26 ms·

Linux Mint downloads (briefly) compromised

472 points by temp 11y ago

icebraining 11y ago
Could [Linux] be added before Mint? I thought it was about Mint.com
- sokoloff 11y ago
  Original page title is more communicative (so I suspect dang will fix it when he notices): Linux Mint downloads (briefly) compromised
  - mintplant 11y ago
    The linked page is actually a comment on an LWN article with that title. Changing the submission title to that wouldn't reflect the content being highlighted here.
    - sokoloff 11y ago
      I don't want to have a lengthy meta-discussion about titles, but as someone who is not in the mint community (either one), the HTML page title of the comment thread linked is more informative than the editorialized-by-excerpting text from the comment body.
      - JBReefer 11y ago
        But I don't know how much you can trust Canonical these days to not fuck things up on a whim.
  - bkor 11y ago
    Note that this suggested title is outdated as Mint was compromised twice. Meaning, it is not so brief anymore. The comment itself is more about the security practices. More ontopic: Having your Wordpress instance compromised is rather expected with the amount of security bugs Wordpress gets.
- randycupertino 11y ago
  Ditto. To be fair, Mint.com has been a lot more buggy lately.
m00dy 11y ago
Whos using Mint these days anyway ?
- cfontes 11y ago
  I am not one, but lot's of people. Most switched off from Ubuntu, landed a stayed there.
  - Ygg2 11y ago
    I've found Xubuntu to be a pretty decent albeit simple environment. Runs great on my VM too.
    - raverbashing 11y ago
      XFCE gets simplicity right, as opposed to Gnome or Unity
    - samuell 11y ago
      Indeed. I never got why people are not just sticking with Xubuntu. It is the most solid, reliable, balanced and beautiful distro I have ever tried. Everytime I tried something else, I finally came back to Xubuntu, and try to remind myself to never switch away again.
      - cowl 11y ago
        Maybe because the company behind Ubuntu has practically declared the desktop dead and we want a desktop that is really a desktop and not some future(already dead)fantasy all in one? Yes Xubuntu is a desktop but i'm not waiting around for the axe to fall and try again to force unity on everyone... I had to change once, better change to distro that is commited to the desktop.
      - ergo14 11y ago
        Because some things are broken in xubuntu - like wacom tablet configuration is missing :(
  - 11y ago
onlycommenting 11y ago
There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast. There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be it's name space? Give the user an option to still use- they're example- xedit while having another xedit installed along side? I can see how this could also get messy. Just spit balling here.
- JupiterMoon 11y ago
  Check out NixOS
  - obelisk_ 11y ago
    Personally I switched from Ubuntu to Fedora a couple of days ago because I've had it with Canonical. It was the first time I switched distro almost since I started using Linux (though I've admined servers with other distros and other OSes in the meantime). I am satisfied with Fedora thus far.
  - smt88 11y ago
    I absolutely love the concept of NixOS, but I haven't tried it out. Is it well-supported enough to use day-to-day as a developer? Do you often have to build things from source?
    - mjhoy 11y ago
      It's worth playing with to see if it could fit into your work; for instance, the Haskell ecosystem is very well supported, while Ruby seems to have issues. I am now using it for work on some of my projects. Generally you won't have to compile from source; that said I did recompile glibc when that last bug hit. (Security updates for core packages are not a great story now.) It's not perfect, but it's very hackable.
    - deleted 11y ago
embik 11y ago
> Secondly, they are mixing their own binary packages with binary packages from Debian and Ubuntu without rebuilding the latter. This creates something that we in Debian call a "FrankenDebian" which results in system updates becoming unpredictable This is interesting because Debian itself encourages derivative projects to use their binary packages[1]: > For those derivatives that re-use Debian binary packages, add some source packages and modify some source packages, where possible we encourage them to use standard Debian mirrors and add a second repository containing only the source and binary packages that have been added or modified. Or maybe they don't encourage that behaviour but still give guidelines in case you want your derivative to work that way? I'm not 100% sure. [1] https://wiki.debian.org/Derivatives/Guidelines https://wiki.debian.org/Derivatives/Guidelines
- asb 11y ago
  I believe the problem is the mixing of Debian and Ubuntu binaries rather than the fact they're not recompiling everything. Ubuntu doesn't just take Debian and add a few extra packages - it's a complete recompile with package versions likely don't match any Debian release.
  - embik 11y ago
    Oh, Linux Mint mixes Debian and Ubuntu packages by default? I was under the impression that there is Linux Mint based on Ubuntu and Linux Mint Debian Edition based on Debian.
    - tremon 11y ago
      Yes. Linux Mint was based on Ubuntu but still would pull packages from Debian unstable. LMDE was based purely on Debian.
kozukumi 11y ago
Fucking bang on point. Mint has a nice out of the box experience but after using it for a while you begin to see all the shit they stuffed in the cracks. It is a shame as Cinnamon is a lovely DE, I wish there were an official Ubuntu build with Cinnamon as the default DE similar to Xubuntu with Xfce.
- downtide 11y ago
  I've felt the same thing with many Ubuntu releases.
- mayhew 11y ago
  Installing Ubuntu GNOME and then installing Cinnamon would give you a nearly identical setup. Cinnamon is basically just a replacement for GNOME Shell. You could also install Nemo if you prefer that file manager.
akerro 11y ago
I had to quit using Mint because a lot of packages in their repo are really, really, old. Just to give example that made me install Manjaro on friends PC is ownCloud client for file syncing. It's a few years old, contains a lot of security bugs and doesn't work with HTTPS. You need to add repo with opensuse in URL address. Mint developers were contacted by ownCloud developers to resolve the issue, a few years ago, and they ignored it.
- creshal 11y ago
  Manjaro, really? The one distribution with a worse security track record than Mint? "Our SSL certificate expired, please change your computer clocks one year back" Manjaro?
  - akerro 11y ago
    Yea, I know, I expected this answer. I needed something quick to install, not deb... and with latest versions of packages. I was thinking about Arch, but it's too long to install, I had ~20 minutes. Manjaro is ok to people how know what they're doing and who know how to setup basic features of OS.
    - creshal 11y ago
      Antergos is a hands-free installer for Arch that doesn't cripple the installed system with unreliable third-party repositories.
XorNot 11y ago
Never let a good security breach not be an opportunity to air a bunch of unrelated greviences, apparently.
izacus 11y ago
> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Hmm, that was actually one of major selling points for Mint around me - it was the distro that "worked", with relevant software, codecs and drivers being preinstalled and not crippled due to strange laws on the other side of the ocean.
- creshal 11y ago
  It's user friendly, yes, but also reckless. The distro won't "work" any more if it gets sued into oblivion by Oracle, Adobe, Nvidia, AMD and whoever else feels like kicking puppies.
  - izacus 11y ago
    Hmm, why would they be. Mint already offers a special version for people living in countries where they can be sued for installing a video decoder or a video driver - it's called a "No codecs" version and it's meant for users in USA and Japan. Suing in the rest of the world would be a rather wasted effort right now.
  - takluyver 11y ago
