71–80 of 180 posts
It’s a funny artifact because most people today use, and have only used Linux in a “single user” context. The “local system administrator” is me!
Earlier quoted context omitted.
I think this is underrated as a design flaw for how Linux tends to be used in 2024. At its most benign it's an anachronism and potential source of complexity, as its worst it's a major source of security vulnerabilities and unintended behavior (eg linux multitenancy was designed for two people in the same lab sharing a server, not for running completely untrusted workloads at huge scale, so it doesn't really implemen…
Actually, I have been wondering if using a Linux system as multi-user could be a boon in security. As single user, each and every process has full and complete control of $HOME. Instead, I would prefer all applications were sandboxed to their own little respective areas with minimal access to data unless explicitly authorized. Without going full QubeOS, get some amount of application separation so my photo utility do…
And it's a bad UX also. As a user, I don't want to deal with fake users, for example.
Earlier quoted context omitted.
> Instead, I would prefer all applications were sandboxed to their own little respective areas with minimal access to data unless explicitly authorized. You’ll be interested to learn about systemd-nspawn. You can sandbox stuff with it really easily. It is like chroot so not really resource intensive, lighter than a container. I think a pretty useful thing you can do is boot ephemeral instances. So whatever someone do…
I read a good chunk of that wiki link, but didn't really come away with an understanding of how it differs from just using Docker for sandboxing an app. Did you have any insight there you might share?
It doesn't require forwarding sockets or giving free access to root just for building images. It doesn't explode just because you touch your nftables rules. It doesn't suddenly expose a process to the Internet because of some undocumented option. You can use all the normal tools such as auditd and SELinux without having your configuration overwritten by a madman.
Earlier quoted context omitted.
I agree that multi-user should go away for modern server workloads, however, users are used as a blast door. Mainly because Linux's security model is lacking. systemd for example commonly runs services under separate users to make it more difficult for a compromised application to elevate privileges. Android does something similar AFAIK. Users should have never became a security boundary to isolate applications, but…
> Linux's security model is lacking It's not lacking at all. The root + users model is common not only across OSes but also all sort of physical devices.
I was building a user-impersonation system, and it allowed a power-admin to login as another user to change their settings and to help them.
When you signed in as the user it said:
> You are now signed in as User\##{user_id}, behave nicely ;-)
and when you switched back to your admin it said:
> You are now signed back in as Admin\##{admin_id}, wreak havoc! ;-)
I met with a former colleague years later, and he still referred to the wreak havoc message that I didn't think about for more than 10 seconds, but I had installed that in his brain and it lived there as a memory of that company and that system.
Pretty wild that sudo is still the most common authorization framework for linux.
Earlier quoted context omitted.
My networking instructor still suggests this today when configuring the login for routers and switches
Perhaps it is useful for countries that still don't have any real computer crime laws? Because in most western nations it would be totally pointless.
Earlier quoted context omitted.
Interesting comment actually. I would have assumed that the vast majority of people using Linux are still sysadmins in small and large companies - this is certainly my personal experience. I wonder how many home users there are versus systems managed by sysadmins. I would still think there’s more in the corporate world, while I would think the opposite for Windows.
> I wonder how many home users there are versus systems managed by sysadmins Isn’t Android the most popular Linux distro these days? Probably also most TV set-top boxes and other IoT devices
Back in the 90s we were told ostentatiously to include "unauthorised access is not permitted" to the login prompt. Why? Because the login prompt said "please login:" and this was being read by some bush lawyer as an invitation to connect, and therefore would impede a case if we had a hacker login with a stolen password. I think it was founded on urban myth, but I assure you this is what we were told to do: add text t…
My networking instructor still suggests this today when configuring the login for routers and switches
Earlier quoted context omitted.
Perhaps it is useful for countries that still don't have any real computer crime laws? Because in most western nations it would be totally pointless.
No, the US is the main country that loves these messages. Have you seen the size of universities or the government ? It's just clerical staff doing make believe work. Go to any .gov website. They'll throw up a wall of bs before you log in (e.g., https://ttp.dhs.gov/ ).