Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 16.04 (Xenial Xerus)

releases.ubuntu.com

Post reply on HN
Print view View original

121–130 of 303 posts

Re: Ubuntu 16.04 (Xenial Xerus)

#121

Post by Rezo »

PSA: If you're running a HTTP/2 server like NGINX on the 14.04 LTS you'll want to upgrade to this release.

Google Chrome will no longer support HTTP/2 on vanilla 14.04 after May 15th [0], even if you're using the latest official upstream NGINX packages. This is because 14.04 ships with a version of OpenSSL that does not support the ALPN extension (prior to OpenSSL 1.0.2 you're limited to NPN, now deprecated). There was a bit of back-and-forth about the exact date, as the change was originally scheduled for earlier. However, Chrome decided to specifically push back the date so that there would be an Ubuntu LTS release available with the required support [1]. If you're still stuck on SPDY, that's going to be dropped too, so there's really no good reason not to simply use HTTP/2 at this point.

[0] http://blog.chromium.org/2016/02/transitioning-from-spdy-to-...

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=557197

Re: Ubuntu 16.04 (Xenial Xerus)

#122

Post by listic »

atonse wrote: post #32
nailer wrote: post #19

For anyone packaging software on Linux, this now means every major distro - Debian, RHEL/CentOS, Arch and now Ubuntu - supports .service files. No need for bash scripts, custom watchdog and daemonise tools, etc.

This is pretty much the only reason I've been waiting for 16.04 – to get rid of upstart scripts and standardize on systemd. Still going to wait for a couple months while people iron out initial bugs but definitely excited about this release.

> to wait for a couple months while people iron out initial bugs

There's going to be a 16.04.1 release just 3 months away from the initial LTS release; I believe it is just for that.

https://wiki.ubuntu.com/TrustyTahr/ReleaseSchedule - this schedule is for 14.04, but I believe it's been the same for quite a few years already.

Re: Ubuntu 16.04 (Xenial Xerus)

#123

Post by defective »

thieving_magpie wrote: post #119
csense wrote: post #104

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has been severely compromised, with its weaknesses having been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially "cryptographically broken and unsuitable for further use". [1] [1]…

I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're dow…

It's worth it for error-checking.

Re: Ubuntu 16.04 (Xenial Xerus)

#124

Post by avar »

csense wrote: post #104

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has been severely compromised, with its weaknesses having been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially "cryptographically broken and unsuitable for further use". [1] [1]…

You're conflating collision attacks like the Flame malware with a preimage attack that would be necessary to produce a malicious Ubuntu release with the same MD5SUM.

I.e. what's "broken" about MD5 is if you have a lot of CPU time and I allow you to give me two unrelated blobs, you can craft those blobs to have the same MD5 sum.

What's not "broken" (beyond a theoretical 2^123.4 attack) with MD5 and not broken at all for SHA1 is preimage attacks. E.g. if I work for Canonical, make an Ubuntu ISO and you have to produce a malicious ISO with the same MD5 sum.

We should be considerate of collision / preimage attacks, but please don't spread FUD by conflating the two. Publishing MD5 sums for ISOs is just fine.

Re: Ubuntu 16.04 (Xenial Xerus)

#125

Post by peatmoss »

stephenr wrote: post #61
nailer wrote: post #19

For anyone packaging software on Linux, this now means every major distro - Debian, RHEL/CentOS, Arch and now Ubuntu - supports .service files. No need for bash scripts, custom watchdog and daemonise tools, etc.

> No need for bash scripts Friends don't let friends write shell scripts targeting bash. For context: Bash is not available|installed everywhere, and has some inter-version weirdness. Write clean, posix-compliant shell scripts (i.e. target /bin/sh commonly referred to as bourne shell) and you're in a much better position. On Debian your script will be run by Dash, on OS X it will be run by Bash, on Ubuntu or RedHat i…

You're getting downvoted to oblivion, but I'm old enough to remember not being able to take bash for granted. The default shell on some modern systems (OpenBSD for example) comes to mind as well. I feel this battle has mostly been lost, however.

Re: Ubuntu 16.04 (Xenial Xerus)

#126

Post by eloisant »

thieving_magpie wrote: post #119
csense wrote: post #104

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has been severely compromised, with its weaknesses having been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially "cryptographically broken and unsuitable for further use". [1] [1]…

I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're dow…

If they infect at the source, yes. But if just one mirror is infected, or one of the CDN servers, the attacker may not be able to change the checksum on the official site.

Re: Ubuntu 16.04 (Xenial Xerus)

#127

Post by qznc »

Rezo wrote: post #121

PSA: If you're running a HTTP/2 server like NGINX on the 14.04 LTS you'll want to upgrade to this release. Google Chrome will no longer support HTTP/2 on vanilla 14.04 after May 15th [0], even if you're using the latest official upstream NGINX packages. This is because 14.04 ships with a version of OpenSSL that does not support the ALPN extension (prior to OpenSSL 1.0.2 you're limited to NPN, now deprecated). There w…

If you use 14.04, you usually upgrade at the first point release to 16.04.01, not now at 16.04.00. Only 15.10 will immediately suggest an update.

Is this outdated or not applicable to servers?

Re: Ubuntu 16.04 (Xenial Xerus)

#128

Post by fideloper »

weitzj wrote: post #107
zakk wrote: post #87

Earlier quoted context omitted.

Does it work for you? For me VirtualBox gets stuck into the 'gurumeditation' state when booting.

Same Problem. Newest VirtualBox newest vagtant 1.8.1

Also same, but have heard better reports from those on Virtuabox 4 instead of latest Virtuabox 5 :(

I had better luck with https://atlas.hashicorp.com/gbarbieru/boxes/xenial which just got updated a few hours ago.

Re: Ubuntu 16.04 (Xenial Xerus)

#129

Post by thieving_magpie »

eloisant wrote: post #126
thieving_magpie wrote: post #119

Earlier quoted context omitted.

I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're dow…

If they infect at the source, yes. But if just one mirror is infected, or one of the CDN servers, the attacker may not be able to change the checksum on the official site.

Ah - that makes sense. I knew their had to be an easy answer but I couldn't see it.

Thanks

Re: Ubuntu 16.04 (Xenial Xerus)

#130

Post by fulafel »

thieving_magpie wrote: post #119
csense wrote: post #104

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has been severely compromised, with its weaknesses having been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially "cryptographically broken and unsuitable for further use". [1] [1]…

I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're dow…

They GPG-sign the cryptographic checksums, see the .gpg files. If you don't verify the GPG sig, with Canonical's signing key obtained out of band, the checksum by itself is pretty useless as you describe.

PS. anyone know of a CLI download tool that supports this format of GPG signatures?

edit: why the downvotes for the parent? it's a fine question

Post reply on HN