Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

Post reply on HN
Print view View original

121–130 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#121

Post by sontek »

astrange wrote: post #10
gambiting wrote: post #7

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues.

Its not an X11 problem.

- https://bit.ly/3o2qekz

- https://bit.ly/38Y6pGO

(using bit.ly because he gives a testicle if referrer is HN :P)

Re: Kids find a security flaw in Linux Mint by mashing keys

#122

Post by nic_wilson »

sontek wrote: post #121
astrange wrote: post #10

Earlier quoted context omitted.

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

To others, you'll definitely still want to copy paste that URL into a new tab rather than clicking directly. :~)

Re: Kids find a security flaw in Linux Mint by mashing keys

#123

Post by mhh__ »

cuillevel3 wrote: post #110
mhh__ wrote: post #95

Unless there's something unbelievably wacky going on, this is why people use formal verification. If you can describe your program as a state machine, you can ask an SMT solver to find any transitions that break stuff. Unfortunately it's a lot harder to do for software than hardware because of the plasticity people expect from the former, but works it was it's really nice.

Right .... Start kiosk mode fullscreen app as a lock screen -> if app exits -> show desktop

The inputs cause the transitions, but it depends on if you can encode the states granularly enough to be invalid.

Re: Kids find a security flaw in Linux Mint by mashing keys

#124

Post by joshspankit »

My own anecdote:

My daughter was 1ish at the time, and I sat her down while I grabbed something from the fridge. Windows 98, locked. When I came back the screensaver was on, the password dialog was still up, but the desktop was fully functional in front of it. I could navigate, open applications, and everything else.

Still no idea how she did it, but that’s not the first or last time she surprised me :)

Re: Kids find a security flaw in Linux Mint by mashing keys

#125

Post by michaelcampbell »

Haemm0r wrote: post #53
herpderperator wrote: post #13

In middle school long ago, I was using one of the library search computers. They ran Windows XP and were locked down to the point where you couldn't open anything except the software that was running and you had no access to the desktop. One day I was rapidly mashing the "Search" button in the native book-searching software they were using - for no reason at all - and it suddenly opened an Explorer window out of nowh…

Classic thing was to write file:///C:\ (or something similar, I do not remember it anymore) on computers with only kiosk mode IE on them to access the local file system. :)

In the early web days, I had a public facing web site with a link that said "I can see what's on your computer", and the href was essentially what you posted.

The number of emails I got from that was worth the vitriol contained in them, including threatened lawsuits.

Re: Kids find a security flaw in Linux Mint by mashing keys

#126

Post by metafunctor »

sontek wrote: post #121
astrange wrote: post #10

Earlier quoted context omitted.

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

I don't understand the part about JWZ's testicles, so here are the links without bit.ly tracking for those whose ad blockers don't allow them:

- https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition/

- https://www.jwz.org/xscreensaver/toolkits.html

[Edit]: I understand now. My browser doesn't send referrer URLs, and I think that's the real fix instead of using something like bit.ly!

Re: Kids find a security flaw in Linux Mint by mashing keys

#127

Post by GekkePrutser »

Tsiklon wrote: post #33
boblivion wrote: post #23

Earlier quoted context omitted.

https://www.jwz.org/xscreensaver/toolkits.html Good post on the topic

Judging by the redirect to the image macro of a testicle in an egg cup, specifically calling out HN, I think we can assume the author of that article does not appreciate links to his website from HN

So what. This is how the web works. If you don't want people linking to you, don't have a website. He puts this blog out there for people to read, is it so weird that tech sites like HN would want to link to it?

And really if you're being DDoSed by a small thing like HN comment links you really have to up your game :) Wait till you get featured on reddit (previously called slashdotting when slashdot was still a big thing).

Re: Kids find a security flaw in Linux Mint by mashing keys

#128

Post by gambiting »

metafunctor wrote: post #126
sontek wrote: post #121

Earlier quoted context omitted.

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

I don't understand the part about JWZ's testicles, so here are the links without bit.ly tracking for those whose ad blockers don't allow them: - https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition/ - https://www.jwz.org/xscreensaver/toolkits.html [Edit]: I understand now. My browser doesn't send referrer URLs, and I think that's the real fix instead of using something like bit.ly!

You still get the testicles if you click this link, at least using Chrome you do. It's because the referrer field is set to HN so they know where the traffic is coming from.

Re: Kids find a security flaw in Linux Mint by mashing keys

#129

Post by Aulig »

MrDresden wrote: post #93
segfaultbuserr wrote: post #24

Earlier quoted context omitted.

People have been fuzzing user interfaces since the 80s. It was used for developing MacPaint and MacWrite in Apple's original Macintosh. Quote Wikipedia: > In 1983, Steve Capps at Apple developed "The Monkey", a tool that would generate random inputs for classic Mac OS applications, such as MacPaint [0]. The figurative "monkey" refers to the infinite monkey theorem which states that a monkey hitting keys at random on…

I frequently use the monkey bundled with the Android tool chain[0] to stress test my UIs. Have found numerous issues throughout the years by using it [0] https://developer.android.com/studio/test/monkey

That's really cool, I never knew about that. I'll have to try it on my apps!

Re: Kids find a security flaw in Linux Mint by mashing keys

#130

Post by eznzt »

canofbars wrote: post #59
josefx wrote: post #55

Earlier quoted context omitted.

Other commenters link to similar issues with Wayland screen lockers. So I am not sure how the current shiny fixes things. > python 2 In contrast to Wayland that can be installed in parallel to python 3. So the only reason to remove it is if you enjoy breaking working software.

Its not that they still had python 2, its that the binary "python" referred to python 2 on ubuntu (it might even still be like this) while other distros had it pointed to python 3.

It's complicated: https://lwn.net/Articles/780737/
Post reply on HN