Kids find a security flaw in Linux Mint by mashing keys • Hacker News Board

Re: Kids find a security flaw in Linux Mint by mashing keys

#331

Post by cycloptic » Thu, Jan 21, 2021, 5:02 PM UTC

traverseda wrote: post #328

cycloptic wrote: post #326

Earlier quoted context omitted.

I am not saying don't be pissed off, I am saying please channel that energy to help to fix the underlying problems/attitudes. I can give suggestions on how to do this, if you're interested to hear it, so we can maybe have a chance to finally get some issues fixed. Beating the same dead horse going on years now is just not going to help this, regardless of what your perceptions of certain developer's attitudes are. If…

Alright, I want this type-ahead feature. https://gitlab.gnome.org/GNOME/nautilus/-/issues/244 Not having type-ahead, instead using gnome's search, makes GTK apps really annoying for me. Right now I have a solution that involves patching, but presuming that my ultimate goal is just that one concessions, just have a flag buried somewhere that would enable type-ahead instead of search, how do you suggest I get that done…

If you have a working patch for this that makes it a configurable option then just use that. There is no harm in submitting that as a merge request either, worst case it gets rejected again and you're in the same spot you are now. I don't believe a real non-intrusive patch was ever submitted for this, everything out there just seems to be a revert back to some old functionality that breaks other things. (Please don't waste maintainer time submitting patches that are broken or hacky, or patches that were already rejected. When in doubt talk about it with them first before submitting anything, and make sure your patch is actually new and addresses all the concerns that were made in the bug tracker already)

If it does get rejected then you do the same thing you'd do with any other open source project: convince your distro to carry the patch. I think the key here is to just not lose sight of the goal which is to get enough support somewhere to have the patch maintained, if you don't care to become an upstream developer and work closely with them then you can skip that and just do the same process but only with a downstream that is relevant to you.

If the patch still needs a lot of work/money to get it to the point where it's stable and doesn't break other things, well, now you know why upstream doesn't want to do it... so with that I would say a way to help would be to commit to maintaining this for however many years you expect to be using the patch. I can't give you a specific quote (I don't have any interest in working on this, sorry) but based on average developer rates you probably should expect to spend at least a few thousand dollars on this total, over several years of maintenance time, if you are not the one who is going to be writing the code. Of course, you can reduce the burden on yourself by getting a distro to share the cost, which is why I suggested that first :)

Re: Kids find a security flaw in Linux Mint by mashing keys

#332

Post by traverseda » Thu, Jan 21, 2021, 9:43 PM UTC

cycloptic wrote: post #331

traverseda wrote: post #328

Earlier quoted context omitted.

Alright, I want this type-ahead feature. https://gitlab.gnome.org/GNOME/nautilus/-/issues/244 Not having type-ahead, instead using gnome's search, makes GTK apps really annoying for me. Right now I have a solution that involves patching, but presuming that my ultimate goal is just that one concessions, just have a flag buried somewhere that would enable type-ahead instead of search, how do you suggest I get that done…

If you have a working patch for this that makes it a configurable option then just use that. There is no harm in submitting that as a merge request either, worst case it gets rejected again and you're in the same spot you are now. I don't believe a real non-intrusive patch was ever submitted for this, everything out there just seems to be a revert back to some old functionality that breaks other things. (Please don't…

>When in doubt talk about it with them first before submitting anything

Normally you'd do that before even working on the patch, and you can see what kind of response that's gotten.

I've got a patched version that suites my needs, as I say. That being said I'm sure raising a few thousand dollars for that feature wouldn't have been hard.

Re: Kids find a security flaw in Linux Mint by mashing keys

#333

Post by cycloptic » Thu, Jan 21, 2021, 9:57 PM UTC

traverseda wrote: post #332

cycloptic wrote: post #331

Earlier quoted context omitted.

If you have a working patch for this that makes it a configurable option then just use that. There is no harm in submitting that as a merge request either, worst case it gets rejected again and you're in the same spot you are now. I don't believe a real non-intrusive patch was ever submitted for this, everything out there just seems to be a revert back to some old functionality that breaks other things. (Please don't…

>When in doubt talk about it with them first before submitting anything Normally you'd do that before even working on the patch, and you can see what kind of response that's gotten. I've got a patched version that suites my needs, as I say. That being said I'm sure raising a few thousand dollars for that feature wouldn't have been hard.

>you can see what kind of response that's gotten

I don't think we have. Like I said, I have not seen any serious offers to work on a non-intrusive patch for this, to put up the time and/or money and to maintain it for the number of years required. That's what you want to look for. And if you want to bring it upstream, you have to sell it to them in a way that shows it will not increase their maintenance burden or break the currently in-place designs. (This is not a GNOME specific thing, this is how basically every open source project operates. You generally can't just dump code on upstream and expect it to go well)

If you want to do fundraising, some trusted person has to put in the time to do it and to manage the money.

