8 ms·

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm

by jnbiche 11y ago

I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I'm not bothered by the licensing issues mentioned, and I'm ambivalent about the namespace issues, but I've been increasingly uneasy for some time now about Mint's security practices. Serving downloads over http and not providing GPG signed SHA hashes like every other distro is fairly irresponsible in this day and age. This recent security issue, and the poor response to it, are basically the straw that breaks the camel's back for me. I'm moving on to Ubuntu-Mate, since frankly Mate was the primary reason I was using Mint anyway. Serving downloads of the most popular Linux distro from the same machine as is running WordPress is cringeworthy, and failing to take the compromised machine totally offline until it's 100% sure the compromise has been mitigated (through reformatting, including boot sector) shows really poor judgment. I'm a bit sad to be so critical, since I recognize that Clem has done a lot for the Linux world, and as a Mint user I've benefited personally from his work. But when you're distributing operating systems to so many users, you have to take security seriously. To do otherwise, even on a "hobby" project (although I'm fairly sure it's his full-time job now) is pretty irresponsible. In many ways, I'd like to pitch in, but based on other interactions I've seen and read about, I'm not sure my input would be welcome, particularly wrt security issues. Edit: I'm also playing around with FreeBSD for my development environment, since I can use Mate on there. To be honest, I don't really need a DE these days anyway, since I only use terminal and a web browser. I should look into just using a Windows Manager. Edit 2: Apparently they do provide GPG signed hashes. I've been looking for them each time I've downloaded Mint distros, but never came upon them. So I stand corrected.