    The flip side is that if you believe that laws like those around software patents should change, someone ignoring them and taking the risk of being sued is a more compelling demonstration than carefully observing the rules and then complaining about them on HN. More pragmatically, it seems unlikely that Oracle or Adobe will sue a distro for helping them distribute the Java/Flash runtimes. They want their runtime to be on as many devices as possible.
    - creshal 11y ago
      > The flip side is that if you believe that laws like those around software patents should change, someone ignoring them and taking the risk of being sued is a more compelling demonstration than carefully observing the rules and then complaining about them on HN. As EU citizen I have zero influence on US politics. Complaining on HN to US citizens is literally all I can do. > More pragmatically, it seems unlikely that Oracle or Adobe will sue a distro for helping them distribute the Java/Flash runtimes. Then maybe those companies should change their license terms. Right now, Adobe does not even allow you to use a downloaded Flash installer on two computers, you must either download it separately on each PC or apply for a special license: http://www.adobe.com/products/players/flash-player-distribution.html http://www.adobe.com/products/players/flash-player-distribut... If they want to shoot themselves in their feet, I'm not going to interfere.
jnbiche 11y ago
I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age. This recent security issue, and the poor response to it, are basically the straw that breaks the camel's back for me. I'm moving on to Ubuntu-Mate, since frankly Mate was the primary reason I was using Mint anyway. Serving downloads of the most popular Linux distro from the same machine as is running WordPress is cringeworthy, and failing to take the compromised machine totally offline until it's 100% sure the compromise has been mitigated (through reformatting, including boot sector) shows really poor judgment. I'm a bit sad to be so critical, since I recognize that Clem has done a lot for the Linux world, and as a Mint user I've benefited personally from his work. But when you're distributing operating systems to so many users, you have to take security seriously. To do otherwise, even on a "hobby" project (although I'm fairly sure it's his full-time job now) is pretty irresponsible. In many ways, I'd like to pitch in, but based on other interactions I've seen and read about, I'm not sure my input would be welcome, particularly wrt security issues. Edit: I'm also playing around with FreeBSD for my development environment, since I can use Mate on there. To be honest, I don't really need a DE these days anyway, since I only use terminal and a web browser. I should look into just using a Windows Manager. Edit 2: Apparently they do provide GPG signed hashes. I've been looking for them each time I've downloaded Mint distros, but never came upon them. So I stand corrected.
- theandrewbailey 11y ago
  I put my parents on Xubuntu about 5 years ago on a whim, then moved them over to Mint about 2 years later. About a year-ish ago, I saw that Xubuntu was using whisker-menu (main UI menu with a search box like Windows) I put them back on it and went back, myself.
- venomsnake 11y ago
  GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give your signature and key fingerprint.
wfunction 11y ago
When I read the title I thought this was about Mint.com... perhaps it should be changed to "Linux Mint" or something?
- mmahemoff 11y ago
  +1. I wasn't sure if it was about Mint.com or the analytics tool http://haveamint.com/ http://haveamint.com/. Wrong on both counts.
- _fabio 11y ago
  same
- DonHopkins 11y ago
  Unfortunately waferthinmint.com was taken. [1] [1] https://www.youtube.com/watch?v=aczPDGC3f8U https://www.youtube.com/watch?v=aczPDGC3f8U
snarfy 11y ago
I remember installing it when it was relatively new and people were gushing over it. A few weeks later a new version came out. I tried upgrading when I found there was no upgrade path. Upgrading Mint means reinstalling Mint. I remember the days before apt-get when there was only dpkg. Before Debian I used Slackware so I'm all too familiar with package management (or lack of). The idea that someone would release a new distribution, based on Debian of all things, and it not be able to upgrade was repelling to my mind. Re-install Mint to upgrade? No thanks I'll install Ubuntu over it. Cinnamon is nice but I never understood why it needs its own distribution. I should be able to apt-get install cinammon-desktop or whatever and it work like any other package.
- bildung 11y ago
  > Cinnamon is nice but I never understood why it needs its own distribution. I should be able to apt-get install cinammon-desktop or whatever and it work like any other package. On Debian you actually can 'apt-get install cinnamon' and have the full desktop.
  - PerryCox 11y ago
    There is also a Fedora spin with Cinnamon as the default DE: https://spins.fedoraproject.org/en/cinnamon/ https://spins.fedoraproject.org/en/cinnamon/
- versteegen 11y ago
  I'm sorry for the rant, it's a bit off topic and not called for, but would like to say my experience is sort of the opposite: I've been a Slackware-current user for most of a decade, and I love that it's so easy to upgrade the OS using slackpkg. I can (and do) often only upgrade a subset of packages, and never even need to reboot afterwards, not even after replacing the kernel (although, obviously...). A simple package system without dependency tracking has had many advantages for me. But installing stuff not in the standard system is more of a pain; there are third party repos but no where near as convenient as Debian/Ubuntu. I compile a couple SlackBuilds (packages) per week. I admit I've spent a huge amount of time learning how to do things like that manually and wouldn't recommend Slackware to those who won't want to learn sysadmin. On the other hand my experience with upgrading between Ubuntu releases is terrible. A number of things have broken, permanently, every time, and I can't trivially upgrade from Ubuntu 14.10, because they purposefully break the package manager in old releases by breaking URLs. Also other pain points, like it not allowing installing both 32 and 64 bit devel libraries. I need those! The package manager is too complex and clever for me. (Honestly, I don't want to spend time learning how to override it.) I'm planning to format the drive and reinstall from scratch because it seems easier than fixing it.
red_admiral 11y ago
Starting a post with "I know this is voluntary work, pitch in or shut up and all that ..." doesn't make the quote you're attacking untrue. For what I'm paying for Mint ($0.00) and what I get out of it in terms of productivity, I find it quite a decent distribution.
- dineshp2 11y ago
  Accepting poor security practices from the Linux mint developers cannot be justified just because you are not paying anything. Open source projects need to be held to the very highest security standards. How these security breaches are handled today set a precedent for how such security breaches are handled in the future. So it's a good idea to learn and improve from such security breaches and set a positive precedent.
- smt88 11y ago
  If Mint advertised, "Free to download, but also free of good security practices", then I could buy this argument. The problem is that Mint allows users to trust it. It would be better if they didn't work on the distro at all if they're not going to take security seriously. People on HN become furious about antivirus programs and routers and whatever else that are discovered to be laughably insecure. An OS is no less of security product than A/V or a router. In fact, it's the first line of defense for an end user.
- DonHopkins 11y ago
  Poor security is more expensive than money.
  - RaleyField 11y ago
    And unless you are using your computer only for media consumption it's also unethical because you are only delegating that insecurity onto your customers/users.
VarunAgw 11y ago
