Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 16.04 (Xenial Xerus)

releases.ubuntu.com

Post reply on HN
Print view View original

141–150 of 303 posts

Re: Ubuntu 16.04 (Xenial Xerus)

#141

Post by rakoo »

thieving_magpie wrote: post #119
csense wrote: post #104

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has been severely compromised, with its weaknesses having been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially "cryptographically broken and unsuitable for further use". [1] [1]…

I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're dow…

It doesn't protect against a malware being included by default, it protects against a malware being inserted on the wire, ie between Canonical's HDD and your HDD; if a malware is inserted at this point then the checksum should fail.

Coincidentally it requires the checksum to be propagated through an other, more secure mean, so distributing the checksum on the very same site increases the chance for an attacker to act, however there is no other way as widespread as this to give the checksum anyway.

Re: Ubuntu 16.04 (Xenial Xerus)

#142

Post by thieving_magpie »

lwf wrote: post #140
thieving_magpie wrote: post #119

Earlier quoted context omitted.

I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're dow…

If you have an existing Ubuntu system you trust, you can verify the authenticity of this release via: $ gpg --no-default-keyring --keyring /usr/share/keyrings/ubuntu-archive-keyring.gpg --verify SHA256SUMS{.gpg,} gpg: Signature made Thu 21 Apr 2016 10:40:38 UTC using DSA key ID FBB75451 gpg: Good signature from "Ubuntu CD Image Automatic Signing Key " gpg: WARNING: This key is not certified with a trusted signature!…

I see. I'll do that from now on, that's pretty reassuring.

Re: Ubuntu 16.04 (Xenial Xerus)

#143

Post by blueblob »

fulafel wrote: post #130
thieving_magpie wrote: post #119

Earlier quoted context omitted.

I've always wondered this but felt too embarrassed to ask, screw it. Let's say the ubuntu 16 iso is infected with some kind of malware by a 3rd party. If they have control of the file, would they not have control of the checksum displayed on the site? I can understand if the checksum is spread to other sites for cross-reference but I'm having trouble seeing why a checksum from the same location as the file you're dow…

They GPG-sign the cryptographic checksums, see the .gpg files. If you don't verify the GPG sig, with Canonical's signing key obtained out of band, the checksum by itself is pretty useless as you describe. PS. anyone know of a CLI download tool that supports this format of GPG signatures? edit: why the downvotes for the parent? it's a fine question

`gpg` is a command line tool for verifying these signatures and it is what `apt-key verify` uses in it's backend. you can download the signatures with `curl` or `wget`

Re: Ubuntu 16.04 (Xenial Xerus)

#144

Post by pavanky »

peatmoss wrote: post #125
stephenr wrote: post #61

Earlier quoted context omitted.

> No need for bash scripts Friends don't let friends write shell scripts targeting bash. For context: Bash is not available|installed everywhere, and has some inter-version weirdness. Write clean, posix-compliant shell scripts (i.e. target /bin/sh commonly referred to as bourne shell) and you're in a much better position. On Debian your script will be run by Dash, on OS X it will be run by Bash, on Ubuntu or RedHat i…

You're getting downvoted to oblivion, but I'm old enough to remember not being able to take bash for granted. The default shell on some modern systems (OpenBSD for example) comes to mind as well. I feel this battle has mostly been lost, however.

Default on debian is dash.

Re: Ubuntu 16.04 (Xenial Xerus)

#145

Post by chippy »

From some sources, I've heard that it appears that those with AMD graphics will suffer a downgrade in performance until the point release in June. I think by June, the open source AMD drivers should be up to speed or have the same features as the previous flgrx ones. From what I gather it's more like a downgrade in supported features.

I think this is just an issue if you are doing 3D graphics work or gaming.

Re: Ubuntu 16.04 (Xenial Xerus)

#147

Post by pkaye »

uuuuu wrote: post #47

Is an update from 14.04 painless or would you recommend reinstalling? I'd like some newer packages but don't really feel like setting up the whole system again with a reinstall.

I always wait a month before upgrading/reinstalling. I have done upgrades in the past through multiple versions and they generally go smoothly but there might a minor glitch or two that requires manual intervention to fix (usually solved though search google for advice.)

Another thing I've done is keep /home on a separate partition so I can nuke everything else for a clean install if needed. In such cases, I backup the /etc directory beforehand to recover configuration details as needed.

Re: Ubuntu 16.04 (Xenial Xerus)

#148

Post by bryanlarsen »

Rezo wrote: post #139
bryanlarsen wrote: post #135

Earlier quoted context omitted.

Is http2 supported on xenial now? It wasn't as of beta1 -- http2 was considered 'experimental' and wasn't included in the builds. We're using the PPA instead.

Xenial seems to include nginx 1.9.15 and OpenSSL 1.0.2, so it should fully support HTTP/2. Personally I would still use the official upstream nginx packages.

IIRC, xenial beta1 included nginx 1.9.12 with http2 explicitly disabled.

Re: Ubuntu 16.04 (Xenial Xerus)

#149

Post by abiox »

csense wrote: post #104

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has been severely compromised, with its weaknesses having been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially "cryptographically broken and unsuitable for further use". [1] [1]…

i thought the use of md5 here was just to check that your download wasn't damaged, by comparing your hash to theirs.

Re: Ubuntu 16.04 (Xenial Xerus)

#150

Post by jandrese »

criddell wrote: post #67
creshal wrote: post #25

Earlier quoted context omitted.

> I love the part about simplifying packaging via 'snap'. Bleargh. More container bullshit, now with even less control over it by end users. Now each tiny library update (think OpenSSL security fixes) will pull hundreds of "snaps" instead of a single package… assuming the developers even realize they have to rebuild their snaps.

> Now each tiny library update (think OpenSSL security fixes) will pull hundreds of "snaps" Do you think that's worse than the alternative where each tiny (shared) library update potentially breaks hundreds of programs?

While that potential was always there (and people were paranoid about it), in real life it was extremely rare. ABIs don't tend to change much between minor versions on sane libraries. I can't remember it ever happening to me.
Post reply on HN