposed to defeat keyloggers. I thought they existed to stop people walking up to an unattended computer and mess around.

Anyways, if i am reading the CVE right it is about how X11 can be provoked into maxing out its stack. Possibly annoying for those trying to use X11, but not something that leaks data.

The more i see "security" discussed on HN, the more i feel that there needs to be a ranking system. All to often it seems like people are operating with a binary definition of security, putting anything with a CVE in the insecure bin.

Re: “This version of XScreenSaver is very old. Please upgrade”

#86

Post by digi_owl »

zanny wrote: post #71
digi_owl wrote: post #39

Earlier quoted context omitted.

Having used Gobolinux for some years now, i find the xdg-app thinking a case of shooting twee twee birds with AA guns. *nix already have a mechanism called soname in place that allow versioned libs to live side by side. Gobolinux makes good use of it, along with symlinking, to allow multiple versions to be installed side by side. You find similar, tho more elaborate, systems in place in NixOS/Guix. xdg-app on the oth…

Different versions of the same libraries for different applications is still the same problem. Fundamentally developers are writing software that distributors and integrators do not want to actually ship. There are two independent circumstances to that, though. Either the developer does not deserve downstream trust because they abuse their users by breaking their APIs, ABIs, or UX's without due notice or process. Thi…

From where i sit, what seems to block most distributors from upgrading is the rigidity of their tradition package managers when dealing with multiple versions.

Thus they are reluctant to adopt new version of something, because the dependency chain may force a update of a large part of a installed system.

A package manager that can handle multiple version frees them from this worry, without the admin of a system having to trawl every "container" if a lib is found to be vulnerable (a very real possibility with the likes of xdg-app, and somewhat akin to Windows "dll hell").

Re: “This version of XScreenSaver is very old. Please upgrade”

#87

Post by cmsj »

sanbor wrote: post #30
jarcane wrote: post #23

Frankly, this is a very good example why I inevitably give up on using Debian. It is not the software writers' fault that your distro can't be arsed to keep its package system up-to-date. Even the unstable branch is routinely multiple versions behind on software. The idea of linking end-user software versioning to the operating system version itself was always a dumb idea, but has become even more absurd over time. N…

Maybe distros like Debian are more stability/security oriented than feature oriented. New version of software often contain new features that it may introduce new bugs. Debian guarantees that when you install their distro things are going to work and are kind of secure. The tradeoff of having all the software in the distro being checked by people that have tested and checked that everything works well and smooth it's…

Debian doesn't guarantee you anything. "stable" isn't bug free, what you're getting is a lack of newness. "stale" would be a better choice of word. It's not necessarily better, it's just not changing.

Re: “This version of XScreenSaver is very old. Please upgrade”

#88

Post by seba_dos1 »

tinco wrote: post #83
ferrari8608 wrote: post #80

Earlier quoted context omitted.

Arch isn't a distro for people who take issue to reading up on what they're actually doing to their system with upgrades, package installations, and configuration. That's why they have one of the most amazing wikis around. It's expected that you read all of the things. I still don't agree with the unbootable bit though. That hasn't happened on any of my systems (two Arch machines, two Arch-based Antergos machines) in…

Please note that I ran Arch for over 5 years, upgrading perhaps once or twice a year. Rebooting only at power failures, and at particularly bad security issues. The hardware was a Pentium 4. This was years ago (when I was in college).

That's basically guaranteed to break your system on Arch. Don't do that - it's your fault when it breaks like that.

Re: “This version of XScreenSaver is very old. Please upgrade”

#89

Post by dfc »

jarcane wrote: post #81
dfc wrote: post #56

Earlier quoted context omitted.

> No other operating system but Linux (and possibly some > BSDs) does this to the extent that the distro model does. I am not sure this is the case. What other operating systems except Linux and the BSDs offer users a choice for which XYZ should be used? Is the window manager functionality in Windows Vista not provided by a specific version of that software component? I think the version of OpenSSH in OSX is tied to…

At the moment, the Racket package in the current stable release of Debian is using 6.1. That is an 8 month old package. Even unstable is only on on 6.3, which itself is almost 6 months old. The last time I used Debian was at most a year ago, and at that time the stable package for Racket was still 5.3, which came out in 2013 . And this same pattern repeated itself so often where programming tools were concerned that…

Correct racket version 6.3 is 6 months old. But 6.4 came out two months ago, that seems to be the relevant age statistic. That seems a little disingenuous of you?

The software distribution and management scheme you are advocating for sounds like a security nightmare. Administrators are already bad enough with applying vendor updates. Can you imagine what things would be like if administrators had to track all of the different upstream security announcements for everything they installed?

Re: “This version of XScreenSaver is very old. Please upgrade”

#90

Post by basch »

morb wrote: post #84
cyphax wrote: post #68

Earlier quoted context omitted.

Oh wow, I didn't expect that from Slackware... I hadn't noticed that the message is gone, I guess. I can't help but to think it is kind of rude to keep using xscreensaver but not honor the request of its author. It's purely the principle of the thing because I agree that the message is ugly. That's not in true Slackware spirit imho (in the sense that this is a less-than-necessary patch). I am a little bit disappointe…

Yes, the nag text was removed, but at least xscreensaver gets updates, which was the whole point. > patches/packages/xscreensaver-5.34-i486-1_slack14.1.txz: Upgraded. I promised jwz that I'd keep this updated in -stable when I removed (against his wishes) the nag screen that complains if a year has passed since that version was released. So, here's the latest one. Personally I don't get the point of screesavers at al…

it is a lock screen that prompts for password on wake

https://www.jwz.org/xscreensaver/toolkits.html

Post reply on HN