Linux Mint downloads (briefly) compromised [LWN.net]

Linux Mint downloads (briefly) compromised

Posted Feb 21, 2016 21:37 UTC (Sun) by job (guest, #670)
In reply to: Linux Mint downloads (briefly) compromised by glaubitz
Parent article: Linux Mint downloads (briefly) compromised

Thank you for that. At least it shows that I'm not the only one dumbfounded by the apparent insanity here.

It's one thing that this is a hobbyist project, but when real people are actually put at risk because of your hobby, it is not unfair to demand at least some accountability.

> they are mixing their own binary packages with binary packages from Debian and Ubuntu without rebuilding the latter

I don't understand. Why would you ever want to do that? Surely it must be a lot less work to just build your desktop and artwork and whatnot against stretch and sid, and publish those?

You can still build your own installer if you wish, and have a very wide leeway with branding. Not to mention the immense help building on established infrastructure would give. What is the background for this decision? On the surface of it, it seems like a lose-lose proposition.

to post comments

Linux Mint downloads (briefly) compromised

Posted Feb 21, 2016 21:48 UTC (Sun) by glaubitz (subscriber, #96452) [Link] (8 responses)

> I don't understand. Why would you ever want to do that? Surely it must be a lot less work to just build your desktop and artwork and whatnot against stretch and sid, and publish those?

I'm not sure what you are asking. Are you asking why a derivative should rebuild all the packages they import from their upstream distributions? If that's the question, then the answer is simple: To avoid the exact upgradebility issues that Linux Mint has. I'm not aware of any other distribution which has to blacklist single packages during updates like Mint.

> You can still build your own installer if you wish, and have a very wide leeway with branding. Not to mention the immense help building on established infrastructure would give. What is the background for this decision? On the surface of it, it seems like a lose-lose proposition.

Again, I'm not sure I'm grasping your stance. Are you in favor of mixed repositories or against it?

My point is: If you don't have the resources to rebuild all packages from source that you ship to your users, you shouldn't maintain your own distribution in the first place.

Sure, making your own spin of your distribution of choice is easy enough and fun. But the hard part is not creating those images, the hard part is providing proper support for that spin you created. The work on a distribution doesn't stop once the images have been created.

Adrian

Linux Mint downloads (briefly) compromised

Posted Feb 21, 2016 22:32 UTC (Sun) by job (guest, #670) [Link] (7 responses)

Linux Mint is a desktop environment. Why don't they build this desktop for Debian (or Ubuntu, or some other entity with the infrastructure already in place)?

Building a top notch modern desktop environment and compete with Gnome and KDE (let alone Windows and Mac) is hard enough. I can not for the life of me understand why you would also take upon yourself to build out a fully fledged Linux distribution on top of that. The odds that both of these ventues would be successful seems faint.

The last part of my comment was meant to say that if you for some inexplicable reason still wanted to go down that road, a Debian spin is still a thousand times easier than re-inventing everything yourself. Because the latter must be what Mint set out to do, otherwise they would not have ended up with the situation they are in. It must close to impossible to maintain, and it can't possibly be anyone's idea of "fun".

Linux Mint downloads (briefly) compromised

Posted Feb 22, 2016 14:44 UTC (Mon) by Beolach (guest, #77384) [Link] (5 responses)

Linux Mint is *NOT* a desktop environment - it is a Linux Distribution. As part of their distribution they also created their own desktop environment, but the name of the DE is Cinnamon, not Linux Mint. And Cinnamon is IMO one of the good things Linux Mint has done - I strongly agree w/ their design goal of a traditional desktop UI. Fortunately, Cinnamon can be & is packaged in other distributions, including Debian.

But Linux Mint is a full Distribution, not just the Cinnamon DE, and as such has a *much* larger scope, and in that larger scope has made decisions that I strongly disagree with. In addition to glaubitz's list, the issue that turned me off of Linux Mint is their very old kernel versions - 3.19 in their latest release. And it's not even an older LTS kernel release; it's a no-longer supported kernel. 3.18 would have been better (assuming they kept up w/ the LTS minor updates, of course).

There are how-to guides out there for upgrading Linux Mint to a more recent kernel, but they're all just about grabbing an Ubuntu or Debian kernel. So it's back to the Frankendebuntu situation, make-your-own monster this time.

Linux Mint downloads (briefly) compromised

Posted Feb 22, 2016 19:13 UTC (Mon) by job (guest, #670) [Link] (3 responses)

It certainly doesn't look that way. It looks more like they took Ubuntu, added their packages, and called it a distribution.

What is the larger scope here? What is it in Mint apart from the installer and the desktop environment that differs from regular Ubuntu or Debian?

Linux Mint downloads (briefly) compromised

Posted Feb 22, 2016 20:53 UTC (Mon) by johannbg (guest, #65743) [Link]

All these distributions are fundamentally the same thing with their greatest collaborated achievement being collectively making upstream life miserable about the needles deviation they all do to distinguish themselves from each other.