Every once in a while, I get difference error in /etc/issue*. I really hate all of these. I use Mint only because I like its GUI interface. I really cannot stand Ubuntu desktop for a moment
- spdionis 11y ago
  I also use Mint mostly because of its interface and i hate Ubuntu desktop too. Given this, what are the best alternatives to Mint GUI that offer the same level of comfort?
  - Kliment 11y ago
    There's a mate flavor of ubuntu out now, and it works wonderfully.
  - ergo14 11y ago
    Ubuntu Gnome - works VERY well - if you enable the "window list" plugin for shell, it works as well as cinnamon. You can also use some other distro like debian or fedora that also provides cinnamon.
    - RaleyField 11y ago
      > if you enable the "window list" plugin for shell And add minimize/maximize buttons and applications ("start") button. I have no idea why Gnome has to experiment, they have lost so many users unnecessarily. At least it's configurable to something sane. They are far from catering to the same feature-averse audience of iPad so there's no use in trying to (poorly) emulate its minimalist design language.
      - VarunAgw 11y ago
        That's why Linux Mint wins. It look completely like MS Windows. Taskbar, Icons, Keyboard Shortcuts,...everything is similar to MS Windows. As a Windows user, I find it most easier to use and that's why they are winning.
ouiyaaa 11y ago
People I understand your criticism, but may I suggest donating to them too if you've used Mint? Once his bills are paid off, maybe he'll spend more time worrying about Mint?
- jnbiche 11y ago
  Speaking for myself, I have donated multiple times to Mint. > Once his bills are paid off What bills are you talking about? As a result of this incident?
  - jmnicolas 11y ago
    I think he means that he has a job and Mint devs on Mint in his free time.
teekert 11y ago
An yet, it just works, looks nice, is fast on old hardware, mounts everything out of the box, controls your audio from the volume icon and gets out of your way in general. 17.3 is one the best out of box experiences imo.
- DonHopkins 11y ago
  How bad must desktop Linux in general be, if people are so busy rejoicing about a volume icon that works, that they accept poor security?
  - bitL 11y ago
    Poor security in what sense? That something can be spoofed by an attacker with unlimited resources? How many of your desktop users are actually at risk? How about Win 10 telemetry? Or whatever OS X is sending back to Apple? Happy about it?
    - ChrisClark 11y ago
      Did you read the article? Mint blocks many security patches because of the mish-mash of packages it has, makes updating impossible.
  - kedean 11y ago
    They mean from a usability perspective. Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks. It's like a tiny music player in your task bar. That said, no it should not excuse poor security.
    - mayhew 11y ago
      > Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks. GNOME and Unity also have that, probably KDE too.
    - 11y ago
mschuster91 11y ago
> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Seriously, with the rotten-ness of the US patent/copyright/political system, it's better for mankind to just say "ok, US users can't get this, but everyone else can". E.g. many European banks do this for "US persons" - they simply cannot get accounts because the legal risks are just too high. Edit: It's not just banks. E.g. BMW Group (and likely other huge non-US corps with US subsidiaries) refuse to allow US persons to look at financial statements, again due to regulatory hassle.
- smt88 11y ago
  > "ok, US users can't get this, but everyone else can" Setting aside for a minute that this isn't possible, it's like saying you won't release your app on iOS because of Apple's walled gardens. Sure, the walls suck, but the users inside are numerous and spend lots of money. Most product creators don't have the option to exclude US users.
  - beefsack 11y ago
    Not everyone is entirely driven by money, I choose not to write software for any of the walled gardens.
    - zymhan 11y ago
      Wait, so you avoid walled gardens by...exercising your right to include proprietary plugins in software?
  - cowl 11y ago
    Nobody is saying to not release for US (in fact you can choose to use the noCodex version) but Why Should problems in US or anywhere else limit the experience that everyone else can get?
  - oxguy3 11y ago
mhw 11y ago
Hmm; I'm puzzled by a contradiction between this and another recent article. From this article we learn that we shouldn't do this: "Secondly, they are mixing their own binary packages with binary packages from Debian and Ubuntu without rebuilding the latter. This creates something that we in Debian call a "FrankenDebian" which results in system updates becoming unpredictable <https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_FrankenDebian> https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_Frank.... With the result, that the Mint developers simply decided to blacklist certain packages from upgrades by default thus putting their users at risk because important security updates may not be installed." while from <https://news.ycombinator.com/item?id=11131081> https://news.ycombinator.com/item?id=11131081>: "Nobody else requires that you rebuild every package before you can redistribute it in a modified distribution - such a restriction is a violation of freedom 2 of the Free Software Definition, and as a result the binary distributions of Ubuntu are not free software." I appreciate that the latter one is discussing a hard requirement as a result of Canonical's IP licensing. But the former seems to indicate that it would be bad practice to just copy all of Ubuntu's (or Debian's) binary packages and build a new derivative distribution on top of it. Is the latter piece arguing in part for a freedom that would be a really bad idea in practice?
- claudius 11y ago
  > to just copy all of Ubuntu's (or Debian's) binary packages and build a new derivative distribution on top of it This is okay. However, copying Ubuntu’s and Debian’s packages into the same repository and then mixing them willy-nilly is not. You can either: a) Base your derivative on binaries from Debian xor Ubuntu, then add source packages compiled with these binaries as you like. or b) Base your derivative on sources from Debian and/or Ubuntu, then compile everything together with your custom packages to make sure that all ABIs match.
  - mhw 11y ago
    Ah, ok. So the issue is mixing binary packages from different distributions or different releases of the same distribution (the Debian doc mentions mixing Debian stable and testing for example). If that's what Mint are doing then I'm surprised they aren't stuck in perpetual dependency hell.
borplk 11y ago
Is there a way for me to get the Mint Cinnamon experience with Ubuntu under the hood? The last time I tried I couldn't get it to work in a painless/reliable way.
- lucb1e 11y ago
  What do you need Ubuntu for? I loved the Cinnamon experience and was used to dpkg/apt-get, so wanting a rolling release with up to date software, Debian was the easy choice. Choose Cinnamon in the installer and basically you're set.
- jcastro 11y ago
  You can just `sudo apt-get install cinnamon-desktop-environment`.
pweissbrod 11y ago
I guess this is what you get when you try to make a cathedral out of the bazaar
unixhero 11y ago
I realize they have not taken security seriously in designing their delivery mechanisms. However I do not care. Linux Mint solves all my problems of configuration. It is configured so nicely and with Cinnamon it comes with so many useful bells and whistles, I'm not moving anywhere. It's great. Mint will be back after this blow and I am sure it will not happen again. I use it daily and I am super productive on it as my desktop. My family uses it also, on new and old computers, and it is perfect.
- splintercell 11y ago
  This. Because of Linux Mint, I don't even notice my Operating System anymore(which is a good thing). Everybody else here is recommending 'safer' options, but seriously I don't want to pay the cost of fighting with my OS (which is what every Linux experience has been for me since 1996). Linux Mint has been the only OS which makes me forget that I am using Linux. It beats OS X in almost everything.
