Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus torvalds on security

plus.google.com

Post reply on HN
Print view View original

21–30 of 133 posts

Re: Linus torvalds on security

#21

Post by batista »

Duff wrote: post #13

He is wrong about date/time setting. Most computers have automatic time sync, and consistent time stamps are important for many business purposes. Giving end users the ability to manipulate time can cause significant issues. Is it overkill for Linus's kids? Yes. But OpenSUSE wasn't put together for his kids.

He is wrong about date/time setting. Most computers have automatic time sync, and consistent time stamps are important for many business purposes. Giving end users the ability to manipulate time can cause significant issues.

On a laptop? A seriously doubt it. Make the bloody distro learn to differentiate between a server and a personal installation, and change the settings accordingly.

Re: Linus torvalds on security

#22

Post by huhtenberg »

cpswan wrote: post #4

It's funny that some of the areas that he touches on are also things where Windows requires local admin. Clearly a messed up privileged action model seems to be common across OSes.

Don't get started on Windows. Just don't.

You know that UAC prompt you get when running setup.exe for an IM client? Ever wondered why there's an UAC prompt in the first place? Because Windows assumes that setup.exe needs admin privileges (unless .exe explicitly states that it doesn't). This piece of engineering doesn't even have a concept of ~/bin. In fact, there is/was an official W7 guideline that said that all programs must go into %ProgramFiles%, which is a system directory. Now, what sort of a imbecile decided that it's a good idea to let an underprivileged account install into a system directory - UAC or not - is beyond me. So, please, don't mix Windows in. While Linux distros have their dark moments, Windows is just one big service pack now.

Re: Linus torvalds on security

#23

Post by batista »

beatle wrote: post #19
alextgordon wrote: post #16

Earlier quoted context omitted.

I think you may have misread. > I first spent weeks arguing on a bugzilla that the security policy of requiring the root password for changing the timezone The time zone is a completely presentational setting, something that users can be expected to want to change every so often. And it has no relation to timestamps.

Changing time zones can fuck up a server application.

No, the server application should have it's own timezone setting, like almost any serious server has, and/or use UTC time.

And a distro must not assume you're using it for server applications, when you install a personal installation on your laptop.

Re: Linus torvalds on security

#24

Post by batista »

javert wrote: post #2

... please just kill yourself now I don't think someone who actually knows what it's like to experience suicidal thoughts would ever say something like that to people in a technical/professional context. There is something to be said for the "tough love" Linux culture, but IMO, language as extreme as what I just quoted is just not acceptable. For me, this is crossing the line from "Linus has an interesting and entert…

Actually, the above comment immediately tells me: "oh, another American, why can't the guys take a bloody joke, we're not all 9 year olds". It rarely is a French guy or a British complaining on such matters.

Re: Linus torvalds on security

#25

Post by beatle »

batista wrote: post #23
beatle wrote: post #19

Earlier quoted context omitted.

Changing time zones can fuck up a server application.

No, the server application should have it's own timezone setting, like almost any serious server has, and/or use UTC time. And a distro must not assume you're using it for server applications, when you install a personal installation on your laptop.

don't tell me. tell the linux developers who created the server application.

Re: Linus torvalds on security

#26

Post by batista »

javert wrote: post #11
lurker17 wrote: post #8

Earlier quoted context omitted.

It's the same in US English. The issue is just that there are 1-10% of people who are sensitive to the issue, and computing has grown from a small club of close friends/enemies/frenemies to a more mainstream activity, there is a growing call for being more welcoming and "politicallyy correct" tone in conversation. For example, on the official Mozilla Bugzilla, diverting from technical debate to non-technical vitrioli…

I think this is quite different from "political correctness" as the term is typically used, which is regarding issues of gender, ethnicity, political opinion, etc. It's the same in US English I don't agree. I've never thought of it before, but to be honest, in my 25 years of life, I've never seen the kind of behavior Linus is famous for on the part of anyone besides Europeans. (Most of whom, I should add, do not appe…

I don't agree. I've never thought of it before, but to be honest, in my 25 years of life, I've never seen the kind of behavior Linus is famous for on the part of anyone besides Europeans.

Really? Does Lenny Bruce qualify? How about Dennis Leary? (Well, he is of Irish descent, I'll give you that).

Hani Suleiman, of the Bile Blog fame?

http://javablogs.com/views/ViewBlog.action?id=11454

Definitely not a European.

How about The Filty Critic?

http://www.bigempire.com/filthy/

And don't get me started on Hunter S. Thompson and co.

[EDIT] Fk, how could I forget Maddox and the "Best Page in the Universe": http://maddox.xmission.com/

Re: Linus torvalds on security

#27

Post by viraptor »

It really depends on the context / configuration (or at least should depend on). Imagine a host available to public at a library. Considering that people can come there to print out some sensitive documents, you don't want to allow normal users to change printer settings. Someone could remove the default one and set up a tunnel through his own host, capturing all documents on the wire before they hit the printer. Very similar situation exists for the WiFi networks.

Of course this doesn't make any sense on a laptop. But it doesn't look like there's any sane default. You need to choose your configuration properly and that's it. If OpenSUSE doesn't allow it, then yes... that's a bug.

Re: Linus torvalds on security

#28

Post by batista »

Iulian wrote: post #6

The real problem is the `MacBook Air`, not security...

Really? How so? Because the MacBook Air has nothing to do with the issue at hand, and it is by Linux admission the best laptop for him (from the thread: "Trust me, I tried. Nothing better exists. It's sad. They are all big and clunky").

Re: Linus torvalds on security

#29

Post by Wilya »

beatle wrote: post #19
alextgordon wrote: post #16

Earlier quoted context omitted.

I think you may have misread. > I first spent weeks arguing on a bugzilla that the security policy of requiring the root password for changing the timezone The time zone is a completely presentational setting, something that users can be expected to want to change every so often. And it has no relation to timestamps.

Changing time zones can fuck up a server application.

Time zone setting can (and should) be a user-specific setting.

Since a server application most likely isn't running as a the same user as the "real" logged-in user, there's no reason anything bad would happen.

Re: Linus torvalds on security

#30

Post by beatle »

Wilya wrote: post #29
beatle wrote: post #19

Earlier quoted context omitted.

Changing time zones can fuck up a server application.

Time zone setting can (and should) be a user-specific setting. Since a server application most likely isn't running as a the same user as the "real" logged-in user, there's no reason anything bad would happen.

CAN and SHOULD. but it's NOT.
Post reply on HN