Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

jatan.blog

Post reply on HN
Print view View original

591–600 of 645 posts

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#591

Post by lucb1e »

SahAssar wrote: post #584
lucb1e wrote: post #453

Earlier quoted context omitted.

> apt is typically delivered over HTTP This is a large misunderstanding of how it works. You can't MITM millions of servers around the world just because they use HTTP for downloading their apt archives. It verifies the cryptographic signatures. That's why you need to "apt-key add" when you add a custom repository. It doesn't rely on the transport method for integrity. > [Typo-squatting] is already possible with ever…

> This is a large misunderstanding of how it works. You can't MITM millions of servers around the world just because they use HTTP for downloading their apt archives. Actually, a bug allowing exactly that was in the last 3 ubuntu LTS versions: https://justi.cz/security/2019/01/22/apt-rce.html https://usn.ubuntu.com/3863-1/ If they used HTTPS then an attacker would have to control the mirror instead of being able to p…

I wasn't aware that plain http was what made that attack practical, that's good to know. And while not disagreeing with your point, I meant that it isn't supposed to be interceptable despite being plain text, due to the integrity check, so it isn't inherently insecure, just (significantly?) less hardened than if it would use https only.

For the 'which software is installed' argument (confidentiality in addition to integrity), I agreed but your first link actually argues this:

> the privacy gains [of using https] are minimal, because the sizes of packages are well-known

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#592

Post by lucb1e »

Macha wrote: post #494
lucb1e wrote: post #391

Earlier quoted context omitted.

The browser is actually the number one component you should update as soon as a security fix comes out. If you don't want new features ("more free stuff!"), use an LTS version that only includes the security updates?

You can note the version everyone is complaining about here _is_ the LTS.

You mean the Ubuntu LTS, I meant a browser's LTS version (a sibling comment just mentioned it's called ESR in Firefox instead of LTS... I meant the concept, not the specific name for Firefox, but my bad) so that you don't keep getting browser feature updates but only get the backported fixes.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#593

Post by jplayer01 »

trianglem wrote: post #477
jplayer01 wrote: post #442

Earlier quoted context omitted.

The concern is that there's no simple way to disable auto-updates. If you want Ubuntu to turn into Windows, why not just use Windows?

Because there are so many different Linux distorts out there. I feel like at least one of them should be as newb friendly as possible.

That doesn't answer why it's okay to not give an option for advanced users. Even they want to use Ubuntu.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#596

Post by znpy »

eikenberry wrote: post #364
znpy wrote: post #348

Earlier quoted context omitted.

You might want to consider jumping ship and go into the RHEL/CentOS world. Stability and predictability is their main strenght. Each release is supported for a veeeeery long time.

Stability and predictability of the core OS. But then everyone uses EPEL for everything else which throws that all out the window.

Uhm, yes and no.

I mean... As long as you don't use EPEL, stability and predictability are pretty much granted.

I've been using epel on some machine and haven't had that many problems, though.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#597

Post by yyyk »

lucb1e wrote: post #408
ChrisSD wrote: post #145

Earlier quoted context omitted.

Be aware that Testing may get security updates much later than Unstable or Stable. https://www.debian.org/security/faq#testing

Does that actually happen in practice though? And as for the severity, we're talking desktops so the most critical piece of software is the browser. Firefox is the only piece of software I download outside of the repositories to make sure the updates come directly from the source, but other than that, openssh very rarely has serious vulnerabilities, to attack Thunderbird you'd already need to mitm my traffic... it's…

Firefox is a rather good example - the update to Firefox esr 68 (from esr 60) came far later in testing than either unstable or stable.

Given that some trigger happy devs remove support from old versions as soon as they leave support, this can directly affect browsing experience.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#598

Post by koheripbal »

littlethrowaway wrote: post #541
geek_at wrote: post #293

Earlier quoted context omitted.

only if you install your server applications using snap

So, why are people getting upset about this then? If you can simply just _not use snaps_?

I'm guessing it's not an option when using the GUI?

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#599

Post by thejsa »

macintux wrote: post #525
MereInterest wrote: post #279

Earlier quoted context omitted.

My first experience with systemd was when they implemented a default that would kill processes when a user logs off. This may be acceptable in some single-user desktop environments, but it is absolutely unacceptable in any server environment. If I am using tmux, emacs --daemon, nohup, or any other custom program that catches SIGHUP, then it is inexcusable for systemd to escalate to sending SIGKILL. I know that there…

> ... they implemented a default that would kill processes when a user logs off Is that still the default? That’s horrific.

It doesn’t seem to do that on my Ubuntu 18.04 / 20.04 servers; I haven’t tried on desktop though as I don’t use Ubuntu there, would indeed be a huge violation of my expectations of how a system should work if so.

Re: Ubuntu 20.04 LTS’ snap obsession has snapped me off of it

#600

Post by MereInterest »

macintux wrote: post #525
MereInterest wrote: post #279

Earlier quoted context omitted.

My first experience with systemd was when they implemented a default that would kill processes when a user logs off. This may be acceptable in some single-user desktop environments, but it is absolutely unacceptable in any server environment. If I am using tmux, emacs --daemon, nohup, or any other custom program that catches SIGHUP, then it is inexcusable for systemd to escalate to sending SIGKILL. I know that there…

> ... they implemented a default that would kill processes when a user logs off Is that still the default? That’s horrific.

As of this thread [1] in January 2019, yes. The user poettering is Lennart Poettering, the original Creator and lead developer of systemd, and doesn't show any signs of coming to the light.

At this point, my standard .bashrc includes a check of whether systemd is running, and whether this absurd setting is set, so at least I will get some warning, and can either fix it or complain to the sysadmin.

[1] https://news.ycombinator.com/item?id=19023232

Post reply on HN