Re: Kids find a security flaw in Linux Mint by mashing keys

#334

Post by Qub3d » Fri, Jan 22, 2021, 2:20 AM UTC

troff wrote: post #323

Qub3d wrote: post #112

Earlier quoted context omitted.

> Why is it his responsibility to fix your code? The distro extended his program, the extension broke. cinnamon-screensaver (the repo this discussion is pertinent to) is written from scratch. The commenter's intent here is to suggest that JWZ has valid criticisms, but he has voiced them before and his latest blog post doesn't add anything to the discussion. This blog post, which links to the issue, creates additional…

Even with their voice in the matter, the voice is speaking nonsense and trying to snow the reader (as your response seems to indicate. And that's being charitable and assuming you're sincere). Giving that voice oxygen is making the matter worse. Cinnamon tried to re-invent the wheel. They made it very sparkly and shiny and colourful and forgot that it had to be robust, round and capable of rolling. Jesus wept, you cr…

Good info, thanks for sharing. I can only be as accurate as the info I was provided. I did read JWZ's post -- I have his blog in my RSS feed and actually saw the post there before I saw it being linked here.

Mr. Lefebvre said "cinnamon-screensaver is written from scratch" in his GitHub post. I assumed good faith[0], and thought that maybe after nearly 30 years, JWZ was just a bit jaded and assumed the worst. I see that JWZ is probably the right one here, and clefebvre mistaken.

But Jamie has a certain "tone" that I would argue is a tad combative. To be fair, its his style, just like Linus Torvalds. But that lead me to see his comments in the context that he responds like this to every bad thing (TM) he feels lead to comment on, and I combined that with the GitHub response to conclude that JWZ was acting as a peanut gallery member here.

And please don't mistake my reasoning for support. In both my earlier comments, I was advocating for exposure of the response, not endorsement. I feel that is quite clear, and this is shooting the messenger.

> I don't wish to be rude to you; but I finally stopped lurking on HN after years and created an account for the purpose of telling you these things. And by years, I mean that my Slashdot ID is in the 500,000s, rather than say the 60-millions.

Welcome to HN, officially! But maybe chill with the cred dropping. Appeal to authority is no basis for an argument.

[0]: "Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith." https://news.ycombinator.com/newsguidelines.html#comments

Re: Kids find a security flaw in Linux Mint by mashing keys

#335

Post by joshuaissac » Fri, Jan 22, 2021, 12:42 PM UTC

passivate wrote: post #249

joshuaissac wrote: post #149

Earlier quoted context omitted.

It happens to me on Windows 10 if I close the laptop lid to lock the desktop and send it to sleep. When I open it again, the desktop is accessible for a few seconds (sometimes long enough to launch programs) before the lock screen activates and I have to input my password. The workaround I use is to manually lock with Win+L before closing the lid.

Would you mind posting a video? I have never seen this occurring in any version of Windows.

I tried a few times but it cannot be reliably reproduced. It successfully locked every time I tried today.

Re: Kids find a security flaw in Linux Mint by mashing keys

#336

Post by jodrellblank » Sun, Jan 24, 2021, 5:10 AM UTC

rexpop wrote: post #259

mightybyte wrote: post #143

Years ago I taught a high school typing class in a K-12 school. The school didn't have the funds to get a commercial typing program so I wrote my own typing program. It evolved over time with features to help me track the students' progress etc. One day we had a school open house where all the parents could come to school. We had a bunch of different activities set up in different classrooms and I ended up getting as…

> The school didn't have the funds to get a commercial typing program so I wrote my own typing program. Off-topic, but: It seems absurd, to me, that such a conclusion could ever be reached. Obviously, from my perspective, the economies of scale, the infrastructure, overhead, and institutional resources available to programmers at a dedicated software development firm would produce an application at better quality per…

How do you commercially produce "better quality per dollar" when the high school teacher's off-hours cost the school $0 and they get infinite quality per dollar?

Re: Kids find a security flaw in Linux Mint by mashing keys

#337

Post by mightybyte » Tue, Jan 26, 2021, 12:50 PM UTC

BruiseLee wrote: post #159

mightybyte wrote: post #143

Years ago I taught a high school typing class in a K-12 school. The school didn't have the funds to get a commercial typing program so I wrote my own typing program. It evolved over time with features to help me track the students' progress etc. One day we had a school open house where all the parents could come to school. We had a bunch of different activities set up in different classrooms and I ended up getting as…

Are you sure it was a segfault? DOS did not have any memory protection, so segfault would be impossible. Or maybe you used some protected mode DOS extender?