- RaleyField 11y ago
  > I realize they have not taken security seriously in designing their delivery mechanisms. However I do not care. I hope then that you don't use you computer for developing software or for work or anything remotely important, because otherwise using insecure software is most egregiously unethical towards your users/customers/employers because you are consciously choosing to exposing them to unnecessary risks.
bitL 11y ago
As a super happy user of Linux Mint - guys, please keep doing what you are doing! Thank you so much for giving us a proper desktop Linux! You have my (financial) support! Don't get pressured by some random loud Internet criticism and change for worse! Please don't do Win7->Win8 or iOS6->iOS7 regression in Mint as well because of a few unhappy voices trying to acquire power over you!
- hotcool 11y ago
  I'm going to back you up on this. I'm sorry to hear there are problems, but I won't be switching OS's. Mint has been rock solid for me.
  - flurpitude 11y ago
    It has been stable and reliable for me too. But the concern is not about reliability so much as security: some patches are not delivered due to the way Mint (apparently) mixes binaries from Debian and Ubuntu. It may be quite reliable but still insecure.
lucaspottersky 11y ago
ironically, by not caring about copyrights and such, they provide a better User Experience!
bitL 11y ago
Mint's HiDPI is simply the best experience on Linux these days, not to mention it just works. But let's attack it because it doesn't conform to some autistic standards of ours. Way to go friendly Linux community! Let's make all distros unusable, super complex, require all people to wear their own personal TPMs and certificates so that they can feel finally secure. Let's blame Mint for not having DNA real-time sequencers for confirming package authenticity! Let's force my grandma to compile all her packages - she must be upgraded as well or she won't make it during singularity, right? /s You are blaming Mint for things that are wrong in some context with Debian/Ubuntu or Linux or even unsolved in computing as such. And the small team of developers simply can't respond to every single issue within minutes as you wish, they have their plate full.
- ergo14 11y ago
  Sorry between Mint and Gnome 3 - Gnome seems to have better HiDPI support, but cinnamon is close :)
  - cookiecaper 11y ago
    Gnome 3 only allows whole integer steps in DPI scaling. This means that the options for me are a) too small at 1x or b) too big at 2x. I use a scale factor of 1.4x in KDE. I haven't tested on Cinnamon, so I don't know if it accepts non-integers for scaling.
    - ergo14 11y ago
      It doesn't I tried this recently ;) I would gladly use KDE - I like it, but this https://bugs.kde.org/show_bug.cgi?id=162211 https://bugs.kde.org/show_bug.cgi?id=162211 is still not fixed after so many years (and no - the title is not updated - it doesn't affect only remote media)
incepted 11y ago
I thought this was about mint.com... Relieved.
geostyx 11y ago
I've been using Mint for the past month or so, should I be using something else?
- kuschkufan 11y ago
  Given the grave lapses that are described here, I hope it's obvious to you that absolutely yes, you should be using something else. I'll guess that Ubuntu might be your cup of tea.
  - lucb1e 11y ago
    "Obvious"? Now you are turning criticism from the thread into FUD. I used mint for a long time and really liked it. By issue with it was twofold: old packages and non-rolling release. But if those are not immediate concerns, I'd still recommend it to anyone wanting to try Linux.
  - geostyx 11y ago
    Yeah you're right. Downloading Ubuntu now.
    - lucb1e 11y ago
      Don't have to believe everything on the Internet, including me, but I wouldn't be so fast. Ubuntu's interface is so annoying, I've seen many people turned away from Linux because of it and that's just a shame.
    - knd775 11y ago
      Ubuntu mate has the same desktop environment as Mint with Ubuntu underneath it. https://ubuntu-mate.org/ https://ubuntu-mate.org/
    - jason46 11y ago
      The issues described are not going to impact the average user, and due to some of these issues Mint would probably be more convenient, for the average user.
rpgmaker 11y ago
This post is pretty damning. I was considering using Mint at some point but after this I will stay away.
stuaxo 11y ago
There are way less Mint developers than others, and it is mainly user driven. - So of course it less likely to be professional, at the same time it is more user driven.
AdmiralAsshat 11y ago
So, functionally, is there any real difference between using Mint's ISO to install-from-scratch versus using you're preferred distro of choice (Ubuntu/Fedora/FreeBSD, etc.) and installing the Cinnamon Mint desktop on top of it? I've been playing with Mint for the past few weeks and experimenting with full-Mint-on-a-VM versus Ubuntu-with-Cinnamon-desktop, and I don't really notice much of a difference. After reading about all of Mint's problems this morning, I'm tempted to stick with Cinnamon exclusively as a DE unless someone offers a compelling reason to use the full distro.
- RaleyField 11y ago
  > So, functionally, is there any real difference between using Mint's ISO to install-from-scratch versus using you're preferred distro of choice (Ubuntu/Fedora/FreeBSD, etc.) and installing the Cinnamon Mint desktop on top of it? No. Switch to another DE. Cinnamon is developed by the same gung-ho cowboys that develop Mint so that's a poor indication that it's managed any better than Mint itself.
BuckRogers 11y ago
I see a lot of people asking for alternatives. I spent 12 months trying almost every distro I could get my hands on and have some recommendations for those interested. This was my shortlist at the end of all my adventurism and testing. 1. Linux Mint 2. Ubuntu MATE 3. Antergos Cinnamon Pretty short list but those are what I found I settled on as possible choices for my own use. If the goal is getting down to business and getting work done rather than fiddling with the system I think those 3 would fit most people's needs. I was a longtime Xubuntu user prior to this adventurism, and IMO there are just better alternatives though it would probably be #4 if I had one, but I'm just not a fan any longer. MATE man handles XFCE. I leave Mint at the top because other than these security concerns, it remains the best distro for me. I love their LTS update policy, continually delivering updates to Mint during the entire support span of Ubuntu LTS. Their desktop env is also just better IMO than alternatives. Ubuntu MATE is pretty good and for the type of person like myself who is drawn to Mint, would be a really good alternative. It's missing a few features of Cinnamon, which is superior in general for me to MATE. But overall this is what I'll install if I decided to ditch Mint. Antergos is just Arch with a nice installer. I didn't spend a long time testing this but it would be my choice for a rolling distro. Many people I know want that and they offer Cinnamon as a main, supported environment. Might be the best of every world for some. I prefer the slower updates of LM and UM, and install newer packages through PPAs or compiling it. As an aside, I have completely given up installing other desktop environments onto distros that didn't originally ship with them. I see people recommending that, and it may work out but it's a mess if you want to switch back in my experience. I prefer to pick a distro that ships with the DE of your choice. I would not run for example, 'sudo apt-get install cinnamon-desktop-environment', anywhere at any point. :) Hopefully this helps someone out there looking to migrate off of Mint. I'm still using it (on 17.2 here) but may move to UbuntuMATE or Antergos Cinnamon, depending on Clem's response.
Mikeb85 11y ago
I've tried Mint. It's basically Ubuntu + a bunch of bugs. The quality is seriously sub-par, I'd much rather use any 'official' Ubuntu derivative.

