Live data from Hacker News

Remove “This incident will be reported.” from user warnings

github.com

91–100 of 302 posts

Re: Remove “This incident will be reported.” from user warnings

#91

Earlier quoted context omitted.

Yeah, I kind of lament them removing this warning if I'm going to be honest. It feels like something such as that should be more common best practice. Of course decent log collection/monitoring should also be able to catch authlog stuff and alert accordingly and I'm sure most organizations rely on solutions like that instead of letting things get lost in email

I feel like that warning comes right out of the era of multi-user machines with unprivileged shell accounts. That era is largely gone. Today, someone, possibly a less knowledgeable user, runs sudo on their single user laptop that they completely own outright, and may get confused who they're being "reported" to.

To themselves of course. That's pretty clear.

But there is a renewed focus on corporate laptops to remove admin rights on windows. Not really because the user is not being trusted, but because malware has a lot more options for bypassing EDR/antimalware and persistence when it runs with admin rights.

I'm sure this will come to Linux too at some point.

Re: Remove “This incident will be reported.” from user warnings

#93
Reminds me of using Win9x when programs crashed (as often happened then), prompting Windows to present those "This program has performed an illegal operation" dialogs.

As a kid the only bit of that message that made any sense was "illegal operation" which made me wonder if I'd broken some law somehow.

Re: Remove “This incident will be reported.” from user warnings

#95
post #72

Earlier quoted context omitted.

"This incident will be logged" may have been better.

“Your transgression has been noted and punishment may be dispensed accordingly”.

"A disapproving God has noted your infraction, and Santa Claus has added an entry on the naughty list for you"

Re: Remove “This incident will be reported.” from user warnings

#96

Earlier quoted context omitted.

They are just paying their respects.

What does F mean?

It's a call of duty meme, at some point your character is at a funeral and F is the action button and there is a prompt on the casket "press F to pay respects"

Re: Remove “This incident will be reported.” from user warnings

#97

Can someone share even one story where sudo reporting these "incidents" was helpful? This feature seems to come from a world where elite hackers simply repeat the same sudo command over and over hoping it will eventually work.

I have a small server that some of my friends have accounts on. When they accidentally (or not!) try to use sudo (often this happens with a "curl | sh" thing) I like to be informed.

Re: Remove “This incident will be reported.” from user warnings

#98
post #12

I was always disappointed it never summoned some grumpy graybeard unix admin from a dark server room basement to give me a chiding lecture.

Just because we’ve never seen him doesn’t mean he hasn’t at some point quietly summoned a curse on us

"man the internet has been really slow lately"

graybeard chuckles in the server room

Re: Remove “This incident will be reported.” from user warnings

#99
post #75

Next step is to remove users/groups/sudo from Linux/UNIX entirely. I'm one person using the computer, running software I trust. I don't need it.

I suspect if you look in your passwd file you’ll find lots of users. Does nginx really need to read the files in your home directory?

Re: Remove “This incident will be reported.” from user warnings

#100
post #41

My favorite message I got in Ubuntu in 2008 (I still have a screenshot of it): > Could not grab your mouse. > A malicious client may be eavesdropping on your session or you may have just clicked a menu or some application just decided to get focus. > Try again. > [Close]

This sounds like an xwindows thing. The way popup menu windows work in x, is the program grabs all keyboard and mouse events.
Post reply on HN