theandrewbailey 11y ago
I put my parents on Xubuntu about 5 years ago on a whim, then moved them over to Mint about 2 years later. About a year-ish ago, I saw that Xubuntu was using whisker-menu (main UI menu with a search box like Windows) I put them back on it and went back, myself.
venomsnake 11y ago
GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give your signature and key fingerprint.
- jnbiche 11y ago
  The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the signature page is defaced. If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly. I've had many signatures for package signers in my keyring for 5+ years. If and when they replace the key, they let the community know and we update our keyrings. Yes, if you don't want to do that, fine, but for those of us who are careful users of GPG, it's a huge barrier against malware in packages and distros.
  - venomsnake 11y ago
    I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.
    - berdario 11y ago
      You can use gpg on windows or macosx as well to verify the signed hashes. As linked in the blog post in my other comment, tails explains things quite well: https://tails.boum.org/download/index.en.html#verify https://tails.boum.org/download/index.en.html#verify
    - jnbiche 11y ago
      If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows: 1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers. Even if you haven't previously established trust, GPG can be an extremely valuable ally.
deleted 11y ago
[deleted]
- nailer 11y ago
  No consumer OS since Windows Me logs in with a system account by default. Linux Mint sucks, but I'm pretty much OK with disabling autologin to root.
  - RaleyField 11y ago
    > No consumer OS since Windows Me logs in with a system account by default. About that. > It’s important to be aware that UAC elevations are conveniences and not security boundaries. https://technet.microsoft.com/en-us/magazine/2007.06.uac.aspx https://technet.microsoft.com/en-us/magazine/2007.06.uac.asp... >unfortunately, this is also where we run into some of the limitations of UAC. Remember, there is no effective isolation; there is no security boundary that isolates processes on the same desktop. The OS does include some protective measures to keep the obvious and unnecessary avenues of communication blocked, but it would be impossible and undesirable to block them all. Therefore, Microsoft does not consider breaches of that nonexistent security boundary to be security breaches. https://technet.microsoft.com/en-us/magazine/2007.09.securitywatch.aspx https://technet.microsoft.com/en-us/magazine/2007.09.securit... In default and probably usual configuration UAC does not represent security boundary between medium-il (user) an high-il (equivalent of linux's root). Only if you bother to run under non-admin account are you protected from escalations. Leo Davidson then provided demonstrations of privilege escalation between those two integrity levels without triggering uac. I haven't checked Windows 10, but at least until Windows 8 most machines running Windows had been running most software effectively under root.
purpled_haze 11y ago
I'm curious- what do you think of Fedora? It's in the top 5 distros along with OpenSUSE, Ubuntu, Debian, and Mint, and yet I hardly ever hear people talk about it. I had personally given up on Fedora years ago, but recently was told I should give it a second look and I've not had time to try it out.
- DanBC 11y ago
  Fedora isn't for non technical family members. Here's a bit of mild whinging that's only relevant if you want to give it to non-technical people. There's a move to give stuff generic names, rather than the obscure names they had in the past. For example, Nautilus has been renamed to Gnome Files, or just Files. When a non technical person needs to search for hep this new name makes it impossible for them to create a useful search term. [files foo bar] is going to be different from [nautilus foo bar]. Frustratingly the old name works for searching, but it's not in any titlebars or about boxes or menu items, so the non-technical person has to just know that files is also sometimes called Nautilus. Fedora 20 has an appstore. This has something like 4 different names - in the menu, in the title bar, in the about box, in the icon. For what it is (a rapidly released testing distro) it's lovely - nice community (from what I could tell) and lots of activity.
  - okasaki 11y ago
    > For example, Nautilus has been renamed to Gnome Files, or just Files. It's a bad trend. It's really frustrating when you're trying to find out what the executable or package name is.
    - Brakenshire 11y ago
      I don't think there's that much wrong with "Gnome Files". That should be enough to search for help, and also gives information about what the program does. Similarly, I would say the names should be "Firefox Browser", "Geary Email" etc (if we're aiming to be user friendly).
      - 11y ago
berdario 11y ago
They provide gpg signed sha hashes, it's apparently just not documented: https://micahflee.com/2016/02/backdoored-linux-mint-and-the-perils-of-checksums/ https://micahflee.com/2016/02/backdoored-linux-mint-and-the-...
viperscape 11y ago
Have you given Arch a try yet? Their are also some family friendly projects like Antergos. Arch wiki is my all time favorite for great documentation, even when not using arch, go figure.
- zymhan 11y ago
  The documentation is good, I'm using it to configure KVM on Fedora now.