Linux Mint downloads (briefly) compromised

Posted Feb 23, 2016 2:21 UTC (Tue) by Beolach (guest, #77384) [Link] (1 responses)

It looks more like they took Ubuntu, added their packages, and called it a distribution.

I don't think I understand what you think a distribution is. Do you thing Ubuntu isn't a distribution? If Ubuntu is a distribution, and Linux Mint took it, added their packages, and re-distributed it under their own branding, how is Linux Mint *not* a distribution? Yes, it is most definitely a fork of Ubuntu, but a fork of a distribution is a still a distribution. I think you're underestimating how far the Linux Mint fork has diverged from Ubuntu, but regardless, even if it was a very close fork w/ very small differences, how would it not be a distribution? And how is the Ubuntu fork from Debian any different from the Linux Mint from from Ubuntu?

I had been thinking you were conflating Linux Mint w/ their Cinnamon DE, but now I'm just confused by what you mean by distribution.

My definition of a Linux Distribution is: a project to distribute the Linux kernel together with a selection of user-space packages. Linux Mint fits that definition.

Most distributions, including Linux Mint, have a set of goals that guide which user-space packages they select for inclusion, and they put effort into getting the user-space packages to serve those goals & deliver a consistent user experience. But while I think those goals are important in determining how useful a specific distribution is, I don't think they're defining charateristics required to be a "Linux Distribution". If someone distributed the Linux Kernel together w/ a completely random selection of user-space packages w/ no effort spent on consistency, I would say that still fits the definition of a "Linux Distribution" - it would just be a particularly useless one.

What is the larger scope here? What is it in Mint apart from the installer and the desktop environment that differs from regular Ubuntu or Debian?

I was comparing the scope of the Cinnamon DE to the scope of the entire Linux Mint distribution; not the scope of Linux Mint to the scope of Ubuntu or Debian. To me it's very obvious that Linux Mint is larger than one package within it.

Again, I think you're underestimating how far Linux Mint has diverged since their fork. There are many more differences between Linux Mint & Ubuntu or Debian than just the installer & desktop environment (and the DE isn't really different, since you can use Cinnamon or MATE in Debian or Ubuntu). But again I don't think that's relevant to whether or not Linux Mint is a distribution.

What makes Linux Mint different are its different goals, and the different decisions made in pursuit of those goals. Its goals are out-of-the-box ease-of-use & a traditional desktop computer user experience. While Ubuntu also has a goal of out-of-the-box ease-of-use, they don't have the second goal. And Debian has many more goals & different priorities. Both Ubuntu and Debian do have broader goals & therefore larger scope than Linux Mint.

Another significant difference is the project's organization: here Linux Mint is closer to Debian than Ubuntu, being a volunteer non-corporate organization, but compared to Debian is *much* smaller & less mature.

As a result of the nature of Linux Mint's small volunteer organization, they made the decision to clone much (but not all) of the Ubuntu repository directly, rather than investing in the infrastructure to completely build their own repository. I can understand how the cost/benefit analysis appeared that led to that decision, but I think it was a mistake, compounded by other mistakes made later (see glaubitz & h2 comments earlier).

But while I think Linux Mint has made mistakes that ultimately lead me not to use it, even when I agree w/ their goals, that doesn't mean they're not a distribution.

Linux Mint downloads (briefly) compromised

Posted Feb 25, 2016 12:23 UTC (Thu) by job (guest, #670) [Link]

If Ubuntu is a distribution, and Linux Mint took it, added their packages, and re-distributed it under their own branding, how is Linux Mint *not* a distribution?

Well, that was perhaps harshly put, but isn't there a difference between redistribution and forking? If you don't even re-build the packages you're just redistributing. From the comments here it seems like the Mint people generally do more of the latter than the former.

Again, I think you're underestimating how far Linux Mint has diverged since their fork. There are many more differences between Linux Mint & Ubuntu or Debian than just the installer & desktop environment

I probably am. I really don't understand why they created a distribution (pseudo- or not) around their desktop environment. It seems like a strange decision from the outside, as they clearly don't have enough resources for even the most basic distribution work, such as keeping track of security issues.

What is it that Linux Mint does differently than Ubuntu or Debian? What were the reasons behind this decision? Again, I don't want to criticize anyone's hobby, but there is a limit when end users at put at risk.

Linux Mint downloads (briefly) compromised

Posted Feb 23, 2016 9:41 UTC (Tue) by jtaylor (subscriber, #91739) [Link]

3.19 is a stable kernel, just not the 'official' stable one. It supported for quite some time by canonical and imo they are doing a good job.

Assuming mint is based on ubuntu lts you can install a 4.2 kernel via:
apt-get install --install-recommends linux-generic-lts-wily

but I have never used mint, so maybe this doesn't work there.

Linux Mint downloads (briefly) compromised

Posted Feb 22, 2016 14:47 UTC (Mon) by leoluk (guest, #97665) [Link]

Don't they? Cinnamon is packaged by Debian Jessie and works perfectly well, as far as I can tell.