Live data from Hacker News

Kids find a security flaw in Linux Mint by mashing keys

github.com

41–50 of 340 posts

Re: Kids find a security flaw in Linux Mint by mashing keys

#41
post #33

Earlier quoted context omitted.

https://www.jwz.org/xscreensaver/toolkits.html Good post on the topic

Judging by the redirect to the image macro of a testicle in an egg cup, specifically calling out HN, I think we can assume the author of that article does not appreciate links to his website from HN

I clicked the link specifically seeking out this testicle in an egg cup, however, all I got was an article on XScreenSaver.

How do I get the testicle in an egg cup?

Re: Kids find a security flaw in Linux Mint by mashing keys

#42
post #18

For anyone interested there is something called fuzzing that uses usually code coverage based heuristics to generate data to find bugs. For example LLVM's lib fuzzer uses instrumentation to track code coverage and mutates data to find invalid behaviour. https://llvm.org/docs/LibFuzzer.html It uses a compiler pass to insert code to branch points functions calls etc. I think it uses genetic algorithms to increase cover…

Somewhat similar for web UIs: Quickstrom is a tool that lets you define a set of conditions that should hold (e.g. "there should always be an 'Add todo' button"), and then it'll simulate behaviour that might break that condition.

See https://quickstrom.io/

(I haven't used it myself yet, but it looks interesting.)

Re: Kids find a security flaw in Linux Mint by mashing keys

#43

Earlier quoted context omitted.

https://www.jwz.org/xscreensaver/toolkits.html Good post on the topic

Uhm, this link doesn't lead where you think it does. Or the owner of the website is specifically redirecting HN traffic.

They are, if you copy paste the link you can read the article.

Re: Kids find a security flaw in Linux Mint by mashing keys

#44
post #40

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

X11 problem. Wayland fixes that and is the default on Fedora etc. as of 2021.

Oh, so Wayland is finally ready to replace X11?

Re: Kids find a security flaw in Linux Mint by mashing keys

#45

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

Bad design in X11 which can't be fixed. https://news.ycombinator.com/item?id=25801693

I'm surprised he doesn't mention XSecureLock. Its entire focus is on preventing issues like this with modularity and redundancy.

https://github.com/google/xsecurelock

Re: Kids find a security flaw in Linux Mint by mashing keys

#46
post #41
post #33

Earlier quoted context omitted.

Judging by the redirect to the image macro of a testicle in an egg cup, specifically calling out HN, I think we can assume the author of that article does not appreciate links to his website from HN

I clicked the link specifically seeking out this testicle in an egg cup, however, all I got was an article on XScreenSaver. How do I get the testicle in an egg cup?

Make sure your browser sends in the Referer header.

Otherwise, this is the image that gets displayed:

NSFW. This is a testicle in an egg cup.

https://cdn.jwz.org/images/2016/hn.png

Re: Kids find a security flaw in Linux Mint by mashing keys

#47

Earlier quoted context omitted.

https://www.jwz.org/xscreensaver/toolkits.html Good post on the topic

Uhm, this link doesn't lead where you think it does. Or the owner of the website is specifically redirecting HN traffic.

He's specifically redirecting HN traffic, if you copy the link you won't have any issues.

Re: Kids find a security flaw in Linux Mint by mashing keys

#48
post #35

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

Can anyone explain why a crash in xscreensaver results in the computer being unlocked? It seems like this whole class of bugs could be fixed pretty easily by having a simple process watchdog run xscreensaver as a child process, and re-launch it if it crashes without first signalling that the desktop has been unlocked.

> and re-launch it if it crashes without first signalling that the desktop has been unlocked.

Might be better to just exit the session or load a minimalistic replacement lock program (like the original xscreensaver) to avoid an infinite crash loop.

Re: Kids find a security flaw in Linux Mint by mashing keys

#49
post #35

Does anyone know why lockscreens in Linux have been such a joke? I remember trying Ubuntu couple years ago and when waking up my laptop it would show me my entire desktop with all the information displayed right there in the open for about 10-20 seconds before suddenly engaging the lockscreen. All you had to do was close the lid and open it again and you could just copy whatever was on the screen before the lock scre…

Can anyone explain why a crash in xscreensaver results in the computer being unlocked? It seems like this whole class of bugs could be fixed pretty easily by having a simple process watchdog run xscreensaver as a child process, and re-launch it if it crashes without first signalling that the desktop has been unlocked.

KDE has a failsafe mechanism. If the screen locker has crashed, it shows a black screen of death with a huge error message.

> The screen locker is broken and unlocking is not possible anymore. In order to unlock, switch to a virtual terminal (e.g. Ctrl+Alt+F2), log in and execute the command: "loginctl unlock session c2". Afterwards switch back to the running session.

I think it's a reasonable design.

Re: Kids find a security flaw in Linux Mint by mashing keys

#50

Step 1: Gather timings of key presses from a lot of kids. 2: Use ML to learn how to simulate it. 3: Sell it as a service, labeling it KaaS. 4: Profit, then go to jail because of a misunderstanding. But seriously, is there such a tool to automate this?

As others have pointed out, you are describing fuzzing but rather than purely random you’ve trained your fuzzer on a particularly troublesome set of random variables ;-)
Post reply on HN