472 points by temp 11y ago

icebraining 11y ago

Could [Linux] be added before Mint? I thought it was about Mint.com

sokoloff 11y ago
Original page title is more communicative (so I suspect dang will fix it when he notices): Linux Mint downloads (briefly) compromised
- mintplant 11y ago
  The linked page is actually a comment on an LWN article with that title. Changing the submission title to that wouldn't reflect the content being highlighted here.
  - sokoloff 11y ago
    I don't want to have a lengthy meta-discussion about titles, but as someone who is not in the mint community (either one), the HTML page title of the comment thread linked is more informative than the editorialized-by-excerpting text from the comment body.
    - JBReefer 11y ago
      But I don't know how much you can trust Canonical these days to not fuck things up on a whim.
- bkor 11y ago
  Note that this suggested title is outdated as Mint was compromised twice. Meaning, it is not so brief anymore. The comment itself is more about the security practices. More ontopic: Having your Wordpress instance compromised is rather expected with the amount of security bugs Wordpress gets.
randycupertino 11y ago
Ditto. To be fair, Mint.com has been a lot more buggy lately.

m00dy 11y ago

Whos using Mint these days anyway ?

cfontes 11y ago
I am not one, but lot's of people. Most switched off from Ubuntu, landed a stayed there.
- Ygg2 11y ago
  I've found Xubuntu to be a pretty decent albeit simple environment. Runs great on my VM too.
  - raverbashing 11y ago
    XFCE gets simplicity right, as opposed to Gnome or Unity
  - samuell 11y ago
    Indeed. I never got why people are not just sticking with Xubuntu. It is the most solid, reliable, balanced and beautiful distro I have ever tried. Everytime I tried something else, I finally came back to Xubuntu, and try to remind myself to never switch away again.
    - cowl 11y ago
      Maybe because the company behind Ubuntu has practically declared the desktop dead and we want a desktop that is really a desktop and not some future(already dead)fantasy all in one? Yes Xubuntu is a desktop but i'm not waiting around for the axe to fall and try again to force unity on everyone... I had to change once, better change to distro that is commited to the desktop.
    - ergo14 11y ago
      Because some things are broken in xubuntu - like wacom tablet configuration is missing :(
- 11y ago

onlycommenting 11y ago

There's something interesting to be said here. "They make {{ package }} unusable by hijacking it's name space", well who gave them that name space? I understand the whole first come first serve and all but if we played that way things could get messy real fast. There was recently an article on HN about the "Web of Hashes" and this article got me thinking about it. Why not give each application an UUID and let that be it's name space? Give the user an option to still use- they're example- xedit while having another xedit installed along side? I can see how this could also get messy. Just spit balling here.

JupiterMoon 11y ago
Check out NixOS
- obelisk_ 11y ago
  Personally I switched from Ubuntu to Fedora a couple of days ago because I've had it with Canonical. It was the first time I switched distro almost since I started using Linux (though I've admined servers with other distros and other OSes in the meantime). I am satisfied with Fedora thus far.
- smt88 11y ago
  I absolutely love the concept of NixOS, but I haven't tried it out. Is it well-supported enough to use day-to-day as a developer? Do you often have to build things from source?
  - mjhoy 11y ago
    It's worth playing with to see if it could fit into your work; for instance, the Haskell ecosystem is very well supported, while Ruby seems to have issues. I am now using it for work on some of my projects. Generally you won't have to compile from source; that said I did recompile glibc when that last bug hit. (Security updates for core packages are not a great story now.) It's not perfect, but it's very hackable.
  - deleted 11y ago

embik 11y ago

> Secondly, they are mixing their own binary packages with binary packages from Debian and Ubuntu without rebuilding the latter. This creates something that we in Debian call a "FrankenDebian" which results in system updates becoming unpredictable This is interesting because Debian itself encourages derivative projects to use their binary packages[1]: > For those derivatives that re-use Debian binary packages, add some source packages and modify some source packages, where possible we encourage them to use standard Debian mirrors and add a second repository containing only the source and binary packages that have been added or modified. Or maybe they don't encourage that behaviour but still give guidelines in case you want your derivative to work that way? I'm not 100% sure. [1] https://wiki.debian.org/Derivatives/Guidelines https://wiki.debian.org/Derivatives/Guidelines

asb 11y ago
I believe the problem is the mixing of Debian and Ubuntu binaries rather than the fact they're not recompiling everything. Ubuntu doesn't just take Debian and add a few extra packages - it's a complete recompile with package versions likely don't match any Debian release.
- embik 11y ago
  Oh, Linux Mint mixes Debian and Ubuntu packages by default? I was under the impression that there is Linux Mint based on Ubuntu and Linux Mint Debian Edition based on Debian.
  - tremon 11y ago
    Yes. Linux Mint was based on Ubuntu but still would pull packages from Debian unstable. LMDE was based purely on Debian.

kozukumi 11y ago

Fucking bang on point. Mint has a nice out of the box experience but after using it for a while you begin to see all the shit they stuffed in the cracks. It is a shame as Cinnamon is a lovely DE, I wish there were an official Ubuntu build with Cinnamon as the default DE similar to Xubuntu with Xfce.

downtide 11y ago
I've felt the same thing with many Ubuntu releases.
mayhew 11y ago
Installing Ubuntu GNOME and then installing Cinnamon would give you a nearly identical setup. Cinnamon is basically just a replacement for GNOME Shell. You could also install Nemo if you prefer that file manager.

akerro 11y ago

I had to quit using Mint because a lot of packages in their repo are really, really, old. Just to give example that made me install Manjaro on friends PC is ownCloud client for file syncing. It's a few years old, contains a lot of security bugs and doesn't work with HTTPS. You need to add repo with opensuse in URL address. Mint developers were contacted by ownCloud developers to resolve the issue, a few years ago, and they ignored it.

creshal 11y ago
Manjaro, really? The one distribution with a worse security track record than Mint? "Our SSL certificate expired, please change your computer clocks one year back" Manjaro?
- akerro 11y ago
  Yea, I know, I expected this answer. I needed something quick to install, not deb... and with latest versions of packages. I was thinking about Arch, but it's too long to install, I had ~20 minutes. Manjaro is ok to people how know what they're doing and who know how to setup basic features of OS.
  - creshal 11y ago
    Antergos is a hands-free installer for Arch that doesn't cripple the installed system with unreliable third-party repositories.

