Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

Post reply on HN
Print view View original

321–330 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#321

Post by lostlogin »

throwaway325 wrote: post #293
smnrchrds wrote: post #257

Earlier quoted context omitted.

What I miss about the old HN is learning about all the cool new programming tools, libraries, frameworks, etc and participating in the discussions about them. These days, you rarely see posts about programming tools, unless it is one of the big ones like React, Qt, or TypeScript. I used to stumble upon so many great tools on HN, but that has become a rare experience these days. Is there still somewhere on the web, pe…

>Is there still somewhere on the web, perhaps on Reddit or another platform, where you can find such posts and discussions? If they exist it would be wise not to link it here, or else the same fate would befall the new community. My advice is to search for a small community around a niche topic (say a specific text editor or programming language).

There are some great Reddit subs for niche projects, the trouble is discoverability. Those I’ve found have always been via obscure links or a chance hunt after finding a git repo.

Re: Kids find a security flaw in Linux Mint by mashing keys

#322

Post by chris_wot »

smnrchrds wrote: post #204
dr_cypher wrote: post #196

Earlier quoted context omitted.

jwz has a lot to say about complex graphical toolkits/desktop environments and their complex locking mechanisms. It's an interesting series of posts. If you are not running xscreensaver on Linux, then it is safe to assume that your screen does not lock. Once is happenstance. Twice is coincidence. Three times is enemy action. Four times is Official GNOME Policy. https://www.jwz.org/xscreensaver/toolkits.html

Never directly link to jwz from HN. https://web.archive.org/web/20210117212403/https://www.jwz.o...

You'd be better off reading the response here:

https://github.com/linuxmint/cinnamon-screensaver/issues/354...

Re: Kids find a security flaw in Linux Mint by mashing keys

#323

Post by troff »

Qub3d wrote: post #112
sbierwagen wrote: post #101

Earlier quoted context omitted.

What context? Reading that issue, the content seems to be: 1: jwz says if you add accessibility features to a text box, make sure they don't have any bugs that can kill a process, since that will break screen lockers 2: Cinnamon adds a buggy accessibility feature to a text box that lets you crash the screen locker 3: Github user clefebvre says something along the lines of "why is jwz being so negative >:(" Well... yo…

> Why is it his responsibility to fix your code? The distro extended his program, the extension broke. cinnamon-screensaver (the repo this discussion is pertinent to) is written from scratch. The commenter's intent here is to suggest that JWZ has valid criticisms, but he has voiced them before and his latest blog post doesn't add anything to the discussion. This blog post, which links to the issue, creates additional…

Even with their voice in the matter, the voice is speaking nonsense and trying to snow the reader (as your response seems to indicate. And that's being charitable and assuming you're sincere). Giving that voice oxygen is making the matter worse.

Cinnamon tried to re-invent the wheel. They made it very sparkly and shiny and colourful and forgot that it had to be robust, round and capable of rolling.

Jesus wept, you criticise other people for not reading the entire discussion, and yet you somehow missed the part in JWZ's post where he explains that Cinnamon-screensaver was NOT written from scratch. So congratulations, you hypocritically own-goaled yourself there too. Which again, makes me question the charitability of assuming sincerity.

And JWZ is supposed to "work with them" when their code fouls up for the Nth time? No, the idiots should've been writing modules for JWZ's engine, seeing as JWZ's is the one that a) they did indeed steal from and b) still screwed up.

Yes, he's voiced his valid criticisms before. And the damn Cinnamon tards STILL KEEP MAKING THE SAME MISTAKES. This adds to the discussion. It adds useful, educational history that the Cinnamon morons are so stupid that they repeatedly, in the face of history, keep making the same goddamn stupid mistakes.

I get to "the other side of the road" just fine with JWZ's screensaver. I just FIFTEEN MINUTES AGO had to step the housemate through replacing her new Mint install's Cinnamon screensaver with xscreensaver; because what a surprise, it's 2021 and the $hitpile that is Cinnamon screensaver lock would NOT RESPOND to keyboard or mouse and wouldn't let her log in. And either she had to either magic-sysrq, or I had to ssh in to the root account to kill the stupid pile of crap that is cinnamon-screensaver.

And I found this ridiculous comment on this thread, because I was trying to show her a reference as to WHY Cinnamon-screensaver is stupidly broken in its principles and why xscreensaver should be used instead.

Clement Lefebvre has some pretty big balls to have written what he did; and that's good. Because it'll make it easier to repeatedly kick him in them as he deserves for this. And defence of his positions is... not particularly defensible.

