Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Mint downloads (briefly) compromised

lwn.net

Post reply on HN
Print view View original

151–160 of 236 posts

Re: Linux Mint downloads (briefly) compromised

#151

Post by JBReefer »

sokoloff wrote: post #89
mintplant wrote: post #49

Earlier quoted context omitted.

The linked page is actually a comment on an LWN article with that title. Changing the submission title to that wouldn't reflect the content being highlighted here.

I don't want to have a lengthy meta-discussion about titles, but as someone who is not in the mint community (either one), the HTML page title of the comment thread linked is more informative than the editorialized-by-excerpting text from the comment body.

But I don't know how much you can trust Canonical these days to not fuck things up on a whim.

Re: Linux Mint downloads (briefly) compromised

#152

Post by verbatim »

onlycommenting wrote: post #6

There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast. There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be…

Distributions manage the namespace of executables. Well, they're supposed to anyway... that's much of the complaint here about Linux Mint.

In Fedora (and most distros), programs with an executable name overlapping another program will be renamed to a unique name as part of the distro packaging. (Putting aside programs intentionally named the same thing because they provide the same function, which are managed differently via "alternatives".)

This puts some implicit pressure on creators of software to not reuse names that are already in use, which seems to work for the most part.

Re: Linux Mint downloads (briefly) compromised

#153

Post by zamalek »

onlycommenting wrote: post #6

There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast. There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be…

> unusable by hijacking it's name space

That's not what was exactly written but is illuminating none-the-less (the original quote only says "name," which is a very different thing to "namespace"). Why do package managers have a single namespace to begin with? I should be able to install packages regardless of name conflicts, by using a namespace, e.g.

    $> apt-get install mdm
    Found org.debian.mdm and com.linuxmint.mdm.
    $> apt-get install com.linuxmint.mdm
    $> apt-get install org.debian.mdm
There's obviously the chance for a file system conflict, but the package manager should be able to keep track of that for you and abort if it would occur (or allow you to install it to a different prefix).

It's incredibly naive to believe that name conflicts would never occur, especially with the 3-letter acronyms/contractions that are so prevalent in Unix. I'd pin the blame this specific problem squarely on Debian, it shouldn't be happening in the first place.

Re: Linux Mint downloads (briefly) compromised

#154

Post by rincebrain »

moonchrome wrote: post #149
zwarag wrote: post #63

Earlier quoted context omitted.

Fedora has come a long way from where it came from. It is much better then it used to be and has become really fast, secure, and yes: user-friendly. I use Fedora @work and Ubuntu @home. The reason I use Ubuntu @home is that my roommates run Ubuntu too and we get all the same Versions on whatever software. But @work I run Fedora. There aren't any particular reasons except that it just "feels" better to work on that on…

Ubuntu is just too dated for development work IMO - I need to rebuild everything from source or find 3rd party PPA for anything remotely recent - I'm fine with compiling deps for production but for development the distro really shouldn't be getting in my way of trying new stuff out. That said I've had many performance issues on GNOME - I like the way it looks and the "feel" and I got used to the UI over the last year…

LTS or the other versions?

Any distro with a release schedule is going to have caveats about not having prebuilt packages for the latest XYZ. The only things I can think of that might give you a faster update schedule than Ubuntu (in terms of newer versions, not just point releases) would be Fedora, Arch, or Gentoo.

Re: Linux Mint downloads (briefly) compromised

#155

Post by hayleox »

smt88 wrote: post #53
mschuster91 wrote: post #41

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Seriously, with the rotten-ness of the US patent/copyright/political system, it's better for mankind to just say "ok, US users ca…

> "ok, US users can't get this, but everyone else can" Setting aside for a minute that this isn't possible, it's like saying you won't release your app on iOS because of Apple's walled gardens. Sure, the walls suck, but the users inside are numerous and spend lots of money. Most product creators don't have the option to exclude US users.

To be quite honest, I wish a lot of app developers _would_ do that, and then maybe Apple would loosen up a bit.

Re: Linux Mint downloads (briefly) compromised

#156

Post by riquito »

rplnt wrote: post #144
purpled_haze wrote: post #40

Earlier quoted context omitted.

I'm curious- what do you think of Fedora? It's in the top 5 distros along with OpenSUSE, Ubuntu, Debian, and Mint, and yet I hardly ever hear people talk about it. I had personally given up on Fedora years ago, but recently was told I should give it a second look and I've not had time to try it out.

There are two huge disadvantages why I wouldn't recommend it to everyone (though I use it myself): 1) strict licensing restrictions - lots of basic functionality/software missing from official repositories; there is rpmfusion of course, but that's not something my mom should know how to install 2) Very short support. You'll be stuck without updates in no time, and upgrading to possibly broken release (that might radi…

> 2) Very short support. You'll be stuck without updates in no time, and upgrading to possibly broken release (that might radically change things) every few months is ridiculous.

New releases are out after around 6 months. If you find release upgrades risky you can always wait a whole year and stay one release behind (any bug would have been ironed out in that time).

I usually don't update in the first couple weeks and I hadn't any problem with a Fedora upgrade in the last two/three years.

Re: Linux Mint downloads (briefly) compromised

#157

Post by mayhew »

kedean wrote: post #139
DonHopkins wrote: post #119

Earlier quoted context omitted.

How bad must desktop Linux in general be, if people are so busy rejoicing about a volume icon that works, that they accept poor security?

They mean from a usability perspective. Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks. It's like a tiny music player in your task bar. That said, no it should not excuse poor security.

> Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks.

GNOME and Unity also have that, probably KDE too.

Re: Linux Mint downloads (briefly) compromised

#158

Post by citizensixteen »

viperscape wrote: post #86
jnbiche wrote: post #21

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age.…

Have you given Arch a try yet? Their are also some family friendly projects like Antergos. Arch wiki is my all time favorite for great documentation, even when not using arch, go figure.

I have just installed Manjaro and find it to be fast, stable and easy to use.

Re: Linux Mint downloads (briefly) compromised

#159

Post by jmnicolas »

jnbiche wrote: post #37
ouiyaaa wrote: post #30

People I understand your criticism, but may I suggest donating to them too if you've used Mint? Once his bills are paid off, maybe he'll spend more time worrying about Mint?

Speaking for myself, I have donated multiple times to Mint. > Once his bills are paid off What bills are you talking about? As a result of this incident?

I think he means that he has a job and Mint devs on Mint in his free time.

Re: Linux Mint downloads (briefly) compromised

#160

Post by lucb1e »

kuschkufan wrote: post #145
geostyx wrote: post #128

I've been using Mint for the past month or so, should I be using something else?

Given the grave lapses that are described here, I hope it's obvious to you that absolutely yes, you should be using something else. I'll guess that Ubuntu might be your cup of tea.

"Obvious"? Now you are turning criticism from the thread into FUD. I used mint for a long time and really liked it. By issue with it was twofold: old packages and non-rolling release. But if those are not immediate concerns, I'd still recommend it to anyone wanting to try Linux.
Post reply on HN