Ubuntu 16.04 (Xenial Xerus)

Post by Analemma_ » Thu, Apr 21, 2016, 3:27 PM UTC

maaku wrote: post #170

avar wrote: post #124

Earlier quoted context omitted.

You're conflating collision attacks like the Flame malware with a preimage attack that would be necessary to produce a malicious Ubuntu release with the same MD5SUM. I.e. what's "broken" about MD5 is if you have a lot of CPU time and I allow you to give me two unrelated blobs, you can craft those blobs to have the same MD5 sum. What's not "broken" (beyond a theoretical 2^123.4 attack) with MD5 and not broken at all f…

Collision attacks matter if you don't (want to) trust the Ubuntu release team.

Post by nickodell » Thu, Apr 21, 2016, 3:28 PM UTC

avar wrote: post #124

csense wrote: post #104

They should just stop publishing MD5SUMS for new releases. By now, everybody should have gotten the word that MD5 has been broken. The security of the MD5 has been severely compromised, with its weaknesses having been exploited in the field, most infamously by the Flame malware in 2012. The CMU Software Engineering Institute considers MD5 essentially "cryptographically broken and unsuitable for further use". [1] [1]…

You're conflating collision attacks like the Flame malware with a preimage attack that would be necessary to produce a malicious Ubuntu release with the same MD5SUM. I.e. what's "broken" about MD5 is if you have a lot of CPU time and I allow you to give me two unrelated blobs, you can craft those blobs to have the same MD5 sum. What's not "broken" (beyond a theoretical 2^123.4 attack) with MD5 and not broken at all f…

Post by kps » Thu, Apr 21, 2016, 3:32 PM UTC

stephenr wrote: post #61

nailer wrote: post #19

For anyone packaging software on Linux, this now means every major distro - Debian, RHEL/CentOS, Arch and now Ubuntu - supports .service files. No need for bash scripts, custom watchdog and daemonise tools, etc.

> No need for bash scripts Friends don't let friends write shell scripts targeting bash. For context: Bash is not available|installed everywhere, and has some inter-version weirdness. Write clean, posix-compliant shell scripts (i.e. target /bin/sh commonly referred to as bourne shell) and you're in a much better position. On Debian your script will be run by Dash, on OS X it will be run by Bash, on Ubuntu or RedHat i…

Post by oblio » Thu, Apr 21, 2016, 3:37 PM UTC

stegosaurus wrote: post #85

themodelplumber wrote: post #42

Earlier quoted context omitted.

Curious what you want to remove in Windows 10. Not an evangelist, just set it up on a dual-boot refurb for a friend and thought the initial experience wasn't bad.

My experience of Windows 10 is limited to having a look at it in local computer shops (I've been trying to find a decent cheap laptop to stick Linux on for a friend). I clicked the Start Menu. Fully half of it was made up of flashing animated crap - things moving about, very colourful adverts, the actual things I wanted to do were obscured by it. I tried a few machines. They did the same thing. Maybe it's a manufactu…

Post by Thaxll » Thu, Apr 21, 2016, 3:46 PM UTC

Rezo wrote: post #121

PSA: If you're running a HTTP/2 server like NGINX on the 14.04 LTS you'll want to upgrade to this release. Google Chrome will no longer support HTTP/2 on vanilla 14.04 after May 15th [0], even if you're using the latest official upstream NGINX packages. This is because 14.04 ships with a version of OpenSSL that does not support the ALPN extension (prior to OpenSSL 1.0.2 you're limited to NPN, now deprecated). There w…