Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A security update for the Raspberry Pi

raspberrypi.org

Post reply on HN
Print view View original

1–10 of 38 posts

Re: A security update for the Raspberry Pi

#2

Post by aq3cn »

TL;DR

> put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network.

I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information.

I hope running sudo apt-get update, notifies them of this critical change.

Re: A security update for the Raspberry Pi

#3

Post by Normal_gaussian »

aq3cn wrote: post #2

TL;DR > put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network. I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information. I hope running sudo apt-get update, notifies them…

SSH off by default is a change to the image, not an update through apt.

I am not sure if this is the case with the warning telling you that you are still using the default password.

Re: A security update for the Raspberry Pi

#5

Post by gacek »

aq3cn wrote: post #2

TL;DR > put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network. I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information. I hope running sudo apt-get update, notifies them…

As I understand the article, they've only modified the image used to deploy a fresh Raspbian, an update won't disable the ssh.

Re: A security update for the Raspberry Pi

#6

Post by alexellisuk »

aq3cn wrote: post #2

TL;DR > put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network. I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information. I hope running sudo apt-get update, notifies them…

Yes this ruins just about every Pi from scratch tutorial. The worst part is if this affects the "lite" distro which is headless. The beauty of using an image like Raspbian Lite was being able to flash, ssh (ip via DHCP), change password/hostname and done.

Re: A security update for the Raspberry Pi

#7

Post by jcriddle4 »

alexellisuk wrote: post #6
aq3cn wrote: post #2

TL;DR > put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network. I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information. I hope running sudo apt-get update, notifies them…

Yes this ruins just about every Pi from scratch tutorial. The worst part is if this affects the "lite" distro which is headless. The beauty of using an image like Raspbian Lite was being able to flash, ssh (ip via DHCP), change password/hostname and done.

Speaking from my own experience, google has a real problem with indexing out-dated material.

Re: A security update for the Raspberry Pi

#8

Post by aq3cn »

Normal_gaussian wrote: post #3
aq3cn wrote: post #2

TL;DR > put a file called ssh in the /boot/ directory with any content to enable SSH which we turned off by default to prevent unauthorized access of your devise in public network. I wonder how many people are going to scratch their head when their headless Raspberry Pi will be unable to connect to their laptop in same way as earlier without this piece of information. I hope running sudo apt-get update, notifies them…

SSH off by default is a change to the image, not an update through apt. I am not sure if this is the case with the warning telling you that you are still using the default password.

I don't run Raspbian OS in my device, so I cannot verify. But reading this created doubt in my mind.

> To update your existing Jessie image with all the bug fixes and these new security changes, type the following at the command line:

I think better implementation would be asking if one is running their device in public or private network and explaining the consequences while setting up for the first time. We are asked of same question when we connect to network for first time in Windows since last several versions. I am sure tutorials made previously will create lot of frustration among newcomers.

Post reply on HN