Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

Post reply on HN
Print view View original

301–310 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#301

Post by robocat »

globular-toast wrote: post #166
AnIdiotOnTheNet wrote: post #115

Earlier quoted context omitted.

> I've seen Windows do that too. Really? I have never seen this in Windows. Don't get me wrong, I've seen plenty of lock screen failures in Windows, usually in the form of it suddenly being unresponsive, just never anything that actually gave me access to the locked session again. The closest I've seen is when using RDP, if the Window has been minimized or hidden or otherwise has had reason not to update its display,…

Yes, really. I don't use Windows myself, but I've seen it happen to others. As another commenter said, it's usually when the computer is coming out of "sleep" or something like that. Plenty of times I've seen a glimpse of the desktop that was long enough for me to get a vague idea of what they were doing before the lock screen takes over. If one was determined enough a photograph could easily be taken in that time.

My guess would be that the video buffer wasn’t cleared before suspending. If so, on resuming there is a race condition between painting the lock screen, and turning on the video hardware that will show the screen memory as it was when suspended.

Re: Kids find a security flaw in Linux Mint by mashing keys

#302

Post by Sohcahtoa82 »

Const-me wrote: post #280
GlitchMr wrote: post #183

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

In Windows it’s also good. The way it works is follows. The OS support multiple desktops. Similar to files or registry keys, desktops have security descriptors attached (a data structure keeping who’s the owner, and optionally listing users/groups with their respective permissions on the object being controlled). To do anything on a desktop, like create windows, paint stuff, or interact with windows on that desktop,…

> BTW, about crashing GPU drivers, on modern Windows the condition is recoverable. The symptoms are black screen for a second, then the OS resets the hardware, restarts the driver, and resumes rendering of the desktop. Observed quite a few times working on advanced GPU stuff, especially compute shaders.

When I mine cryptocurrency while playing games, I appear to sometimes run out of GPU memory (Both Task Manager and MSI Afterburner let me monitor usage) and I have experienced this reset. It's surprisingly graceful, even when a game is running, though NVIDIA Broadcast often doesn't like it and needs to be restarted, and I will sometimes see lingering graphical glitches in the game until I restart, but it's not game breaking.

You can also trigger a GPU reset manually with CTRL-WIN-SHIFT-B.

Re: Kids find a security flaw in Linux Mint by mashing keys

#303

Post by girvo »

toyg wrote: post #247
nefitty wrote: post #229

Earlier quoted context omitted.

Not to belabor the meta discussion, but your comment sparked a question. If it is how you say, and using a politico-economic lens, I wonder if there has been any discernible shift in commenter attitudes as the demographics have changed. Specifically, if the shift was from entrepreneurs -> skilled wage workers, as you’ve asserted. The interests of the petit bourgeoisie (entrepreneurs, et al), the professional manageme…

This is OT, but I can't resist. I've been around HN since 2011, and tone has definitely shifted in the last 5-6 years. I used to stumble on HN posts that infuriated me relatively often, it was part of the deal (i.e. understanding how the self-appointed entrepreneurial classes actually rationalize certain things). That doesn't really happen anymore. > those overlaps would probably translate to some overarching strains…

I’ve also been around for donkeys years, and I agree mostly. Certain topics bring the “screw you, got mine” opinions back out of the woodworks at times, but yeah it’s far less prevalent.

Re: Kids find a security flaw in Linux Mint by mashing keys

#304

Post by dheera »

GlitchMr wrote: post #183

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

The Gnome screensaver lock is only a fluffy fake security mechanism. It's not real security.

I've had many instances where my CPU was bogged down and after hitting the keyboard I could use the computer for a good several seconds before the lock screen popped up asking for a password.

Re: Kids find a security flaw in Linux Mint by mashing keys

#305

Post by lern_too_spel »

Naracion wrote: post #262
thesh4d0w wrote: post #255

Earlier quoted context omitted.

Cause he redirects based on referrer to https://cdn.jwz.org/images/2016/hn.png

I did not get redirected--would that be because I'm using Brave? Or because I'm on mobile?

Also, if you're using a Hacker News app, it won't send a Referer header when opening an article unless the app authors went out of their way to implement that. I would be surprised if any did.

Re: Kids find a security flaw in Linux Mint by mashing keys

#306

Post by brnt »

GlitchMr wrote: post #183

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

I have no idea why GNOME is the default DE for the big distros (Redhat et al, Ubuntu). Technically it's evidently inferior, it had substandard ergonomics and features like accesibility services. I really dont get it.

Re: Kids find a security flaw in Linux Mint by mashing keys

#308

Post by cuillevel3 »

GlitchMr wrote: post #183

I find interesting that GNOME Screensaver's security depends on it to not crash. Meanwhile, in KDE the lock screen is managed by KDE Session Management Server which ensures that lock screen cannot be bypassed by simply crashing its process. The way it works is follows: ksmserver draws a black rectangle over everything and spawns kscreenlocker. If kscreenlocker crashes, the black rectangle is still here, and ksmserver…

This bug is not about the Gnome screensaver. This is about Cinnamon, which forked from Gnome 3 in 2013.

Re: Kids find a security flaw in Linux Mint by mashing keys

#309

Post by omoikane »

sontek wrote: post #121
astrange wrote: post #10

Earlier quoted context omitted.

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

JWZ has been complaining about these screensavers for a decade. His screensaver from 20 years ago still doesn't have these issues. Its not an X11 problem. - https://bit.ly/3o2qekz - https://bit.ly/38Y6pGO (using bit.ly because he gives a testicle if referrer is HN :P)

xscreensaver has had some issues, for example: https://security-tracker.debian.org/tracker/CVE-2015-8025

Which can be found via this thread: https://news.ycombinator.com/item?id=11412081 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819703#400

Post reply on HN