Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

241–250 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#241
post #216

Earlier quoted context omitted.

It's quite nice of Apple to strip this by default in Safari—didn't even realize it was a thing until I switched over to Chrome to see what you were talking about.

I didn't see it in mobile Chrome (well, Brave) but I kind of want to...

It's this: https://cdn.jwz.org/images/2016/hn.png

Re: Kids find a security flaw in Linux Mint by mashing keys

#242

Earlier quoted context omitted.

jwz has a lot to say about complex graphical toolkits/desktop environments and their complex locking mechanisms. It's an interesting series of posts. If you are not running xscreensaver on Linux, then it is safe to assume that your screen does not lock. Once is happenstance. Twice is coincidence. Three times is enemy action. Four times is Official GNOME Policy. https://www.jwz.org/xscreensaver/toolkits.html

I would recommend not linking to jwz's website. Use web archive or something if you have to. jwz dislikes Hacker News and intentionally shows an NSFW image when Referer header shows Hacker News.

> .. jwz dislikes Hacker News ..

Why, what's the back story?

Re: Kids find a security flaw in Linux Mint by mashing keys

#243

Earlier quoted context omitted.

What's your take on the issues listed by formerly_proven[0]? 0: https://news.ycombinator.com/item?id=25844338

I'll edit it to (for me). With working on an X11 desktop everyday, it felt like everyone has at least once experienced such an issue. To be fair to swaylock, they actually fixed some of those issues, in contrast to kscreenlocker which are just ignoring most edge-case bugs, because it's nearly impossible to fix them.

It's still a fundamentally flawed design, because the system fails open when the locker crashes. So it seems Sway / Wayland actually didn't learn anything in this area, and suffers from exactly the same problem as X11 when it comes to the lockscreen.

Re: Kids find a security flaw in Linux Mint by mashing keys

#244

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

This is a good lesson in "failing open" vs "failing closed"

Re: Kids find a security flaw in Linux Mint by mashing keys

#246

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

Interestingly, there is a race condition in GNOME lock screen which sometimes blocks sleep until unlocking.

Re: Kids find a security flaw in Linux Mint by mashing keys

#247

Earlier quoted context omitted.

Can he at least update the text? HN was full of entrepreneurs and wantrepreneurs years ago. It is mostly big- and mid tech employees now, tech bureaucrats if you will.

Not to belabor the meta discussion, but your comment sparked a question. If it is how you say, and using a politico-economic lens, I wonder if there has been any discernible shift in commenter attitudes as the demographics have changed. Specifically, if the shift was from entrepreneurs -> skilled wage workers, as you’ve asserted. The interests of the petit bourgeoisie (entrepreneurs, et al), the professional manageme…

This is OT, but I can't resist. I've been around HN since 2011, and tone has definitely shifted in the last 5-6 years. I used to stumble on HN posts that infuriated me relatively often, it was part of the deal (i.e. understanding how the self-appointed entrepreneurial classes actually rationalize certain things). That doesn't really happen anymore.

> those overlaps would probably translate to some overarching strains of belief, for example, the tendency toward libertarian viewpoints

The opposite is actually true, in my experience. Hardcore libertarian views on HN have been largely quashed into irrelevance, they only survive in lore. New commenters who join and expect HN to be a nest of hyper-capitalists are quickly downvoted into oblivion. Which is not a terrible thing in the great scheme of things, from the personal perspective of somebody who would likely dislike their point of view; but it has definitely taken something away from the HN experience, and possibly pushed some people towards worse (more radicalized) forums.

Re: Kids find a security flaw in Linux Mint by mashing keys

#248

Earlier quoted context omitted.

Whether wayland is ready for you basically comes down to 2 questions: * Do you use a nvidia GPU * Do you need to screen share from electron or other x11 only applications (MS teams, etc) Its ready if you said no to both of those.

I tried plasma-wayland on Arch a couple days ago. Log in, open firefox. Minimize the window, and the entire machine freezes. This is on an AMD GPU as well. Every time I try Wayland, whether it be sway on my laptop or plasma on my desktop, I run into snags that did not exist in X. So back to X I go. I'll switch to Wayland when it's ready "for real, actually, promise", and not a moment before. Maybe when Debian Stable…

Unfortunately the KDE wayland session is still somewhat unstable. GNOME's wayland session is farther along in this regard.

Re: Kids find a security flaw in Linux Mint by mashing keys

#249

Earlier quoted context omitted.

Never happened to me on Windows, so it shouldn't be that hard.

It happens to me on Windows 10 if I close the laptop lid to lock the desktop and send it to sleep. When I open it again, the desktop is accessible for a few seconds (sometimes long enough to launch programs) before the lock screen activates and I have to input my password. The workaround I use is to manually lock with Win+L before closing the lid.

Would you mind posting a video? I have never seen this occurring in any version of Windows.

Re: Kids find a security flaw in Linux Mint by mashing keys

#250

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

>I'm not sure why GNOME screensaver cannot do something like this.

This actually is fixed in upstream GNOME because the screensaver is now built into the shell. The problem here is exclusively with cinnamon-screensaver and other components derived from gnome-screensaver, which is unmaintained and upstream GNOME considers it obsolete.

Post reply on HN