Really? There is no doubt that it was coming? Secondly, how can something be official when there was no statement from Valve saying so? A one-liner in an article with an unsourced rumor is not "official".
What was "irrefutable" about it? They found a few lines that said "Linux" in some scripts and an incomplete client. That's a pretty shaky foundation to say something is "confirmed".
Protip: Those rumors had no basis in reality.. This is why you should not trust Phoronix as a source of reliable information in addition to their crappy benchmarks with questionable methodology.
it shouldn't be used to free someone who was justly convicted with other evidence.
And you know that the other evidence wasn't faulty, how? Police make mistakes, witnesses lie or remember things wrong, etc etc.
You either believe your justice system is fair or else you scrap the entire thing.
Or you ditch that false dichotomy and realize that within every system mistakes will be made. There is nothing in fixing past errors that means you throw out the whole system.
Your alternative would mean that we would have to release every murderer and rapist.
No, of course not and I wasn't implying such a ridiculous thing either. But to act as if just because there is patch out that the issue is now non-existent is silly. It's no different to back when code red was a big problem. Even after Microsoft pushed out a patch, for many months after there were still people spreading the infection due to not updating their systems.
Also, where else do you expect a distro developers to download the source code for a program if not from the official upstream developer themselves (which is where the trojaned version was pulled from)?
So in order to exploit this exploit you need to make up another exploit which already allows them to do anything on my PC with my user privileges, which means that they've already installed a keylogger in Firefox and stolen my bank passwords and I no longer give a flying monkey turd about whether they've trashed my OS.
No. In fact, for example, a maliciously-formed PDF file opened in a PDF reader, even if that reader is run in a sandbox, can be used to gain root through the exploit.
If your distro is downloading random unauthenticated tar files (no signature, not even a checksum) and shipping them out to end-users then you have much bigger problems than a random X-server exploit.
Because downloading a file from the official of the program is equivalent to downloading a random file from an untrusted server? lolwut?
Just to further elaborate, there is nothing in the case of the Xorg exploit that says that the vulnerability in the program that allows the someone to use the exploit has to have been put in their purposefully. So this whole notion about distros and their package managers is just a big red herring.
You assume they would be doing it purposefully which isn't necessarily true. In the case of unrealIRCD not even the developers of the program knew that the version they were serving had been switched to a version with a trojan in it until months after they had been serving the files.
Sure, maybe Joe Sixpack is dumb enough to install a random 'Naked Chicks Screensaver' that exploits a Linux bug, but the vast majority of people only install software from their Linux distro, which they have little choice but to trust.
Well hopefully that distro didn't download the trojaned version of unrealIRCD that it's own developers didn't realize someone had switched. Or are the developers of that program and anyone who trusted that what they were sharing wasn't trojaned are just "dumb Joe Sixpacks"?
Slashdot Mirror
This isn't buzzwordy enough. Where am I being enlightened about the synergy I'll gain from using wave?
You need to reevaluate your life, dude.
Says the person who has internet fights over an OS? LOL.
The cynic in me says they just threw it out now so the new BR could be out in time for Xmas shopping season.
No shit? You thought they were doing this for anything other than to get more people to give them fists full of cash?
Will anyone but a handful of nerds know or even care?
Nothing in this patent application says they are getting rid of desktop OS X.
Why? Apple got permission from Cisco to use the name.
Who says there even was a real source and it wasn't just made up and thrown in there for page hits? It wouldn't even remotely be the first time.
A one-line unsourced rumor at the end of an article is not an announcement from Valve. An announcement from Valve would be something like this.
The part that had "no basis in reality" were the overblown statements that Phoronix was making with headlines such as:
There Is No Doubt, Steam Is Coming To Linux!
It's Official: Valve Releasing Steam, Source Engine For Linux!
Really? There is no doubt that it was coming? Secondly, how can something be official when there was no statement from Valve saying so? A one-liner in an article with an unsourced rumor is not "official".
What was "irrefutable" about it? They found a few lines that said "Linux" in some scripts and an incomplete client. That's a pretty shaky foundation to say something is "confirmed".
Going to the *real* source of the rumours: Phoronix. It all started in this page [phoronix.com]. And they say, quote:
No, it all started back in 2008 here when they first claimed that Steam for Linux was "confirmed".
Protip: Those rumors had no basis in reality.. This is why you should not trust Phoronix as a source of reliable information in addition to their crappy benchmarks with questionable methodology.
Because they don't have the license to?
it shouldn't be used to free someone who was justly convicted with other evidence.
And you know that the other evidence wasn't faulty, how? Police make mistakes, witnesses lie or remember things wrong, etc etc.
You either believe your justice system is fair or else you scrap the entire thing.
Or you ditch that false dichotomy and realize that within every system mistakes will be made. There is nothing in fixing past errors that means you throw out the whole system.
Your alternative would mean that we would have to release every murderer and rapist.
No, actually it wouldn't.
Don't run X as root. Who does that these days?
Probably quite a few. Not everyone is running a version of the 2.6 kernel that has KMS.
No, of course not and I wasn't implying such a ridiculous thing either. But to act as if just because there is patch out that the issue is now non-existent is silly. It's no different to back when code red was a big problem. Even after Microsoft pushed out a patch, for many months after there were still people spreading the infection due to not updating their systems.
Also, where else do you expect a distro developers to download the source code for a program if not from the official upstream developer themselves (which is where the trojaned version was pulled from)?
So in order to exploit this exploit you need to make up another exploit which already allows them to do anything on my PC with my user privileges, which means that they've already installed a keylogger in Firefox and stolen my bank passwords and I no longer give a flying monkey turd about whether they've trashed my OS.
No. In fact, for example, a maliciously-formed PDF file opened in a PDF reader, even if that reader is run in a sandbox, can be used to gain root through the exploit.
You might as well give up. Anything you say is going to be thrown back at you with in some ridiculous caricatured form in order for him to dispute it.
official website*
If your distro is downloading random unauthenticated tar files (no signature, not even a checksum) and shipping them out to end-users then you have much bigger problems than a random X-server exploit.
Because downloading a file from the official of the program is equivalent to downloading a random file from an untrusted server? lolwut?
Just to further elaborate, there is nothing in the case of the Xorg exploit that says that the vulnerability in the program that allows the someone to use the exploit has to have been put in their purposefully. So this whole notion about distros and their package managers is just a big red herring.
But...but...those are clearly just dumb Winblows users!!! HURP DURP!!!
You assume they would be doing it purposefully which isn't necessarily true. In the case of unrealIRCD not even the developers of the program knew that the version they were serving had been switched to a version with a trojan in it until months after they had been serving the files.
Sure, maybe Joe Sixpack is dumb enough to install a random 'Naked Chicks Screensaver' that exploits a Linux bug, but the vast majority of people only install software from their Linux distro, which they have little choice but to trust.
Well hopefully that distro didn't download the trojaned version of unrealIRCD that it's own developers didn't realize someone had switched. Or are the developers of that program and anyone who trusted that what they were sharing wasn't trojaned are just "dumb Joe Sixpacks"?