I don't wish to be rude to you; but I finally stopped lurking on HN after years and created an account for the purpose of telling you these things. And by years, I mean that my Slashdot ID is in the 500,000s, rather than say the 60-millions.

Re: Kids find a security flaw in Linux Mint by mashing keys

#324

Post by traverseda »

cycloptic wrote: post #283
Blikkentrekker wrote: post #279

Earlier quoted context omitted.

> I mean actual actionable feedback that someone is able to work with Is this not what “constructive criticism”, as I called it, is? GNOME is not going to listen to an H.N. comment an change it's ways, and it was never my intent to reach them or otherwise inspire change in them. My intent was simply to be humorous.

Please don't discount yourself like that, by resigning to the usual HN snark. I think you're smart and capable of much more. If there is new, important and relevant information brought to them, they will listen to that. (This applies to most big projects I've seen, not any one in particular. The smaller niche ones that commit to having their small narrow audience are the ones I've seen that tend to be resistant to ne…

>they will listen to that

Citation needed

Gnome deserves whatever bad reputation it's getting, lest people make the mistake of building stuff on top of it.

Re: Kids find a security flaw in Linux Mint by mashing keys

#325

Post by traverseda »

cycloptic wrote: post #311
Blikkentrekker wrote: post #284

Earlier quoted context omitted.

I doubt they scan H.N. comments for input or come across them. If I had wanted to reach them, I would certainly do wiser to simply send them a feature requæst bug report.

I am sorry if I'm being pushy, it just gets extremely tiring to see all the same type of comments for years on places like here and on /r/linux. You don't have to listen to me if you don't want, it's just my humble plea.

This seems like an obvious response to gnome's poor behavior in the open-source ecosystem, they've been been burning good will among a large group of developers for a long time now. I think the solution to that problem isn't to ask people nicely to stop being pissed off, it's to fix the underlying problems/attitudes.

Re: Kids find a security flaw in Linux Mint by mashing keys

#326

Post by cycloptic »

traverseda wrote: post #325
cycloptic wrote: post #311

Earlier quoted context omitted.

I am sorry if I'm being pushy, it just gets extremely tiring to see all the same type of comments for years on places like here and on /r/linux. You don't have to listen to me if you don't want, it's just my humble plea.

This seems like an obvious response to gnome's poor behavior in the open-source ecosystem, they've been been burning good will among a large group of developers for a long time now. I think the solution to that problem isn't to ask people nicely to stop being pissed off, it's to fix the underlying problems/attitudes.

I am not saying don't be pissed off, I am saying please channel that energy to help to fix the underlying problems/attitudes. I can give suggestions on how to do this, if you're interested to hear it, so we can maybe have a chance to finally get some issues fixed. Beating the same dead horse going on years now is just not going to help this, regardless of what your perceptions of certain developer's attitudes are. If complaining about lost goodwill was ever a substitute for being persuasive and getting things done and taking initiative to restore the goodwill, it would have worked years ago, and we wouldn't be here talking about this now.

And just to be clear, harassing developers who have said "no I don't want to work on feature XYZ" is never acceptable and never has good results. If somebody says no and is just not interested, we leave them alone and we find someone else who does want to work on that feature.

Re: Kids find a security flaw in Linux Mint by mashing keys

#327

Post by cycloptic »

traverseda wrote: post #324
cycloptic wrote: post #283

Earlier quoted context omitted.

Please don't discount yourself like that, by resigning to the usual HN snark. I think you're smart and capable of much more. If there is new, important and relevant information brought to them, they will listen to that. (This applies to most big projects I've seen, not any one in particular. The smaller niche ones that commit to having their small narrow audience are the ones I've seen that tend to be resistant to ne…

>they will listen to that Citation needed Gnome deserves whatever bad reputation it's getting, lest people make the mistake of building stuff on top of it.

>lest people make the mistake of building stuff on top of it.

This is the kind of hyperbole I'm talking about... As with any open source, you don't have to use the parts you don't want. GNOME as a whole is a pretty big project, and like most projects, some of its parts are stable and up-to-date, and some aren't. Lots of other desktops build on pieces of GNOME technologies because they work, and replace the parts they're unhappy with. So I'm sorry if you feel a particular component made a mistake, but it really does not have to be a mistake that affects you, if you handle things the right way.

Can you be more specific about what kind of citation you're looking for?