- Crespyl 11y ago
  Personally, I wouldn't recommend Arch (even the "friendly" variants like Antergos) to the less technically inclined. You don't need a to be extremely familiar with Linux to get started with Arch, but you do need to be comfortable at the command line and are expected to be able to read the (excellent) docs and debug things yourself. It's a very educational experience, but not really something the "average grandmother" is likely to have the patience for, particularly when they're just trying to watch a flash video on Facebook. That's the real strength of Mint, and I'm not sure what best fills that niche if Mint is off the table.
  - JupiterMoon 11y ago
    Ubuntu with a post install script that grabs flash etc? EDIT Write the post install script yourself don't use one of the many flawed ones that a search will show up. I really don't see why the downvote? The OP wants an easy to use distro that their grandmother can use but seems happy to install it them-self.
    - seqastian 11y ago
      flash? isn't that what the chrome cage is for?
      - JupiterMoon 11y ago
        Maybe the OP wants to use Firefox?
autoreleasepool 11y ago
> Edit: I'm also playing around with FreeBSD for my development environment, since I can use Mate on there. To be honest, I don't really need a DE these days anyway, since I only use terminal and a web browser. I should look into just using a Windows Manager. FreeBSD has good support for DEs with XFCE and Lumina, anyways. At least I've never had a problem.
- eatonphil 11y ago
  I've been running Mate and Gnome3 for the past 6 months as well. Mate had some issues and, for both, the screen went black for 1-2 seconds when videos start playing. I was able to get a compositor (Compiz) working on Mate and this fixed the tearing issue. It had some issues where it just kept crashing and rebooting that I never figured out. So I switched back to Gnome3. Although Gnome3 comes with a compositor (I think? And I think it might be Compiz?), I can't seem to get rid of the screen going black when a video starts. But it really doesn't make a big difference and it's not a big enough annoyance to matter. I don't really use FreeBSD for media anyway. It's just the auto-play videos on Facebook that triggers the infrequent frustration.
  - autoreleasepool 11y ago
    Me either. Media is definitely not my use case. I'm running FreeBSD in a VM on top of OS X as a host anyways, so graphics support is likely more stable for me for that reason. I think Lumina is looking really promising, though. I recommend giving it a try if you have the time.
ableal 11y ago
Thanks for the Ubuntu Mate heads up. Over the last 10+ years, and from Apple OS X to MS Windows, the Ubuntu Gnome 2 desktop was the most pleasant for me to use.
agumonkey 11y ago
Mint is having its Manjaro (archlinux based prepackaged desktop distro) crysis. They had the same problem and backlash. They ironed out many security issues and practices since then. Mint will probably do so too, Clem did a lot of work, it's probably just a new territory for him and his team.
talideon 11y ago
I woudn't mind so much if they were running WordPress on the same machine if it were isolated in a container or jail. There's certainly no excuse not to do so these days now that php-fpm exists.
blubb-fish 11y ago
> I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I would consider myself pretty "technical". And yet, I am not willing to spend more effort than absolutely necessary for setting up my Linux OS. Just b/c I am a programmer and even love to use zsh and Git from the CLI does not imply that I have any patience for fiddling with drivers and kernels. In the "Linux Community" there only seems to exist the hacker (who loves to spend ages tinkering with config files and debugging hardware issues) and the technically incompetent user (who most likely uses Windows anyway). There is a lot in between.
- servercobra 11y ago
  I think that's why a lot of people wind up on OSX. You get the CLI environment you're used to with Linux, but rarely lose half a day because a driver upgrade broke your desktop.
  - pimeys 11y ago
    Funny, because I've been using Arch Linux now almost 5 years on my work computer without any problems. Same desktop (xmonad), same editor (emacs) and same terminal (xterm) with the most awesome configuration stored in Github. The only problems I've heard here are coming from the OSX users, who face difficulties when upgrading the OS into a new version, which breaks homebrew or something...
    - banterfoil 11y ago
      Perhaps Servercobra was talking about the barrier for entry. I haven't yet set up an Arch distro, but I can say that getting started with OSX is beyond simple. Based on what I have heard, setting up Arch can be rather difficult. I really like the idea of Arch but I am intimidated to jump in. What was your experience like when you first booted up Arch?
      - pimeys 11y ago
        Well, I have experience with Linux for the last 20 years, since I was 12 years old, so it was not that strange to setup Arch for the first time, way easier than the early Red Hats back in the days. I also have long history with OSX, including the early 10.0 builds until 10.6. I honestly think that having a nicely configured computer build with a simple distribution, like Arch, is much easier for day-to-day work than an OSX installation, that can break lots of things when there's a new version out.