XorNot 11y ago

Never let a good security breach not be an opportunity to air a bunch of unrelated greviences, apparently.

izacus 11y ago

creshal 11y ago
It's user friendly, yes, but also reckless. The distro won't "work" any more if it gets sued into oblivion by Oracle, Adobe, Nvidia, AMD and whoever else feels like kicking puppies.
- izacus 11y ago
  Hmm, why would they be. Mint already offers a special version for people living in countries where they can be sued for installing a video decoder or a video driver - it's called a "No codecs" version and it's meant for users in USA and Japan. Suing in the rest of the world would be a rather wasted effort right now.
- takluyver 11y ago
  The flip side is that if you believe that laws like those around software patents should change, someone ignoring them and taking the risk of being sued is a more compelling demonstration than carefully observing the rules and then complaining about them on HN. More pragmatically, it seems unlikely that Oracle or Adobe will sue a distro for helping them distribute the Java/Flash runtimes. They want their runtime to be on as many devices as possible.
  - creshal 11y ago
    > The flip side is that if you believe that laws like those around software patents should change, someone ignoring them and taking the risk of being sued is a more compelling demonstration than carefully observing the rules and then complaining about them on HN. As EU citizen I have zero influence on US politics. Complaining on HN to US citizens is literally all I can do. > More pragmatically, it seems unlikely that Oracle or Adobe will sue a distro for helping them distribute the Java/Flash runtimes. Then maybe those companies should change their license terms. Right now, Adobe does not even allow you to use a downloaded Flash installer on two computers, you must either download it separately on each PC or apply for a special license: http://www.adobe.com/products/players/flash-player-distribution.html http://www.adobe.com/products/players/flash-player-distribut... If they want to shoot themselves in their feet, I'm not going to interfere.

jnbiche 11y ago

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age. This recent security issue, and the poor response to it, are basically the straw that breaks the camel's back for me. I'm moving on to Ubuntu-Mate, since frankly Mate was the primary reason I was using Mint anyway. Serving downloads of the most popular Linux distro from the same machine as is running WordPress is cringeworthy, and failing to take the compromised machine totally offline until it's 100% sure the compromise has been mitigated (through reformatting, including boot sector) shows really poor judgment. I'm a bit sad to be so critical, since I recognize that Clem has done a lot for the Linux world, and as a Mint user I've benefited personally from his work. But when you're distributing operating systems to so many users, you have to take security seriously. To do otherwise, even on a "hobby" project (although I'm fairly sure it's his full-time job now) is pretty irresponsible. In many ways, I'd like to pitch in, but based on other interactions I've seen and read about, I'm not sure my input would be welcome, particularly wrt security issues. Edit: I'm also playing around with FreeBSD for my development environment, since I can use Mate on there. To be honest, I don't really need a DE these days anyway, since I only use terminal and a web browser. I should look into just using a Windows Manager. Edit 2: Apparently they do provide GPG signed hashes. I've been looking for them each time I've downloaded Mint distros, but never came upon them. So I stand corrected.

theandrewbailey 11y ago
I put my parents on Xubuntu about 5 years ago on a whim, then moved them over to Mint about 2 years later. About a year-ish ago, I saw that Xubuntu was using whisker-menu (main UI menu with a search box like Windows) I put them back on it and went back, myself.
venomsnake 11y ago
GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give your signature and key fingerprint.

wfunction 11y ago

When I read the title I thought this was about Mint.com... perhaps it should be changed to "Linux Mint" or something?

mmahemoff 11y ago
+1. I wasn't sure if it was about Mint.com or the analytics tool http://haveamint.com/ http://haveamint.com/. Wrong on both counts.
_fabio 11y ago
same
DonHopkins 11y ago
Unfortunately waferthinmint.com was taken. [1] [1] https://www.youtube.com/watch?v=aczPDGC3f8U https://www.youtube.com/watch?v=aczPDGC3f8U

snarfy 11y ago

I remember installing it when it was relatively new and people were gushing over it. A few weeks later a new version came out. I tried upgrading when I found there was no upgrade path. Upgrading Mint means reinstalling Mint. I remember the days before apt-get when there was only dpkg. Before Debian I used Slackware so I'm all too familiar with package management (or lack of). The idea that someone would release a new distribution, based on Debian of all things, and it not be able to upgrade was repelling to my mind. Re-install Mint to upgrade? No thanks I'll install Ubuntu over it. Cinnamon is nice but I never understood why it needs its own distribution. I should be able to apt-get install cinammon-desktop or whatever and it work like any other package.

bildung 11y ago
> Cinnamon is nice but I never understood why it needs its own distribution. I should be able to apt-get install cinammon-desktop or whatever and it work like any other package. On Debian you actually can 'apt-get install cinnamon' and have the full desktop.
- PerryCox 11y ago
  There is also a Fedora spin with Cinnamon as the default DE: https://spins.fedoraproject.org/en/cinnamon/ https://spins.fedoraproject.org/en/cinnamon/
versteegen 11y ago
I'm sorry for the rant, it's a bit off topic and not called for, but would like to say my experience is sort of the opposite: I've been a Slackware-current user for most of a decade, and I love that it's so easy to upgrade the OS using slackpkg. I can (and do) often only upgrade a subset of packages, and never even need to reboot afterwards, not even after replacing the kernel (although, obviously...). A simple package system without dependency tracking has had many advantages for me. But installing stuff not in the standard system is more of a pain; there are third party repos but no where near as convenient as Debian/Ubuntu. I compile a couple SlackBuilds (packages) per week. I admit I've spent a huge amount of time learning how to do things like that manually and wouldn't recommend Slackware to those who won't want to learn sysadmin. On the other hand my experience with upgrading between Ubuntu releases is terrible. A number of things have broken, permanently, every time, and I can't trivially upgrade from Ubuntu 14.10, because they purposefully break the package manager in old releases by breaking URLs. Also other pain points, like it not allowing installing both 32 and 64 bit devel libraries. I need those! The package manager is too complex and clever for me. (Honestly, I don't want to spend time learning how to override it.) I'm planning to format the drive and reinstall from scratch because it seems easier than fixing it.

red_admiral 11y ago

Starting a post with "I know this is voluntary work, pitch in or shut up and all that ..." doesn't make the quote you're attacking untrue. For what I'm paying for Mint ($0.00) and what I get out of it in terms of productivity, I find it quite a decent distribution.

dineshp2 11y ago
Accepting poor security practices from the Linux mint developers cannot be justified just because you are not paying anything. Open source projects need to be held to the very highest security standards. How these security breaches are handled today set a precedent for how such security breaches are handled in the future. So it's a good idea to learn and improve from such security breaches and set a positive precedent.
smt88 11y ago
If Mint advertised, "Free to download, but also free of good security practices", then I could buy this argument. The problem is that Mint allows users to trust it. It would be better if they didn't work on the distro at all if they're not going to take security seriously. People on HN become furious about antivirus programs and routers and whatever else that are discovered to be laughably insecure. An OS is no less of security product than A/V or a router. In fact, it's the first line of defense for an end user.
DonHopkins 11y ago
Poor security is more expensive than money.
- RaleyField 11y ago
  And unless you are using your computer only for media consumption it's also unethical because you are only delegating that insecurity onto your customers/users.

