=== guiverc2 is now known as guiverc [13:44] I think I've discovered a bug that could have security implications. [13:45] I noticed it during the install a couple of weeks ago, but shrugged it off as me maybe doing something wrong, I've not used a *ubuntu, or any linux with a DE, for a very long time. [13:45] do tell [13:45] However, I just did an update, and the same thing happened, so I presume it's reproduceable. [13:45] or report appropriately [13:46] are you sure it's not a misunderstanding on your behalf? [13:46] usually, people don't just discover security flaws during installation [13:47] I asked lubuntu update to install the updates [13:47] The sudo pop-up appears, I type in my luser's password. [13:48] The progress windo immediately starts showing some logs [13:48] However, a second sudo password window appears immediately too, this time saying "attempt #2" [13:49] That's odd, as I couldn't have messed up - or could I? - as the logs are progressing. [13:49] I wait for the logs to quiesce, in case there's just some racing going on. [13:49] on any distro, I prefer to do updates via command line [13:50] command line has a lot more advantages [13:50] Progress seems to stop. [13:50] you can see what's going on better, and scroll back to see what happened [13:50] GUI hides stuff [13:50] doesn't matter what distro or OS it is, GUI is terrible for stuff like this [13:50] I recommend avoiding it entirely [13:50] Well, that's another UX bug (updates to the progress always snap you back to the bottom, even if you've dragged the scrollbar up the logs) [13:50] harder to see what's happening, it's harder to paste logs, harder in many ways [13:51] which version of lubuntu? [13:51] maybe report it to them; this channel isn't official [13:51] or post on their forums or whatever with detailed info for a second opinion [13:51] Anyway, I wonder if it's truly waiting for me, so I type in my password again. [13:51] And my password appears in plain text at the bottom of the logs. [13:51] yeah that doesn't sound normal [13:51] I consider that a security flaw. [13:52] this is on a fresh install? [13:52] something doesn't sound right about your setup [13:52] or maybe you've found a known X11 bug, who knows [13:53] I first saw the bug immediately after install. [13:53] video it [13:53] This is noble [13:53] I prefer debian stable anyway [13:53] and using apt from a terminal [13:53] learn to use apt [13:54] I know how to use apt - I run devuan on my other dozen machines. [13:54] This is my lubuntu machine that I use because some software I need needs a lubuntu. [13:55] (technically my virtual machine, it runs in QEMU under devuan) === guiverc2 is now known as guiverc