by jnbiche 11y ago

theandrewbailey 11y ago

I put my parents on Xubuntu about 5 years ago on a whim, then moved them over to Mint about 2 years later. About a year-ish ago, I saw that Xubuntu was using whisker-menu (main UI menu with a search box like Windows) I put them back on it and went back, myself.

venomsnake 11y ago

GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give your signature and key fingerprint.

jnbiche 11y ago
The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the signature page is defaced. If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly. I've had many signatures for package signers in my keyring for 5+ years. If and when they replace the key, they let the community know and we update our keyrings. Yes, if you don't want to do that, fine, but for those of us who are careful users of GPG, it's a huge barrier against malware in packages and distros.
- venomsnake 11y ago
  I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.
  - berdario 11y ago
    You can use gpg on windows or macosx as well to verify the signed hashes. As linked in the blog post in my other comment, tails explains things quite well: https://tails.boum.org/download/index.en.html#verify https://tails.boum.org/download/index.en.html#verify
  - jnbiche 11y ago
    If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows: 1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers. Even if you haven't previously established trust, GPG can be an extremely valuable ally.

deleted 11y ago

[deleted]

nailer 11y ago
No consumer OS since Windows Me logs in with a system account by default. Linux Mint sucks, but I'm pretty much OK with disabling autologin to root.
- RaleyField 11y ago
  > No consumer OS since Windows Me logs in with a system account by default. About that. > It’s important to be aware that UAC elevations are conveniences and not security boundaries. https://technet.microsoft.com/en-us/magazine/2007.06.uac.aspx https://technet.microsoft.com/en-us/magazine/2007.06.uac.asp... >unfortunately, this is also where we run into some of the limitations of UAC. Remember, there is no effective isolation; there is no security boundary that isolates processes on the same desktop. The OS does include some protective measures to keep the obvious and unnecessary avenues of communication blocked, but it would be impossible and undesirable to block them all. Therefore, Microsoft does not consider breaches of that nonexistent security boundary to be security breaches. https://technet.microsoft.com/en-us/magazine/2007.09.securitywatch.aspx https://technet.microsoft.com/en-us/magazine/2007.09.securit... In default and probably usual configuration UAC does not represent security boundary between medium-il (user) an high-il (equivalent of linux's root). Only if you bother to run under non-admin account are you protected from escalations. Leo Davidson then provided demonstrations of privilege escalation between those two integrity levels without triggering uac. I haven't checked Windows 10, but at least until Windows 8 most machines running Windows had been running most software effectively under root.

purpled_haze 11y ago

I'm curious- what do you think of Fedora? It's in the top 5 distros along with OpenSUSE, Ubuntu, Debian, and Mint, and yet I hardly ever hear people talk about it. I had personally given up on Fedora years ago, but recently was told I should give it a second look and I've not had time to try it out.

DanBC 11y ago
Fedora isn't for non technical family members. Here's a bit of mild whinging that's only relevant if you want to give it to non-technical people. There's a move to give stuff generic names, rather than the obscure names they had in the past. For example, Nautilus has been renamed to Gnome Files, or just Files. When a non technical person needs to search for hep this new name makes it impossible for them to create a useful search term. [files foo bar] is going to be different from [nautilus foo bar]. Frustratingly the old name works for searching, but it's not in any titlebars or about boxes or menu items, so the non-technical person has to just know that files is also sometimes called Nautilus. Fedora 20 has an appstore. This has something like 4 different names - in the menu, in the title bar, in the about box, in the icon. For what it is (a rapidly released testing distro) it's lovely - nice community (from what I could tell) and lots of activity.
- okasaki 11y ago
  > For example, Nautilus has been renamed to Gnome Files, or just Files. It's a bad trend. It's really frustrating when you're trying to find out what the executable or package name is.
  - Brakenshire 11y ago
    I don't think there's that much wrong with "Gnome Files". That should be enough to search for help, and also gives information about what the program does. Similarly, I would say the names should be "Firefox Browser", "Geary Email" etc (if we're aiming to be user friendly).
    - 11y ago

berdario 11y ago

They provide gpg signed sha hashes, it's apparently just not documented: https://micahflee.com/2016/02/backdoored-linux-mint-and-the-perils-of-checksums/ https://micahflee.com/2016/02/backdoored-linux-mint-and-the-...

viperscape 11y ago

Have you given Arch a try yet? Their are also some family friendly projects like Antergos. Arch wiki is my all time favorite for great documentation, even when not using arch, go figure.

zymhan 11y ago
The documentation is good, I'm using it to configure KVM on Fedora now.
Crespyl 11y ago
Personally, I wouldn't recommend Arch (even the "friendly" variants like Antergos) to the less technically inclined. You don't need a to be extremely familiar with Linux to get started with Arch, but you do need to be comfortable at the command line and are expected to be able to read the (excellent) docs and debug things yourself. It's a very educational experience, but not really something the "average grandmother" is likely to have the patience for, particularly when they're just trying to watch a flash video on Facebook. That's the real strength of Mint, and I'm not sure what best fills that niche if Mint is off the table.
- JupiterMoon 11y ago
  Ubuntu with a post install script that grabs flash etc? EDIT Write the post install script yourself don't use one of the many flawed ones that a search will show up. I really don't see why the downvote? The OP wants an easy to use distro that their grandmother can use but seems happy to install it them-self.
  - seqastian 11y ago
    flash? isn't that what the chrome cage is for?
    - JupiterMoon 11y ago
      Maybe the OP wants to use Firefox?