VarunAgw 11y ago

Every once in a while, I get difference error in /etc/issue*. I really hate all of these. I use Mint only because I like its GUI interface. I really cannot stand Ubuntu desktop for a moment

spdionis 11y ago
I also use Mint mostly because of its interface and i hate Ubuntu desktop too. Given this, what are the best alternatives to Mint GUI that offer the same level of comfort?
- Kliment 11y ago
  There's a mate flavor of ubuntu out now, and it works wonderfully.
- ergo14 11y ago
  Ubuntu Gnome - works VERY well - if you enable the "window list" plugin for shell, it works as well as cinnamon. You can also use some other distro like debian or fedora that also provides cinnamon.
  - RaleyField 11y ago
    > if you enable the "window list" plugin for shell And add minimize/maximize buttons and applications ("start") button. I have no idea why Gnome has to experiment, they have lost so many users unnecessarily. At least it's configurable to something sane. They are far from catering to the same feature-averse audience of iPad so there's no use in trying to (poorly) emulate its minimalist design language.
    - VarunAgw 11y ago
      That's why Linux Mint wins. It look completely like MS Windows. Taskbar, Icons, Keyboard Shortcuts,...everything is similar to MS Windows. As a Windows user, I find it most easier to use and that's why they are winning.

ouiyaaa 11y ago

People I understand your criticism, but may I suggest donating to them too if you've used Mint? Once his bills are paid off, maybe he'll spend more time worrying about Mint?

jnbiche 11y ago
Speaking for myself, I have donated multiple times to Mint. > Once his bills are paid off What bills are you talking about? As a result of this incident?
- jmnicolas 11y ago
  I think he means that he has a job and Mint devs on Mint in his free time.

teekert 11y ago

An yet, it just works, looks nice, is fast on old hardware, mounts everything out of the box, controls your audio from the volume icon and gets out of your way in general. 17.3 is one the best out of box experiences imo.

DonHopkins 11y ago
How bad must desktop Linux in general be, if people are so busy rejoicing about a volume icon that works, that they accept poor security?
- bitL 11y ago
  Poor security in what sense? That something can be spoofed by an attacker with unlimited resources? How many of your desktop users are actually at risk? How about Win 10 telemetry? Or whatever OS X is sending back to Apple? Happy about it?
  - ChrisClark 11y ago
    Did you read the article? Mint blocks many security patches because of the mish-mash of packages it has, makes updating impossible.
- kedean 11y ago
  They mean from a usability perspective. Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks. It's like a tiny music player in your task bar. That said, no it should not excuse poor security.
  - mayhew 11y ago
    > Mint is famous for it's volume icon that includes album art for what's playing, various other info, and controls to let you pause/skip tracks. GNOME and Unity also have that, probably KDE too.
  - 11y ago

mschuster91 11y ago

> Add to that, that they do not care about copyright and license issues and just ship their ISOs with pre-installed Oracle Java and Adobe Flash packages and several multimedia codec packages which infringe patents and may therefore not be distributed freely at all in countries like the US. Seriously, with the rotten-ness of the US patent/copyright/political system, it's better for mankind to just say "ok, US users can't get this, but everyone else can". E.g. many European banks do this for "US persons" - they simply cannot get accounts because the legal risks are just too high. Edit: It's not just banks. E.g. BMW Group (and likely other huge non-US corps with US subsidiaries) refuse to allow US persons to look at financial statements, again due to regulatory hassle.

smt88 11y ago
> "ok, US users can't get this, but everyone else can" Setting aside for a minute that this isn't possible, it's like saying you won't release your app on iOS because of Apple's walled gardens. Sure, the walls suck, but the users inside are numerous and spend lots of money. Most product creators don't have the option to exclude US users.
- beefsack 11y ago
  Not everyone is entirely driven by money, I choose not to write software for any of the walled gardens.
  - zymhan 11y ago
    Wait, so you avoid walled gardens by...exercising your right to include proprietary plugins in software?
- cowl 11y ago
  Nobody is saying to not release for US (in fact you can choose to use the noCodex version) but Why Should problems in US or anywhere else limit the experience that everyone else can get?
- oxguy3 11y ago

mhw 11y ago

Hmm; I'm puzzled by a contradiction between this and another recent article. From this article we learn that we shouldn't do this: "Secondly, they are mixing their own binary packages with binary packages from Debian and Ubuntu without rebuilding the latter. This creates something that we in Debian call a "FrankenDebian" which results in system updates becoming unpredictable <https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_FrankenDebian> https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_Frank.... With the result, that the Mint developers simply decided to blacklist certain packages from upgrades by default thus putting their users at risk because important security updates may not be installed." while from <https://news.ycombinator.com/item?id=11131081> https://news.ycombinator.com/item?id=11131081>: "Nobody else requires that you rebuild every package before you can redistribute it in a modified distribution - such a restriction is a violation of freedom 2 of the Free Software Definition, and as a result the binary distributions of Ubuntu are not free software." I appreciate that the latter one is discussing a hard requirement as a result of Canonical's IP licensing. But the former seems to indicate that it would be bad practice to just copy all of Ubuntu's (or Debian's) binary packages and build a new derivative distribution on top of it. Is the latter piece arguing in part for a freedom that would be a really bad idea in practice?

claudius 11y ago
> to just copy all of Ubuntu's (or Debian's) binary packages and build a new derivative distribution on top of it This is okay. However, copying Ubuntu’s and Debian’s packages into the same repository and then mixing them willy-nilly is not. You can either: a) Base your derivative on binaries from Debian xor Ubuntu, then add source packages compiled with these binaries as you like. or b) Base your derivative on sources from Debian and/or Ubuntu, then compile everything together with your custom packages to make sure that all ABIs match.
- mhw 11y ago
  Ah, ok. So the issue is mixing binary packages from different distributions or different releases of the same distribution (the Debian doc mentions mixing Debian stable and testing for example). If that's what Mint are doing then I'm surprised they aren't stuck in perpetual dependency hell.

borplk 11y ago

Is there a way for me to get the Mint Cinnamon experience with Ubuntu under the hood? The last time I tried I couldn't get it to work in a painless/reliable way.

lucb1e 11y ago
What do you need Ubuntu for? I loved the Cinnamon experience and was used to dpkg/apt-get, so wanting a rolling release with up to date software, Debian was the easy choice. Choose Cinnamon in the installer and basically you're set.
jcastro 11y ago
You can just `sudo apt-get install cinnamon-desktop-environment`.

pweissbrod 11y ago

I guess this is what you get when you try to make a cathedral out of the bazaar

unixhero 11y ago

I realize they have not taken security seriously in designing their delivery mechanisms. However I do not care. Linux Mint solves all my problems of configuration. It is configured so nicely and with Cinnamon it comes with so many useful bells and whistles, I'm not moving anywhere. It's great. Mint will be back after this blow and I am sure it will not happen again. I use it daily and I am super productive on it as my desktop. My family uses it also, on new and old computers, and it is perfect.

splintercell 11y ago
This. Because of Linux Mint, I don't even notice my Operating System anymore(which is a good thing). Everybody else here is recommending 'safer' options, but seriously I don't want to pay the cost of fighting with my OS (which is what every Linux experience has been for me since 1996). Linux Mint has been the only OS which makes me forget that I am using Linux. It beats OS X in almost everything.
RaleyField 11y ago
> I realize they have not taken security seriously in designing their delivery mechanisms. However I do not care. I hope then that you don't use you computer for developing software or for work or anything remotely important, because otherwise using insecure software is most egregiously unethical towards your users/customers/employers because you are consciously choosing to exposing them to unnecessary risks.