Re: Kids find a security flaw in Linux Mint by mashing keys

#328

Post by traverseda »

cycloptic wrote: post #326
traverseda wrote: post #325

Earlier quoted context omitted.

This seems like an obvious response to gnome's poor behavior in the open-source ecosystem, they've been been burning good will among a large group of developers for a long time now. I think the solution to that problem isn't to ask people nicely to stop being pissed off, it's to fix the underlying problems/attitudes.

I am not saying don't be pissed off, I am saying please channel that energy to help to fix the underlying problems/attitudes. I can give suggestions on how to do this, if you're interested to hear it, so we can maybe have a chance to finally get some issues fixed. Beating the same dead horse going on years now is just not going to help this, regardless of what your perceptions of certain developer's attitudes are. If…

Alright, I want this type-ahead feature. https://gitlab.gnome.org/GNOME/nautilus/-/issues/244

Not having type-ahead, instead using gnome's search, makes GTK apps really annoying for me. Right now I have a solution that involves patching, but presuming that my ultimate goal is just that one concessions, just have a flag buried somewhere that would enable type-ahead instead of search, how do you suggest I get that done?

I think that would go a long way towards demonstrating that gnome can be reasoned with, is worth even approaching or talking to.

Could we hire a developer? Set up crowdfunding? Can someone give me a quote and I can see what resources I can bring to bear on the problem?

I'd be open to other suggestions on how to channel that energy productively, but I really think if they can't compromise on that one feature that's important to a bunch of people then they're probably not going to be worth dealing with. Feel free to send me an email, at gmail.

Re: Kids find a security flaw in Linux Mint by mashing keys

#329

Post by traverseda »

cycloptic wrote: post #327
traverseda wrote: post #324

Earlier quoted context omitted.

>they will listen to that Citation needed Gnome deserves whatever bad reputation it's getting, lest people make the mistake of building stuff on top of it.

>lest people make the mistake of building stuff on top of it. This is the kind of hyperbole I'm talking about... As with any open source, you don't have to use the parts you don't want. GNOME as a whole is a pretty big project, and like most projects, some of its parts are stable and up-to-date, and some aren't. Lots of other desktops build on pieces of GNOME technologies because they work, and replace the parts they…

> you don't have to use the parts you don't want.

I don't want to use systemd-logind or the gnome search services. Right now not using either of those requires a whole lot of work. It's actually pretty hard to use GTK apps with only the GTK toolkit and not a bunch of other software daemons. Hell, in a perfect would I'd even get rid of dconf and gnome's weird registry, but I recognize that as pretty integral to the toolkit.

Re: Kids find a security flaw in Linux Mint by mashing keys

#330

Post by cycloptic »

traverseda wrote: post #329
cycloptic wrote: post #327

Earlier quoted context omitted.

>lest people make the mistake of building stuff on top of it. This is the kind of hyperbole I'm talking about... As with any open source, you don't have to use the parts you don't want. GNOME as a whole is a pretty big project, and like most projects, some of its parts are stable and up-to-date, and some aren't. Lots of other desktops build on pieces of GNOME technologies because they work, and replace the parts they…

> you don't have to use the parts you don't want. I don't want to use systemd-logind or the gnome search services. Right now not using either of those requires a whole lot of work. It's actually pretty hard to use GTK apps with only the GTK toolkit and not a bunch of other software daemons. Hell, in a perfect would I'd even get rid of dconf and gnome's weird registry, but I recognize that as pretty integral to the to…

I'll try to respond to each of these:

AFAIK the only component that really relies on logind is GDM. If you don't want GDM and are comfortable using another display manager to launch your GNOME session, that should work fine, although I haven't tested this in a while. You may also be able to launch your session manually the old way, without a session manager, although that will probably require you to use setuid X which comes with the usual caveats. It's probably a total no-no if you're using wayland. If you decide you want GDM and wayland then you still don't need systemd-logind for session management, you can use elogind, or you can grab BSD's patches for consolekit support. The real issue there is that GDM requires some kind of session management, if you want to do this without any other daemons whatsoever, then you will have to reimplement parts of logind/consolekit inside GDM.

With the search services, there is a switch for that in settings under "Search."

With dconf, that is not actually integral to the toolkit. The API that applications use is GSettings, which requires a backend to actually store the settings, and dconf is just one of those backends. You can disable the dconf backend and just use the one that writes ini files to your home directory, or use some other backend. Technically apps can try to force the dconf backend but I've never seen one that does this.

Post reply on HN