Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

181–190 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#181
post #178
post #133

Earlier quoted context omitted.

Time to switch to Firefox and give Google less data. Firefox doesn't seem to send the referrer :)

Hmmm. I think somebody is following this thread because I got testies using ff on linux by clicking the bitly links above.

haha, same. jwz really wants us to see the testes!

Re: Kids find a security flaw in Linux Mint by mashing keys

#182

Earlier quoted context omitted.

He doesn't think he's getting DDoSed from here. He doesn't respect anyone who comes from here. Nor should he, not least because the redirect reliably results in ~90% of comments in any thread where jwz is mentioned being about the testicle in the eggcup rather than anything substantial.

But he refers to DDoS specifically in his eggcup image :) PS: I have no idea what he means by "finance-obsessed"? I think the community at HN is tech-obsessed which is what I like about it. But finance? This is not yahoo finance or wherever all the finance guys hang out. It sounds more like he had a clash with someone specific on a finance-related issue and bases his view of the HN community on that. The eggcup is a…

"Finance obsessed" is a pretty accurate description of what's going on here. A huge number of people on this site have trouble understanding that there's a world outside of the Bay Area where rent isn't $3000+ a month, and that its possible run a company without involving venture capital and ballooning to multi-million dollar revenues in less than five years. Even the tech discussion here revolves around this stuff -- almost every thread has some mention of "scaling" even if what's being discussed is a niche product that will have a customer base of a few thousand people over its entire life.

I like this site a lot, but I have a lot of patience when it comes to deciphering what is being affected by the Software Hub City Reality Distortion Bubble. Some people don't, hence the eggcup testicle, and people that think something like that undermines the technical argument aren't thinking clearly enough to even debate the technical point with anyway.

Re: Kids find a security flaw in Linux Mint by mashing keys

#183
I find interesting that GNOME Screensaver's security depends on it to not crash.

Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process.

The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver will spawn kscreenlocker again but this time with software rendering (just in case it crashed due to graphics driver issue). If kscreenlocker crashes four times then KDE Session Management Server gives up, stops respawning kscreenlocker and simply draws the following text on the screen.

  The screen locker is broken and unlocking is not possible anymore.
  In order to unlock switch to a virtual terminal (e.g. Ctrl+Alt+F2),
  log in and execute the command:
  
  loginctl unlock-session %1
  
  Afterwards switch back to the running session (Ctrl+Alt+F%2).
If ksmserver itself crashes then the entire session closes.

I'm not sure why GNOME screensaver cannot do something like this. Lock screen crashing seems like something inevitable (especially considering buggy graphic card drivers and so on), and it makes sense to prepare for it so that crashes won't bypass the screen locker.

Re: Kids find a security flaw in Linux Mint by mashing keys

#184

Earlier quoted context omitted.

Are you sure it was a segfault? DOS did not have any memory protection, so segfault would be impossible. Or maybe you used some protected mode DOS extender?

What happens if you try to read from a null pointer in DOS?

You get what is at 0x0000 ?

Re: Kids find a security flaw in Linux Mint by mashing keys

#185

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

That does sound much more sane.

Re: Kids find a security flaw in Linux Mint by mashing keys

#186

Earlier quoted context omitted.

Are you sure it was a segfault? DOS did not have any memory protection, so segfault would be impossible. Or maybe you used some protected mode DOS extender?

What happens if you try to read from a null pointer in DOS?

I haven't actually tried this, but based on my understanding of the MS-DOS memory model it should read the contents of memory at address 0.

Re: Kids find a security flaw in Linux Mint by mashing keys

#189
post #186

Earlier quoted context omitted.

What happens if you try to read from a null pointer in DOS?

I haven't actually tried this, but based on my understanding of the MS-DOS memory model it should read the contents of memory at address 0.

This is correct, and address 0 is the start address of the interrupt vector table, so there are good reasons why you might read from it.

Re: Kids find a security flaw in Linux Mint by mashing keys

#190
post #153

Earlier quoted context omitted.

Xscreensaver has crashed twice in my life and opened the desktop. That's still a good statistic but it may have crashed because of the animation.

Sounds like you were probably using gnome-screensaver or some of the many other poorly written alternatives like cinnamon that do this. I don't believe there is any way for xscreensaver to unlock the desktop even if it does crash

Incorrect. It’s a limitation of X11 that if the screensaver daemon crashes, including xscreensaver, the desktop will be unlocked. See the JWZ links that are posted in this thread.
Post reply on HN