Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remove “This incident will be reported.” from user warnings

github.com

Post reply on HN
Print view View original

71–80 of 302 posts

Re: Remove “This incident will be reported.” from user warnings

#71

Post by TaylorAlexander »

kragen wrote: post #68
john_shafthair wrote: post #63

Earlier quoted context omitted.

That seems pretty stupid. While they're at it, why not update the SSH warning banner with a list of what we do and don't log on this system. As a courtesy to their adversary. This sudo message has been the same since the dawn of time. There is literally no reason to correct it. This is the one place you don't want to be pedantic, leaking security configuration via stderr.

something like 99% of computers with sudo installed are single-user machines where the only effect of the warning is to scare people and it's only been the same since people started to switch to sudo in the late 90s; su never printed such a warning

Reminds me of when I was younger and my mom and my brother were using a windows computer. They got the message “an illegal error has occurred” and my mom called me to ask if they had broken the law.

Re: Remove “This incident will be reported.” from user warnings

#72

Post by rbanffy »

johnisgood wrote: post #10
seanhunter wrote: post #4

Thank goodness. That was a terrible message. I remember my very first experience with unix was setting up Red Hat 3.0.3[1] at work for a small internet company in like 1997 and getting that message and just not knowing what on earth to do. There was noone in my company who could help me and all I had was a unix book from my local library which didn't even cover linux (but I sort of thought it would be helpful). [1] W…

"This incident will be logged" may have been better.

“Your transgression has been noted and punishment may be dispensed accordingly”.

Re: Remove “This incident will be reported.” from user warnings

#73

Post by rbanffy »

gtirloni wrote: post #62
Buttons840 wrote: post #46

Can someone share even one story where sudo reporting these "incidents" was helpful? This feature seems to come from a world where elite hackers simply repeat the same sudo command over and over hoping it will eventually work.

> Can someone share even one story where sudo reporting these "incidents" was helpful? No, not a single one.

“And, if we did, we’d have to kill you.”

Re: Remove “This incident will be reported.” from user warnings

#74

Post by jimmaswell »

dingledork69 wrote: post #13
jamal-kumar wrote: post #7

For those wondering where the reports go, under systemd-based linux distributions ideally you can get them with this: sudo journalctl /bin/sudo Historically speaking however the sysadmin with access to the 'mail' command would be able to run that and see mail delivered to root@localhost for these reports. I think at least OpenBSD still does things this way [1], but they moved away from sudo YEARS ago now [2] [1] http…

Or you set up your system so mail for root gets redirected to an smtp server with an actual inbox read by actual people

I was surprised to start getting emails about my cron tasks once I set up my mail server. It's neat.

Re: Remove “This incident will be reported.” from user warnings

#77

Post by hoodmane »

Buttons840 wrote: post #46

Can someone share even one story where sudo reporting these "incidents" was helpful? This feature seems to come from a world where elite hackers simply repeat the same sudo command over and over hoping it will eventually work.

Yes. More or less the first time I used Linux was on a fedora workstation at my desk at MIT. The very nice sysadmin down the hall sent me an email just a bit later saying "We see you were trying to install x program. We installed it for you." I understand that this is a very rare experience but the first time I saw that message, a helpful person was actually looking at these reports.

Re: Remove “This incident will be reported.” from user warnings

#78

Post by john_shafthair »

kragen wrote: post #68
john_shafthair wrote: post #63

Earlier quoted context omitted.

That seems pretty stupid. While they're at it, why not update the SSH warning banner with a list of what we do and don't log on this system. As a courtesy to their adversary. This sudo message has been the same since the dawn of time. There is literally no reason to correct it. This is the one place you don't want to be pedantic, leaking security configuration via stderr.

something like 99% of computers with sudo installed are single-user machines where the only effect of the warning is to scare people and it's only been the same since people started to switch to sudo in the late 90s; su never printed such a warning

[flagged]

Re: Remove “This incident will be reported.” from user warnings

#79

Post by blueflow »

At @dayjob, we have a mailing list for root@ mails. We actively use it for recording the output of cronjobs and like that. Several times a year i get sudo fail mails from random people on the terminal servers. A few years ago i actually compiled a list of the most prolific repeat offenders and they got a bag of marshmallows that have the form of coal nuggets right before Christmas vacation.

Re: Remove “This incident will be reported.” from user warnings

#80

Post by microtherion »

john_shafthair wrote: post #63
forgotusername6 wrote: post #54

So according to the comments it isn't actually gone, just the wording updated and now dependent on if you have actually set up the mailer to report it somewhere https://github.com/sudo-project/sudo/commit/9757d29a24ac1872...

That seems pretty stupid. While they're at it, why not update the SSH warning banner with a list of what we do and don't log on this system. As a courtesy to their adversary. This sudo message has been the same since the dawn of time. There is literally no reason to correct it. This is the one place you don't want to be pedantic, leaking security configuration via stderr.

Maybe update pnews.sh as well to recalibrate the estimate of "hundreds, if not thousands of dollars" per usenet message.
Post reply on HN