Ubuntu 14.04 [pre-release]: security problem in the lock screen

KDE4 killed Linux on the desktop for me. I loved KDE3, used it for years. And then they stopped maintaining it, and the next version was unusable for years. It's still not particularly good or better than KDE3, it's just different.

My thoughts exactly.

Xscreensaver is a thing and you can use it.

It's no secret that ubuntu's desktop has been a basket case, but it's not the only available option even with ubuntu - let alone on linux. kubuntu is fine, and xubuntu is awesome (neither of which use this screensaver).

The reason why the linux desktop never took off was because microsoft used its not insignificant market power to squash it each time it was about to take off.

Not because of a silly screensaver that got rewritten.

2. This bug was patched before Ubuntu 14.04 was released

3. You're an obvious troll account based on the username "muuh-gnu"

4. Most of your arguments are unfounded and opinion based.

This is an exaggeration you had to make to prove your point (and the reason you had to exaggerate is because you don't actually have a point, which anyone can see by actually doing some research). Most Linux threads on HN seem to end in an anti-linux circle jerk, while the people who are actually presenting the facts get downvoted. The actual usefulness of Linux based operating systems are highly and disproportionately discounted on HN as it is a fact that the majority of computer users spend most of their time inside a browser talking on social media. Now this would be a good point to refute, but whenever the subject comes up the replying comments always seem to diverge from this subject and postulate a different argument that supports their view point while completely disregarding the point the parent comment made.

If you believe that 90% of computer users need photoshop and advanced features of word and excel (you can use both word and excel online though, without windows installed), then fine, show me some proof, don't just say "It'll never happen you guys are dumb", come up with some evidence to support your claim. I mean, new versions of Linux are as easy to use as an iPhone (app stores, home screens, big pretty icons) so if people can learn to use iOS they can obviously learn to use Linux. This week I'm switching over 4000 computers to Ubuntu 14.04 for a tech support company. Last week I did around 2000 for a call center based around ordering small sausages and cheese. Currently I have about six more contracts that are being negotiated to set up even more Linux based machines. I have the ability to switch about a thousand a day because of how the computers in these places are networked. Can you believe they were running Windows 7 to emulate DOS? One of the contracts I'm currently negotiating involves switching a thousand computers from XP to Ubuntu 14.04 and all they use the computers for is a web app that the workers use to send what they call "technical requests" using browser based web apps that all work in firefox. I could go on.

The few people in these companies that are actually skilled workers and need Windows compatibility for some reason are either using "Windows labs" that we set up specifically for them or we're running a remote version of windows on a server and streaming whatever they want to a Linux box.

In my experience Windows is not needed in 90% of cases and when it is it's for a skilled task that involves skilled workers. It's a fact that skilled workers do not make up even close to a majority of the work force. Also, Ubuntu is certified to run on 70% of desktop computers: http://www.ubuntu.com/certification/desktop/ . One of the the manufacturers I work closely with is Dell and for the most part I haven't had any problems installing Linux on any business model Dell desktop that there is. Business models don't typically come with high end nVidia GPUs and other unnecessary hardware, so upgrading to Linux is no problem most of the time. On budget and typical business systems Linux seems to be the king of resume times and performance (at least in my experience). I've only used windows 8 on an employees laptop and from what I can tell, it wasn't made to perform well on his Toshiba to say the least. I've seen both windows 7 and windows 8 running very well on the right hardware though. The performance of windows on budget hardware (~75% of consumer) is mediocre at best, which is unfortunate, but what's even more unfortunate is that because a select few can get Windows performing amazingly on great hardware, the consumer market seems to think it runs amazingly everywhere. Hopefully soon it will, or people will come to their senses and realize installing windows on a low budget (average consumer grade) system is more trouble than it's worth.

If we want to talk about an insecure OS we can start with windows which is the king of insecurities. Do I even need to get into all the bugs people find after the release. At least this was found before the official release.

If anything there's a circle jerk around "why Linux can't be used for anything" which is pretty sad considering the people who come here consider themselves to be tech oriented but can't even use Ubuntu. I'd also like to mention that I have a friend who installs Linux for animation companies, including pixar, who use Blender and other open source technologies to make professional quality animated films. Can we stop pretending that Linux has no uses for anything?

Edit: the title has been edited since I posted this. It still serves no purpose though.

To those who are down voting, please explain why you think this thread should remain here?

However jerking off to discussions about how to properly implement screen locker password input completely misses the point: That locking a screen/session from "inside" always will be flawed. There's an "easy" way to fix it: Instead of trying to lock a session with an inside locker, it should be detached from the terminal instead.

If you're working on just the text console this is a piece of cake: Use tmux or screen for the login shell and as soon as you detach from it you're getting logged out (a lot of people use this setup). There's no way a screen locker crash would pose a security thread, because there's no screen locker at all. Just the regular login which when crashing gets respawned.

Had XFree86/Xorg the capability to detach the X server from the screen, this would allow to log out to the regular display manager login and "unlocking" a session would be simply reattaching to it. Unfortunately the internal driver/device model used by XFree86/Xorg made it hard to impossible to implement such a thing (this is not a drawback of the X11 protocol per se, but the widespread implementations of it).

Luckily Linux is moving to a new graphics model and whatever we'll use in a few years, hopefully detaching graphical sessions will become as simple as using tmux/screen; then you'd close a terminal session instead of locking and no longer need a screen locker.

Meanwhile, http://www.cvedetails.com/vulnerability-list/vendor_id-1861/... . Security is, in general, difficult.

I don't think it needs to be in the kernel; the login process for *nixes has always been in usermode, and this arrangement hasn't proved to be particularly troublesome.

A screensaver would not be immune to this as well when run in userland, in fact the same session.

I think there should be more isolations in place for cases like this.

Windows 3.11 to Windows 98 (and possibly later) let you click 'Cancel' at the login screen so you wouldn't need a user/pass at all to get access to the desktop. There was also the 'safe mode' option if the login prompt really was an obstacle. This easy login was a feature, not a bug.

Also, the bug was solved in 14.04 before the official launch date.