bitL 11y ago

As a super happy user of Linux Mint - guys, please keep doing what you are doing! Thank you so much for giving us a proper desktop Linux! You have my (financial) support! Don't get pressured by some random loud Internet criticism and change for worse! Please don't do Win7->Win8 or iOS6->iOS7 regression in Mint as well because of a few unhappy voices trying to acquire power over you!

hotcool 11y ago
I'm going to back you up on this. I'm sorry to hear there are problems, but I won't be switching OS's. Mint has been rock solid for me.
- flurpitude 11y ago
  It has been stable and reliable for me too. But the concern is not about reliability so much as security: some patches are not delivered due to the way Mint (apparently) mixes binaries from Debian and Ubuntu. It may be quite reliable but still insecure.

lucaspottersky 11y ago

ironically, by not caring about copyrights and such, they provide a better User Experience!

bitL 11y ago

Mint's HiDPI is simply the best experience on Linux these days, not to mention it just works. But let's attack it because it doesn't conform to some autistic standards of ours. Way to go friendly Linux community! Let's make all distros unusable, super complex, require all people to wear their own personal TPMs and certificates so that they can feel finally secure. Let's blame Mint for not having DNA real-time sequencers for confirming package authenticity! Let's force my grandma to compile all her packages - she must be upgraded as well or she won't make it during singularity, right? /s You are blaming Mint for things that are wrong in some context with Debian/Ubuntu or Linux or even unsolved in computing as such. And the small team of developers simply can't respond to every single issue within minutes as you wish, they have their plate full.

ergo14 11y ago
Sorry between Mint and Gnome 3 - Gnome seems to have better HiDPI support, but cinnamon is close :)
- cookiecaper 11y ago
  Gnome 3 only allows whole integer steps in DPI scaling. This means that the options for me are a) too small at 1x or b) too big at 2x. I use a scale factor of 1.4x in KDE. I haven't tested on Cinnamon, so I don't know if it accepts non-integers for scaling.
  - ergo14 11y ago
    It doesn't I tried this recently ;) I would gladly use KDE - I like it, but this https://bugs.kde.org/show_bug.cgi?id=162211 https://bugs.kde.org/show_bug.cgi?id=162211 is still not fixed after so many years (and no - the title is not updated - it doesn't affect only remote media)

incepted 11y ago

I thought this was about mint.com... Relieved.

geostyx 11y ago

I've been using Mint for the past month or so, should I be using something else?

kuschkufan 11y ago
Given the grave lapses that are described here, I hope it's obvious to you that absolutely yes, you should be using something else. I'll guess that Ubuntu might be your cup of tea.
- lucb1e 11y ago
  "Obvious"? Now you are turning criticism from the thread into FUD. I used mint for a long time and really liked it. By issue with it was twofold: old packages and non-rolling release. But if those are not immediate concerns, I'd still recommend it to anyone wanting to try Linux.
- geostyx 11y ago
  Yeah you're right. Downloading Ubuntu now.
  - lucb1e 11y ago
    Don't have to believe everything on the Internet, including me, but I wouldn't be so fast. Ubuntu's interface is so annoying, I've seen many people turned away from Linux because of it and that's just a shame.
  - knd775 11y ago
    Ubuntu mate has the same desktop environment as Mint with Ubuntu underneath it. https://ubuntu-mate.org/ https://ubuntu-mate.org/
  - jason46 11y ago
    The issues described are not going to impact the average user, and due to some of these issues Mint would probably be more convenient, for the average user.

rpgmaker 11y ago

This post is pretty damning. I was considering using Mint at some point but after this I will stay away.

stuaxo 11y ago

There are way less Mint developers than others, and it is mainly user driven. - So of course it less likely to be professional, at the same time it is more user driven.

AdmiralAsshat 11y ago

So, functionally, is there any real difference between using Mint's ISO to install-from-scratch versus using you're preferred distro of choice (Ubuntu/Fedora/FreeBSD, etc.) and installing the Cinnamon Mint desktop on top of it? I've been playing with Mint for the past few weeks and experimenting with full-Mint-on-a-VM versus Ubuntu-with-Cinnamon-desktop, and I don't really notice much of a difference. After reading about all of Mint's problems this morning, I'm tempted to stick with Cinnamon exclusively as a DE unless someone offers a compelling reason to use the full distro.

RaleyField 11y ago
> So, functionally, is there any real difference between using Mint's ISO to install-from-scratch versus using you're preferred distro of choice (Ubuntu/Fedora/FreeBSD, etc.) and installing the Cinnamon Mint desktop on top of it? No. Switch to another DE. Cinnamon is developed by the same gung-ho cowboys that develop Mint so that's a poor indication that it's managed any better than Mint itself.

BuckRogers 11y ago

I see a lot of people asking for alternatives. I spent 12 months trying almost every distro I could get my hands on and have some recommendations for those interested. This was my shortlist at the end of all my adventurism and testing. 1. Linux Mint 2. Ubuntu MATE 3. Antergos Cinnamon Pretty short list but those are what I found I settled on as possible choices for my own use. If the goal is getting down to business and getting work done rather than fiddling with the system I think those 3 would fit most people's needs. I was a longtime Xubuntu user prior to this adventurism, and IMO there are just better alternatives though it would probably be #4 if I had one, but I'm just not a fan any longer. MATE man handles XFCE. I leave Mint at the top because other than these security concerns, it remains the best distro for me. I love their LTS update policy, continually delivering updates to Mint during the entire support span of Ubuntu LTS. Their desktop env is also just better IMO than alternatives. Ubuntu MATE is pretty good and for the type of person like myself who is drawn to Mint, would be a really good alternative. It's missing a few features of Cinnamon, which is superior in general for me to MATE. But overall this is what I'll install if I decided to ditch Mint. Antergos is just Arch with a nice installer. I didn't spend a long time testing this but it would be my choice for a rolling distro. Many people I know want that and they offer Cinnamon as a main, supported environment. Might be the best of every world for some. I prefer the slower updates of LM and UM, and install newer packages through PPAs or compiling it. As an aside, I have completely given up installing other desktop environments onto distros that didn't originally ship with them. I see people recommending that, and it may work out but it's a mess if you want to switch back in my experience. I prefer to pick a distro that ships with the DE of your choice. I would not run for example, 'sudo apt-get install cinnamon-desktop-environment', anywhere at any point. :) Hopefully this helps someone out there looking to migrate off of Mint. I'm still using it (on 17.2 here) but may move to UbuntuMATE or Antergos Cinnamon, depending on Clem's response.

Mikeb85 11y ago

I've tried Mint. It's basically Ubuntu + a bunch of bugs. The quality is seriously sub-par, I'd much rather use any 'official' Ubuntu derivative.