Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

101–110 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#101
post #94

For everyone linking the JWZ "I Told You So" post, the devs are aware of it and posted a response in the GitHub issue. I encourage everyone to read their side of the issue: https://github.com/linuxmint/cinnamon-screensaver/issues/354...

What context? Reading that issue, the content seems to be:

1: jwz says if you add accessibility features to a text box, make sure they don't have any bugs that can kill a process, since that will break screen lockers

2: Cinnamon adds a buggy accessibility feature to a text box that lets you crash the screen locker

3: Github user clefebvre says something along the lines of "why is jwz being so negative >:("

Well... you did exactly what he told you not to do. If you're going to add accessibility features to a text box, you need to not screw it up. If you screw it up, then it breaks the screen locker for every user in the world, including the 99% of people who will never use the accessibility features.

If you make an obvious, stupid mistake, people will make fun of you. Complaining that people are making fun of you won't do much. Try, instead, to not make the obvious stupid mistake?

From the issue:

>With that said, I have on message for JWZ. Don't be that guy. It's too easy to just tell people no to cross the street. Work with us on building that safest path.

Huh? What? He wrote xscreensaver 20 years ago. He's supposed to fix buggy code written by other people until he dies?

Why is it his responsibility to fix your code? The distro extended his program, the extension broke. You can either ignore the problem, remove the extension, or fix the extension. None of these things sounds like xscreensaver's problem!

Re: Kids find a security flaw in Linux Mint by mashing keys

#103

Earlier quoted context omitted.

X11 design flaws you say? https://github.com/swaywm/swaylock/issues/162 https://github.com/swaywm/swaylock/issues/158 https://github.com/swaywm/swaylock/issues/10

I’m not familiar with the details of the design flaw and whether or not Wayland fixes it, but those links don’t contradict this being an X-specific design flaw. I get the impression that swaylock is a direct port of i3lock, and thus stands a fair chance of being written and architected in an X style, rather than taking advantage of any superior form that Wayland may support but X didn’t. Expressed otherwise: just bec…

I think they're simply saying that lock screens are hard to get right and that shitting on x11 at every chance you get doesn't help anything.

Re: Kids find a security flaw in Linux Mint by mashing keys

#104
post #64

Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…

[deleted]

Re: Kids find a security flaw in Linux Mint by mashing keys

#105
post #44

Earlier quoted context omitted.

Oh, so Wayland is finally ready to replace X11?

Whether wayland is ready for you basically comes down to 2 questions: * Do you use a nvidia GPU * Do you need to screen share from electron or other x11 only applications (MS teams, etc) Its ready if you said no to both of those.

> Do you need to screen share from electron or other x11 only applications

Doesn't XWayland solve this?

Re: Kids find a security flaw in Linux Mint by mashing keys

#106
post #64

Mi kid got around the lock screen of my mac. Twice. It was 4-5 years ago when he was about 2. I had a 15+ character random password (a generated one including symbols etc) so the chances of him being lucky were rather slim. He was just mashing button on the lock screen for less than a minute when boom, I was suddenly signed in. The first time I thought it was a fluke. Then it happened again after a couple of months.…

Probably just hit enter when the password field was empty. For some reason that bypassed all security on OS X.

You used to be able to just open up recovery mode and reset the password anyway, passwords on OS X used to be a theatre. No idea about it now though.

Re: Kids find a security flaw in Linux Mint by mashing keys

#107

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

Slock is good.

Re: Kids find a security flaw in Linux Mint by mashing keys

#108
post #56

Earlier quoted context omitted.

Make sure your browser sends in the Referer header. Otherwise, this is the image that gets displayed: NSFW. This is a testicle in an egg cup. https://cdn.jwz.org/images/2016/hn.png

Thank you! I'm using plain Safari with no extensions. An interesting website and blog, I like it! I wonder what their problem with HN is, although I don't mind being a testicle!

Jamie wrote xscreensaver...

Re: Kids find a security flaw in Linux Mint by mashing keys

#109
post #30

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

For x lockscreens this is solved by making sure the lock launches _before_ the system is suspended, I'm not sure how many distros do it like that though.

slock & pm-suspend.

Re: Kids find a security flaw in Linux Mint by mashing keys

#110
post #95

Unless there's something unbelievably wacky going on, this is why people use formal verification. If you can describe your program as a state machine, you can ask an SMT solver to find any transitions that break stuff. Unfortunately it's a lot harder to do for software than hardware because of the plasticity people expect from the former, but works it was it's really nice.

Right ....

Start kiosk mode fullscreen app as a lock screen -> if app exits -> show desktop

Post reply on HN