Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When was the famous "sudo warning" introduced? (2019)

retrocomputing.stackexchange.com

Post reply on HN
Print view View original

11–20 of 180 posts

Re: When was the famous "sudo warning" introduced? (2019)

#11

Post by don-code »

pram wrote: post #3

It’s a funny artifact because most people today use, and have only used Linux in a “single user” context. The “local system administrator” is me!

Indeed, I've been having this conversation with the junior engineers on my team. UNIX was designed for the days when computers - and the operating system - were shared resources, and each individual's permissions to it had to be strictly defined and controlled. Nowadays, we have users as a vestige, and partially as a hindrance, especially where our applications in production are all single processes deployed in containers.

But anyway, it at least gives them the context on why they're working on these projects to not make containers run as root.

Re: When was the famous "sudo warning" introduced? (2019)

#12

Post by alwayslikethis »

dhosek wrote: post #7
quotemstr wrote: post #5

Earlier quoted context omitted.

And that's why we should 1) switch from using "sudo some-command --some-argument" to "some-command --some-argument" in which some-command authenticates and elevates via polkit, and 2) configure polkit to allow the initial human user of the machine to elevate without typing a password. #2 is just a default, and special configurations can of course override it and return a configuration much like what we have today. Bu…

The problem is that any command that elevates privileges introduces a potential hacking vector so while having to enter your password or provide some other authentication at points where privileges get escalated is not an unreasonable ask.

I don't think privilege escalation is a big concern on most personal systems. If you run any malicious code, even unprivileged, you're basically already screwed anyways since the code can access all of your home, upload it, delete/encrypt it, etc.

https://xkcd.com/1200/

Re: When was the famous "sudo warning" introduced? (2019)

#13

Post by 0xbadcafebee »

Boogie_Man wrote: post #4
pram wrote: post #3

It’s a funny artifact because most people today use, and have only used Linux in a “single user” context. The “local system administrator” is me!

I often give myself stern talking tos when I made ignorant sysadmin decisions

I put myself on a PIP for losing my backups. If I'm not careful I might fire my ass

Re: When was the famous "sudo warning" introduced? (2019)

#14

Post by zoky »

quotemstr wrote: post #5
pram wrote: post #3

It’s a funny artifact because most people today use, and have only used Linux in a “single user” context. The “local system administrator” is me!

And that's why we should 1) switch from using "sudo some-command --some-argument" to "some-command --some-argument" in which some-command authenticates and elevates via polkit, and 2) configure polkit to allow the initial human user of the machine to elevate without typing a password. #2 is just a default, and special configurations can of course override it and return a configuration much like what we have today. Bu…

Sounds like an opaque, finicky, and non-portable solution to a relatively minor problem.

Re: When was the famous "sudo warning" introduced? (2019)

#15

Post by tadfisher »

dhosek wrote: post #7
quotemstr wrote: post #5

Earlier quoted context omitted.

And that's why we should 1) switch from using "sudo some-command --some-argument" to "some-command --some-argument" in which some-command authenticates and elevates via polkit, and 2) configure polkit to allow the initial human user of the machine to elevate without typing a password. #2 is just a default, and special configurations can of course override it and return a configuration much like what we have today. Bu…

The problem is that any command that elevates privileges introduces a potential hacking vector so while having to enter your password or provide some other authentication at points where privileges get escalated is not an unreasonable ask.

No, the problem is that the command elevates privileges. Installing and running software should not be an admin-level operation, because its blast radius should be limited to data under the user account (at worst). Flatpak and other sandboxing technologies solves this for the most part.

Re: When was the famous "sudo warning" introduced? (2019)

#16

Post by ggm »

Back in the 90s we were told ostentatiously to include "unauthorised access is not permitted" to the login prompt.

Why? Because the login prompt said "please login:" and this was being read by some bush lawyer as an invitation to connect, and therefore would impede a case if we had a hacker login with a stolen password.

I think it was founded on urban myth, but I assure you this is what we were told to do: add text to make it plain, the invitation was to legitemate users only.

I felt the sudo warning was in the same spirit.

Re: When was the famous "sudo warning" introduced? (2019)

#18

Post by codetrotter »

II2II wrote: post #6
pram wrote: post #3

It’s a funny artifact because most people today use, and have only used Linux in a “single user” context. The “local system administrator” is me!

... and of those who have used multi-user Unix systems, very few would have had the privilege to use sudo in that context. (Unless you count managing a family computer, and even that is likely rare these days given that everyone seems to have their own machine.)

I was member of a student union at my university, for people interested in computers.

We had desktop computers and servers that belonged to the student union, and member students would eventually be granted sudo privileges if they had a reason to need it.

When they gave me and my friends sudo privileges they told us basically the sudo lecture. Use it for good, don’t snoop in other students files, and be careful to not break stuff. They even had a real-life story of their own, about one past member that was kicked out of the union because he had used his sudo privileges to read solutions to an assignment from the home directory of another member!

This wasn’t even that long ago. Around 2010.

It was a nice student union.

Re: When was the famous "sudo warning" introduced? (2019)

#19

Post by jorvi »

don-code wrote: post #11
pram wrote: post #3

It’s a funny artifact because most people today use, and have only used Linux in a “single user” context. The “local system administrator” is me!

Indeed, I've been having this conversation with the junior engineers on my team. UNIX was designed for the days when computers - and the operating system - were shared resources, and each individual's permissions to it had to be strictly defined and controlled. Nowadays, we have users as a vestige, and partially as a hindrance, especially where our applications in production are all single processes deployed in conta…

> strictly defined and controlled. Nowadays, we have users as a vestige, and partially as a hindrance

Not so. Multiple users make perfect sense for a household tablet or a gaming PC / console shared between siblings.

Concurrent access is rarely a thing anymore, but serial access is a very common use case.

Re: When was the famous "sudo warning" introduced? (2019)

#20

Post by weitendorf »

pram wrote: post #3

It’s a funny artifact because most people today use, and have only used Linux in a “single user” context. The “local system administrator” is me!

I think this is underrated as a design flaw for how Linux tends to be used in 2024. At its most benign it's an anachronism and potential source of complexity, as its worst it's a major source of security vulnerabilities and unintended behavior (eg linux multitenancy was designed for two people in the same lab sharing a server, not for running completely untrusted workloads at huge scale, so it doesn't really implement resource fairness or protect against DoS well).

I haven't had a chance to try it out but this is why I think Talos linux (https://www.talos.dev/) is a step in the right direction for Linux as it is used for cloud/servers. Though personally I think multitenancy esp. regarding containerized applications/cgroups is a bigger problem and I don't know if they're addressing that.

Post reply on HN