Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

Post reply on HN
Print view View original

171–180 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#171

Post by tehwebguy »

gambiting wrote: post #128
metafunctor wrote: post #126

Earlier quoted context omitted.

I don't understand the part about JWZ's testicles, so here are the links without bit.ly tracking for those whose ad blockers don't allow them: - https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition/ - https://www.jwz.org/xscreensaver/toolkits.html [Edit]: I understand now. My browser doesn't send referrer URLs, and I think that's the real fix instead of using something like bit.ly!

You still get the testicles if you click this link, at least using Chrome you do. It's because the referrer field is set to HN so they know where the traffic is coming from.

In mobile Safari tap and hold, then tap the preview or the open button

Re: Kids find a security flaw in Linux Mint by mashing keys

#172

Post by throwanem »

GekkePrutser wrote: post #162
throwanem wrote: post #146

Earlier quoted context omitted.

He doesn't think he's getting DDoSed from here. He doesn't respect anyone who comes from here. Nor should he, not least because the redirect reliably results in ~90% of comments in any thread where jwz is mentioned being about the testicle in the eggcup rather than anything substantial.

But he refers to DDoS specifically in his eggcup image :) PS: I have no idea what he means by "finance-obsessed"? I think the community at HN is tech-obsessed which is what I like about it. But finance? This is not yahoo finance or wherever all the finance guys hang out. It sounds more like he had a clash with someone specific on a finance-related issue and bases his view of the HN community on that. The eggcup is a…

Venture capital is finance. So is cryptocurrency.

I don't know what prompted the redirect; it predates my awareness of Hacker News. I could guess, but why bother? The man has a nightclub to run, and I'm sure that's plenty all by itself to fill his days.

Re: Kids find a security flaw in Linux Mint by mashing keys

#173

Post by ohiovr »

metafunctor wrote: post #126
sontek wrote: post #121

Earlier quoted context omitted.

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

I don't understand the part about JWZ's testicles, so here are the links without bit.ly tracking for those whose ad blockers don't allow them: - https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition/ - https://www.jwz.org/xscreensaver/toolkits.html [Edit]: I understand now. My browser doesn't send referrer URLs, and I think that's the real fix instead of using something like bit.ly!

Does anyone know how to make this right? Would simply removing the mate-screen-saver package work?

Re: Kids find a security flaw in Linux Mint by mashing keys

#174

Post by [deleted] »

gambiting wrote: post #128
metafunctor wrote: post #126

Earlier quoted context omitted.

I don't understand the part about JWZ's testicles, so here are the links without bit.ly tracking for those whose ad blockers don't allow them: - https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition/ - https://www.jwz.org/xscreensaver/toolkits.html [Edit]: I understand now. My browser doesn't send referrer URLs, and I think that's the real fix instead of using something like bit.ly!

You still get the testicles if you click this link, at least using Chrome you do. It's because the referrer field is set to HN so they know where the traffic is coming from.

[deleted]

Re: Kids find a security flaw in Linux Mint by mashing keys

#175

Post by wernercd »

gambiting wrote: post #128
metafunctor wrote: post #126

Earlier quoted context omitted.

I don't understand the part about JWZ's testicles, so here are the links without bit.ly tracking for those whose ad blockers don't allow them: - https://www.jwz.org/blog/2021/01/i-told-you-so-2021-edition/ - https://www.jwz.org/xscreensaver/toolkits.html [Edit]: I understand now. My browser doesn't send referrer URLs, and I think that's the real fix instead of using something like bit.ly!

You still get the testicles if you click this link, at least using Chrome you do. It's because the referrer field is set to HN so they know where the traffic is coming from.

I'm using Chrome with uMatrix and uBlock Origin... I assume one of those blocks the data because, somehow strangely, I feel left out that all I'm getting is the websites.

I wonder why someone would setup a "bad result" for specific referrers ...

Re: Kids find a security flaw in Linux Mint by mashing keys

#176

Post by suyjuris »

kuter wrote: post #18

For anyone interested there is something called fuzzing that uses usually code coverage based heuristics to generate data to find bugs. For example LLVM's lib fuzzer uses instrumentation to track code coverage and mutates data to find invalid behaviour. https://llvm.org/docs/LibFuzzer.html It uses a compiler pass to insert code to branch points functions calls etc. I think it uses genetic algorithms to increase cover…

I have used AFL a few times casually in some personal projects, and it has always performed quite well for me. Of course, there are a lot of weird cornercases which would not occur on real-world (non-adversarial) inputs, but it also found some very real bugs.

(For example, I once wrote a hash table implementation where the insertion and resizing procedures had slightly different views on wraparound, causing failures on very specific inputs. Another time, I wrote some code to buffer out-of-order messages, which would only occur due to a race condition. It was wrong. Both times I had thought carefully about the code, and the bugs would have been painful to discover otherwise.)

Re: Kids find a security flaw in Linux Mint by mashing keys

#177

Post by arbitrage »

zadler wrote: post #164
datenwolf wrote: post #144

Earlier quoted context omitted.

It's not an X11 design flaw. The very concept of locking the screen is flawed. A flaw that also haunts Wayland, BTW. The concept of screen lockers is having a special layer, that can't be bypassed, which a locker creates. The whole security then hinges on the locker not crashing. X11 does have such a layer. Wayland compositors also implement it through such a layer. And for either the situation is, that if the locker…

It’s amazing to me that The most popular display managers on Linux have this flaw. Perhaps there is a workaround involving switching to another tty?

that's a really good point! your comment reminded me that that is what we used to do in the lab at university, a long time ago. switching to a different terminal, then locking that, was much more fool proof. perhaps not for security, but rather because X11 was so damned buggy and crashy, that you might need to have access to that terminal to get back into your workstation without forcing a reboot.

Re: Kids find a security flaw in Linux Mint by mashing keys

#178

Post by sgc »

ascar wrote: post #133
gambiting wrote: post #128

Earlier quoted context omitted.

You still get the testicles if you click this link, at least using Chrome you do. It's because the referrer field is set to HN so they know where the traffic is coming from.

Time to switch to Firefox and give Google less data. Firefox doesn't seem to send the referrer :)

Hmmm. I think somebody is following this thread because I got testies using ff on linux by clicking the bitly links above.

Re: Kids find a security flaw in Linux Mint by mashing keys

#179

Post by tachyonbeam »

BruiseLee wrote: post #159
mightybyte wrote: post #143

Years ago I taught a high school typing class in a K-12 school. The school didn't have the funds to get a commercial typing program so I wrote my own typing program. It evolved over time with features to help me track the students' progress etc. One day we had a school open house where all the parents could come to school. We had a bunch of different activities set up in different classrooms and I ended up getting as…

Are you sure it was a segfault? DOS did not have any memory protection, so segfault would be impossible. Or maybe you used some protected mode DOS extender?

What happens if you try to read from a null pointer in DOS?
Post reply on HN