autoreleasepool 11y ago

> Edit: I'm also playing around with FreeBSD for my development environment, since I can use Mate on there. To be honest, I don't really need a DE these days anyway, since I only use terminal and a web browser. I should look into just using a Windows Manager. FreeBSD has good support for DEs with XFCE and Lumina, anyways. At least I've never had a problem.

eatonphil 11y ago
I've been running Mate and Gnome3 for the past 6 months as well. Mate had some issues and, for both, the screen went black for 1-2 seconds when videos start playing. I was able to get a compositor (Compiz) working on Mate and this fixed the tearing issue. It had some issues where it just kept crashing and rebooting that I never figured out. So I switched back to Gnome3. Although Gnome3 comes with a compositor (I think? And I think it might be Compiz?), I can't seem to get rid of the screen going black when a video starts. But it really doesn't make a big difference and it's not a big enough annoyance to matter. I don't really use FreeBSD for media anyway. It's just the auto-play videos on Facebook that triggers the infrequent frustration.
- autoreleasepool 11y ago
  Me either. Media is definitely not my use case. I'm running FreeBSD in a VM on top of OS X as a host anyways, so graphics support is likely more stable for me for that reason. I think Lumina is looking really promising, though. I recommend giving it a try if you have the time.

ableal 11y ago

Thanks for the Ubuntu Mate heads up. Over the last 10+ years, and from Apple OS X to MS Windows, the Ubuntu Gnome 2 desktop was the most pleasant for me to use.

agumonkey 11y ago

Mint is having its Manjaro (archlinux based prepackaged desktop distro) crysis. They had the same problem and backlash. They ironed out many security issues and practices since then. Mint will probably do so too, Clem did a lot of work, it's probably just a new territory for him and his team.

talideon 11y ago

I woudn't mind so much if they were running WordPress on the same machine if it were isolated in a container or jail. There's certainly no excuse not to do so these days now that php-fpm exists.

blubb-fish 11y ago

> I've used Mint in the past, and it was my go-to distro for family members who aren't so technical. I would consider myself pretty "technical". And yet, I am not willing to spend more effort than absolutely necessary for setting up my Linux OS. Just b/c I am a programmer and even love to use zsh and Git from the CLI does not imply that I have any patience for fiddling with drivers and kernels. In the "Linux Community" there only seems to exist the hacker (who loves to spend ages tinkering with config files and debugging hardware issues) and the technically incompetent user (who most likely uses Windows anyway). There is a lot in between.

servercobra 11y ago
I think that's why a lot of people wind up on OSX. You get the CLI environment you're used to with Linux, but rarely lose half a day because a driver upgrade broke your desktop.
- pimeys 11y ago
  Funny, because I've been using Arch Linux now almost 5 years on my work computer without any problems. Same desktop (xmonad), same editor (emacs) and same terminal (xterm) with the most awesome configuration stored in Github. The only problems I've heard here are coming from the OSX users, who face difficulties when upgrading the OS into a new version, which breaks homebrew or something...
  - banterfoil 11y ago
    Perhaps Servercobra was talking about the barrier for entry. I haven't yet set up an Arch distro, but I can say that getting started with OSX is beyond simple. Based on what I have heard, setting up Arch can be rather difficult. I really like the idea of Arch but I am intimidated to jump in. What was your experience like when you first booted up Arch?
    - pimeys 11y ago
      Well, I have experience with Linux for the last 20 years, since I was 12 years old, so it was not that strange to setup Arch for the first time, way easier than the early Red Hats back in the days. I also have long history with OSX, including the early 10.0 builds until 10.6. I honestly think that having a nicely configured computer build with a simple distribution, like Arch, is much easier for day-to-day work than an OSX installation, that can break lots of things when there's a new version out.