Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remove “This incident will be reported.” from user warnings

github.com

Post reply on HN
Print view View original

131–140 of 302 posts

Re: Remove “This incident will be reported.” from user warnings

#131

Post by teaearlgraycold »

alexb_ wrote: post #113
kragen wrote: post #68

Earlier quoted context omitted.

something like 99% of computers with sudo installed are single-user machines where the only effect of the warning is to scare people and it's only been the same since people started to switch to sudo in the late 90s; su never printed such a warning

>the only effect of the warning is to scare people Good. If you're not familiar with what sudo does, then you shouldn't be using it in the first place.

If it’s your own computer you should be able to break it until you learn how not to.

Re: Remove “This incident will be reported.” from user warnings

#132

Post by stilley2 »

abnry wrote: post #87

Funny story. When I was in grad school, the math department office I was in had Linux computers administrated by the department. One day I was goofing in my shared office with a fellow grad student by playing with what resources were available. We were trying sudo and failed with enough silly passwords that we got the "this incident will be reported" message. I confidently told my officemate that these messages were…

I once entered 'sudo echo hi" or something similar on a large HPCC and received an email back from a sysadmin that just said "hello".

Re: Remove “This incident will be reported.” from user warnings

#133

Post by IshKebab »

Arch485 wrote: post #86
john_shafthair wrote: post #78

Earlier quoted context omitted.

[flagged]

I don't really think this is a security issue. If an attacker is able to try executing sudo on your system, you have much bigger problems (for example, data exfil can be done by non-sudo users in many cases, or if your system is sufficiently old there's known priviledge escalation exploits). I don't think an attacker gains much knowledge from knowing whether or not they're on the naughty list.

If the attacker can execute sudo they can probably just alias it to a sudo that sends them the password and wait. The number of users on multiuser systems who don't have sudo access is just vanishingly small. Universities perhaps. But in most companies, if they trust you with access to the machine in the first place they'll trust you with sudo access.

Re: Remove “This incident will be reported.” from user warnings

#136

Post by stcg »

hutzlibu wrote: post #111
hoodmane wrote: post #77

Earlier quoted context omitted.

Yes. More or less the first time I used Linux was on a fedora workstation at my desk at MIT. The very nice sysadmin down the hall sent me an email just a bit later saying "We see you were trying to install x program. We installed it for you." I understand that this is a very rare experience but the first time I saw that message, a helpful person was actually looking at these reports.

Does this kind of sysadmin still exists? (or do they even still have the freedom to be so kind?) I cannot really imagine that happening today, at least not in "professional" context.

It still happens, a fellow student and friend of mine got this response ('installed it for you') about two years ago at Radboud University Nijmegen after entering `sudo apt install nasm`

Re: Remove “This incident will be reported.” from user warnings

#137

Post by 1lint »

stilley2 wrote: post #132
abnry wrote: post #87

Funny story. When I was in grad school, the math department office I was in had Linux computers administrated by the department. One day I was goofing in my shared office with a fellow grad student by playing with what resources were available. We were trying sudo and failed with enough silly passwords that we got the "this incident will be reported" message. I confidently told my officemate that these messages were…

I once entered 'sudo echo hi" or something similar on a large HPCC and received an email back from a sysadmin that just said "hello".

That's an amusing anecdote, though I find it bothersome the sysadmin failed to correctly implement the echo command

Re: Remove “This incident will be reported.” from user warnings

#138

Post by dan_linder »

ibic wrote: post #50

As it happens - "The warning was restored in a slightly altered form in 9757d29" ( https://github.com/sudo-project/sudo/commit/9757d29a24ac1872... ) - Millert.

This is great! Now when I break into a system I can quickly verify if they've got this aspect of sudo logging setup or not!

Only 1/2 /s

Re: Remove “This incident will be reported.” from user warnings

#139

Post by ww520 »

abnry wrote: post #87

Funny story. When I was in grad school, the math department office I was in had Linux computers administrated by the department. One day I was goofing in my shared office with a fellow grad student by playing with what resources were available. We were trying sudo and failed with enough silly passwords that we got the "this incident will be reported" message. I confidently told my officemate that these messages were…

Speaking of interaction with the admin. Back in the days when I was in school, the computer lab ran a Honeywell mainframe with terminals. I wrote a program emulating the logon screen to intercept the username and password of the unsuspecting students logging on and to email them to me. I was going to post the list of all the usernames and passwords at the end of the semester on the wall. I dubbed it the Fishing project with my friends (yes, that's before all the phishing activities went rampant).

I collected dozens of usernames and passwords before the professor of my CS class stopped me one day after class and said, you better stop whatever you're doing. Apparently the system saved the typing of all sessions and the admin actually went through all of them.

The next semester all the terminals had a physical switch installed that had to be pressed to reset the terminal before logon. That killed any running program. I was glad to play a small part in improving the security of my school lab.

Re: Remove “This incident will be reported.” from user warnings

#140

Post by lucb1e »

matsemann wrote: post #126
forgotusername6 wrote: post #54

So according to the comments it isn't actually gone, just the wording updated and now dependent on if you have actually set up the mailer to report it somewhere https://github.com/sudo-project/sudo/commit/9757d29a24ac1872...

But I use the output from sudo in my program, changing this message breaks my scripts. /s

Here, you dropped this: https://xkcd.com/1172/
Post reply on HN