My memory is getting a little fuzzy. I think the machines we were using were running Windows 98 or perhaps Windows 95. But I didn't want people to be able to do other things on the computers that day as the whole point of the endeavor was to emphasize typing skill, so I looked for some kind of way to make it impossible to do ALT-TAB to switch to a different program. I was thinking I booted it up in DOS only but I also might have run it full screen in Windows and just hoped nobody knew about ALT-TAB. :P

Re: Kids find a security flaw in Linux Mint by mashing keys

#338

Post by mightybyte » Tue, Jan 26, 2021, 1:02 PM UTC

rexpop wrote: post #259

mightybyte wrote: post #143

Years ago I taught a high school typing class in a K-12 school. The school didn't have the funds to get a commercial typing program so I wrote my own typing program. It evolved over time with features to help me track the students' progress etc. One day we had a school open house where all the parents could come to school. We had a bunch of different activities set up in different classrooms and I ended up getting as…

> The school didn't have the funds to get a commercial typing program so I wrote my own typing program. Off-topic, but: It seems absurd, to me, that such a conclusion could ever be reached. Obviously, from my perspective, the economies of scale, the infrastructure, overhead, and institutional resources available to programmers at a dedicated software development firm would produce an application at better quality per…

To go in another off-topic direction...of course I mainly did it because I wanted to. I had a view about how to teach/learn typing that the popular typing programs then didn't seem to have. When you're learning typing for the first time, IMO it's fundamentally a kinesthetic endeavor. It's more important to focus on burning the motor pattern of moving your finger from the home row to the key you're typing and back to the home row than remembering where the letters are placed on the keyboard. (Of course you have to also remember where the letters are, but that will happen automatically in the process of doing the former.) So I wanted to take this into account and have my students type things like this:

fff ggg fgf gfg ffgg fggf gffg

jjj hhh jhj hjh jjhh jhhj hjjh

This forces the student to exercise that movement pattern in a way that just telling them to put their fingers on the home row and type English words does not.

So the above sentence you quoted was a an over-simplification for story telling purposes and not the whole story. :)

Re: Kids find a security flaw in Linux Mint by mashing keys

#339

Post by rexpop » Fri, Jan 29, 2021, 12:01 AM UTC

jodrellblank wrote: post #336

rexpop wrote: post #259

Earlier quoted context omitted.

> The school didn't have the funds to get a commercial typing program so I wrote my own typing program. Off-topic, but: It seems absurd, to me, that such a conclusion could ever be reached. Obviously, from my perspective, the economies of scale, the infrastructure, overhead, and institutional resources available to programmers at a dedicated software development firm would produce an application at better quality per…

How do you commercially produce "better quality per dollar" when the high school teacher's off-hours cost the school $0 and they get infinite quality per dollar?

Calling work done in off-hours "$0" is magical thinking. That teacher costs a lot to maintain. Those of us who are employed full-time don't really have "off-hours", and regardless of the intensity with which we focus in a given 60-minute period.

Sometimes, while at work, I am thinking of leisure. Sometimes, while at leisure, I am thinking of work.

At the end of the day, the school pays their employee. And the rest of society pays them during "off-hours", e.g. in depreciation of common resources if, say, they drive on the road.

My point is that people cost society to keep alive, but some of those people are better equipped for certain tasks than others. The question is only where do those costs come from, and to what particular efforts are the particularly-equipped assigned.

Re: Kids find a security flaw in Linux Mint by mashing keys

#340

Post by dragonwriter » Fri, Jan 29, 2021, 12:10 AM UTC

rexpop wrote: post #259

mightybyte wrote: post #143

Years ago I taught a high school typing class in a K-12 school. The school didn't have the funds to get a commercial typing program so I wrote my own typing program. It evolved over time with features to help me track the students' progress etc. One day we had a school open house where all the parents could come to school. We had a bunch of different activities set up in different classrooms and I ended up getting as…

> The school didn't have the funds to get a commercial typing program so I wrote my own typing program. Off-topic, but: It seems absurd, to me, that such a conclusion could ever be reached. Obviously, from my perspective, the economies of scale, the infrastructure, overhead, and institutional resources available to programmers at a dedicated software development firm would produce an application at better quality per…

> Obviously, from my perspective, the economies of scale, the infrastructure, overhead, and institutional resources available to programmers at a dedicated software development firm would produce an application at better quality per dollar (however you measure it) than a high school teacher in their off-hours.

If you measure it by cost to the district (for which a teacher doing it in their off hours is $0), it's clearly not, even if you only consider the sticker price of the commercial software and not the other costs associated with purchasing in a school.

> If you were paid your actual worth,

The school would fire about half it's teaching staff in order to make budget, and still not have money left over to either develop or purchase the typing program, probably.