Top all-time · #7712
Lukas Reschke
Personal blog · statuscode.chsecurityprogramming
Lukas Reschke writes Lukas' Random Thoughts, a personal blog at statuscode.ch about security and programming. Since 2015, 10 different Hacker News readers have linked it 16 times, most often “Distribution packages considered insecure”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN readers link Lukas Reschke's blog for its 2016 argument that Linux distribution packages often lag on security fixes, set against AppImage-style packaging. Commenters cite it as support.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
The personal blog of Lukas Reschke
Most-linked posts?
- Distribution packages considered insecure6 people · 6 mentions · first linked 2016-02-13
- From Markdown to remote code execution in Atom3 people · 3 mentions · first linked 2017-11-21
- OwnCloud “most secure open source file sync and share”2 people · 5 mentions · first linked 2015-09-29
What Hacker News says?
> I run ownCloud, despite some reservations about its security. I'm not too concerned about the data in ownCloud itself (if it's private, then I encrypt it client-side, but most things I put in ownCloud are not very private). I'm more concerned about it being used as a launching point for an attack on my home server. As a kind of compromise, I'm running it in a VM. ownCloud does run a bug bounty program ( https://ha…
Comment linking /2015/09/ownCloud-security-development-over-the-years/
on “Self-hosted alternatives to popular cloud services”Submitted From Markdown to remote code execution in Atom as a story · 234 points
HN discussion> Seafile has a much smaller attack surface (no PHP, MySQL not required, etc) ownCloud does run a successful Bug Bounty program and is paying for security bugs: https://hackerone.com/owncloud Also I have published a blog post elaborating why CVEs are not everything when it comes to comparing the security of products: https://statuscode.ch/2015/09/ownCloud-security-development-... Furthermore please take a look at ht…
Comment linking /2015/09/ownCloud-security-development-over-the-years/
on “Self-hosted alternatives to popular cloud services”Submitted Distribution packages considered insecure as a story · 102 points
HN discussionNot even the maintainers really understand what they are doing : https://github.com/g0tmi1k/debian-ssh > There was an #ifndef PURIFY there for a reason. It's because the openssl authors knew that line would cause trouble in a memory debuger like Purify or Valgrind. Where a debian maintainer screwed the RNG of OpenSSL to make valgrind happy. This made any key generated on a debian or ubuntu system from 2006 to 2008 v…
Comment linking /2016/02/distribution-packages-considered-insecure/
on “Btrfs has been deprecated in RHEL”Submitted Distribution packages considered insecure as a story · 6 points
HN discussionIs space really an issue in most non-mobile user devices nowadays? Consider the tradeoffs: a bit of space vs. packaging nightmare which results in old, buggy and insecure packages. This was posted a few days back on hn: https://statuscode.ch/2016/02/distribution-packages-consider... I am not sure if the whole jar package dependency management would work under ART.
Comment linking /2016/02/distribution-packages-considered-insecure/
on “AppImage: Linux apps that run anywhere”Submitted OwnCloud “most secure open source file sync and share” as a story · 6 points
HN discussion> I trust I can count on Debian/Ubuntu/RHEL will ship a new package for every critical CVE promptly, without forcing me to upgrade to the latest upstream version. There was an article just a couple of weeks ago pointing out that distributions frequently don't fix security issues: https://statuscode.ch/2016/02/distribution-packages-consider... No doubt it's better for high-profile applications, but there are far more…
Comment linking /2016/02/distribution-packages-considered-insecure/
on “AppImage: Linux apps that run anywhere”Submitted Distribution packages considered insecure as a story · 4 points
HN discussionI'd like to point you to https://statuscode.ch/2015/09/ownCloud-security-development-... and make you aware of https://seacloud.cc/group/3/wiki/security-records.md and you should probably consider who reported the last critical vulnerability. Only because a project is serious about actually publishing vulnerability data does not make it necessarily more insecure (or secure).
Comment linking /2015/09/ownCloud-security-development-over-the-years/
on “Owncloud has been forked into Nextcloud”Submitted From Markdown to RCE in Atom as a story · 3 points
HN discussion> logging changes "Please look at this commit so you know how you can hack us", sounds certainly like a much better idea ;-) > Security history at Wordpress When was there a single very grave vulnerability within the core of Wordpress? Mostly plugins are the root of all evil there. (besides the nasty XSS one in Jetpack, which was caused by a static HTML file) > - From what I've heard, security fixes are provided to…
Comment linking /2015/09/ownCloud-security-development-over-the-years/
on “Western Digital and OwnCloud Team Up to Bring OwnCloud to Home Users”Submitted Subtle vulnerabilities with PHP and cURL as a story · 3 points
HN discussionHappy to answer this. First of all: Makes using a specific programming language a software much less secure? Probably not. You can do mistakes in every programming language. But since a lot of software is written in PHP and there are also many unexperienced PHP developers this reflects kinda bad on the language. There is often the perceiption that ownCloud would be insecure because we have so many advisories. But th…
Comment linking /2015/09/ownCloud-security-development-over-the-years
on “OwnCloud Statement concerning the formation of Nextcloud”Submitted From Markdown to RCE in Atom as a story · 1 points
HN discussion