6 ms·

Canonical in particular makes it very difficult to download images over HTTPS. For Ubuntu 16.04, I spent a relatively large amount of time trying to figure out

Canonical in particular makes it very difficult to download images over HTTPS. For Ubuntu 16.04, I spent a relatively large amount of time trying to figure out the best way to download this image over HTTPS: After going through multiple mirrors, I eventually found a reputable mirror that offered secure downloads. Seeing that there is no way for me to verify the authenticity of the signing keys (short of visiting canonical in person), every bit of security helps.

nickpsecurity 10y ago
It's worse: they don't have the updater working properly either. I switched to Ubuntu after the security issues with Mint since I didn't want to re-learn all the grunt stuff associated with Fedora or whatever. Not yet anyway. A while in, I find it won't update the software because /boot or something is out of space. I figure whatever causes that should be automatically prevented by Ubuntu given it is in many other OS's. Gonna have to once again Google around to fix the problem or start from scratch with new install or distro. Might just bite the bullet to learn Fedora given it consistently ranks higher in security metrics. Don't know about quality or UX experience, though. So, distributions and updates have issues in Ubuntu. The very things you want to be painless & secure.
- nol13 10y ago
  While this issue is easy to fix, I've run into it too and it's annoying and shouldn't happen in the default config/install of a popular OS.
- danjoc 10y ago
  >A while in, I find it won't update the software because /boot or something is out of space The boot partition is small and Ubuntu doesn't clean out old kernels. You have to do it yourself. sudo apt-get autoremove This will remove an old kernel. There may be a better way, because I find if there are multiple old kernels I have to do this multiple times. I also found if I have to remove more than one, it's best to follow with a sudo update-grub I previously managed to hose things by removing multiple old kernel versions, seeing a warning about needing to do this, ignoring it, then rebooting. So now I just do it after any autoremove that tosses an old kernel. This may not be the 100% correct magic ubuntu dance, but it is the one that seems to work for me.
  - nickpsecurity 10y ago
    Appreciate the tips. I'll look into those functions. I like their simplicity already.
- RaleyField 10y ago
  In default install. Every so often I click updater and there are updates for CVEs. Why didn't you ask me Ubuntu? Why did you let me run software with known public vulnerabilities longer than is necessary?? I'm also befuddled why it sometimes prompts for password and sometimes doesn't, and I can't insure that the prompt is that of updater so I have to drop in shell and use apt. Or that it will happily let processes with updated binaries run and not ask to restart them. Ubuntu is a joke, but then half other distros are or I can't evaluate the leadership satisfactorily to know if it's a joke (e.g. as I suspected, Mint turned out to be one as they managed to release hijacked isos twice in a row). </rant>
  - nickpsecurity 10y ago
    Great examples. Especially the password thing. I figured it just remembered it from prior use. Yet, there were times it didnt ask during somethimg critical. So, who knows...
- type0 10y ago
  > Don't know about quality or UX experience, though. UX should be fine but Fedora uses RPM so might have a bigger risk to end up with broken or incompatible packages, not sure though maybe things improved lately.
  - aeroevan 10y ago
    RPM doesn't have any bigger risk than using dpkg. You shouldn't be using either manually (unless you really know what you're doing). Using dnf/zypper/yum on the RPM side and aptitude/apt-get/whatever on the debian side should prevent any of those types of risks.
    - nickpsecurity 10y ago
      Have apt-get on Debian. So Yum is the Fedora equivalent?
      - bigger_cheese 10y ago
        DNF is the tool in Fedora (Yum was the previous default).
agwa 10y ago
This is so ironic considering Mark Shuttleworth became a millionaire by starting and selling a certificate authority. Ubuntu is literally funded by the early success of HTTPS yet they don't use it. https://en.wikipedia.org/wiki/Thawte https://en.wikipedia.org/wiki/Thawte
- tedunangst 10y ago
  Snake oil salesman doesn't drink own medicine? :)
- type0 10y ago
  At least the Minimal version is serving checksums via https on community web page: https://help.ubuntu.com/community/Installation/MinimalCD https://help.ubuntu.com/community/Installation/MinimalCD

nickpsecurity 10y ago

It's worse: they don't have the updater working properly either. I switched to Ubuntu after the security issues with Mint since I didn't want to re-learn all the grunt stuff associated with Fedora or whatever. Not yet anyway. A while in, I find it won't update the software because /boot or something is out of space. I figure whatever causes that should be automatically prevented by Ubuntu given it is in many other OS's. Gonna have to once again Google around to fix the problem or start from scratch with new install or distro. Might just bite the bullet to learn Fedora given it consistently ranks higher in security metrics. Don't know about quality or UX experience, though. So, distributions and updates have issues in Ubuntu. The very things you want to be painless & secure.

nol13 10y ago
While this issue is easy to fix, I've run into it too and it's annoying and shouldn't happen in the default config/install of a popular OS.
danjoc 10y ago
>A while in, I find it won't update the software because /boot or something is out of space The boot partition is small and Ubuntu doesn't clean out old kernels. You have to do it yourself. sudo apt-get autoremove This will remove an old kernel. There may be a better way, because I find if there are multiple old kernels I have to do this multiple times. I also found if I have to remove more than one, it's best to follow with a sudo update-grub I previously managed to hose things by removing multiple old kernel versions, seeing a warning about needing to do this, ignoring it, then rebooting. So now I just do it after any autoremove that tosses an old kernel. This may not be the 100% correct magic ubuntu dance, but it is the one that seems to work for me.
- nickpsecurity 10y ago
  Appreciate the tips. I'll look into those functions. I like their simplicity already.
RaleyField 10y ago
In default install. Every so often I click updater and there are updates for CVEs. Why didn't you ask me Ubuntu? Why did you let me run software with known public vulnerabilities longer than is necessary?? I'm also befuddled why it sometimes prompts for password and sometimes doesn't, and I can't insure that the prompt is that of updater so I have to drop in shell and use apt. Or that it will happily let processes with updated binaries run and not ask to restart them. Ubuntu is a joke, but then half other distros are or I can't evaluate the leadership satisfactorily to know if it's a joke (e.g. as I suspected, Mint turned out to be one as they managed to release hijacked isos twice in a row). </rant>
- nickpsecurity 10y ago
  Great examples. Especially the password thing. I figured it just remembered it from prior use. Yet, there were times it didnt ask during somethimg critical. So, who knows...
type0 10y ago
> Don't know about quality or UX experience, though. UX should be fine but Fedora uses RPM so might have a bigger risk to end up with broken or incompatible packages, not sure though maybe things improved lately.
- aeroevan 10y ago
  RPM doesn't have any bigger risk than using dpkg. You shouldn't be using either manually (unless you really know what you're doing). Using dnf/zypper/yum on the RPM side and aptitude/apt-get/whatever on the debian side should prevent any of those types of risks.
  - nickpsecurity 10y ago
    Have apt-get on Debian. So Yum is the Fedora equivalent?
    - bigger_cheese 10y ago
      DNF is the tool in Fedora (Yum was the previous default).

agwa 10y ago

This is so ironic considering Mark Shuttleworth became a millionaire by starting and selling a certificate authority. Ubuntu is literally funded by the early success of HTTPS yet they don't use it. https://en.wikipedia.org/wiki/Thawte https://en.wikipedia.org/wiki/Thawte

tedunangst 10y ago
Snake oil salesman doesn't drink own medicine? :)
type0 10y ago
At least the Minimal version is serving checksums via https on community web page: https://help.ubuntu.com/community/Installation/MinimalCD https://help.ubuntu.com/community/Installation/MinimalCD