Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When was the famous "sudo warning" introduced? (2019)

retrocomputing.stackexchange.com

Post reply on HN
Print view View original

121–130 of 180 posts

Re: When was the famous "sudo warning" introduced? (2019)

#121

Post by thrw42A8N »

vundercind wrote: post #102
thrw42A8N wrote: post #80

Earlier quoted context omitted.

Sounds like you have never been to Europe. Here they make you actually sign (as in pen and paper) this stuff before they give you access.

I used to read an Eastern European world traveler photoblogger who’d been to damn near every country (even a lot that most folks from even semi-developed countries would consider far too dangerous or boring to be worth going out of your way to visit—he’d surely been to at least 150 countries, several more than once) and according to him the specific behavior of posting regulations and signs all over the place is prac…

The European way is to post a gigantic wall of text like 1.5 by 1.5 meters with small letters and a full binding contract somewhere close to the entrance.

Re: When was the famous "sudo warning" introduced? (2019)

#122

Post by xorcist »

e145bc455f1 wrote: post #117
xorcist wrote: post #73

Earlier quoted context omitted.

It differs by not being insane. Trivial functionality that actually works. It's what's good about systemd. It doesn't require forwarding sockets or giving free access to root just for building images. It doesn't explode just because you touch your nftables rules. It doesn't suddenly expose a process to the Internet because of some undocumented option. You can use all the normal tools such as auditd and SELinux withou…

How is it different from podman then?

It's not a docker replacement. Use podman to replace docker. Use system to start stuff (in a namespace or otherwise).

Re: When was the famous "sudo warning" introduced? (2019)

#123

Post by mixmastamyk »

quotemstr wrote: post #32
zoky wrote: post #26

Earlier quoted context omitted.

The system has no way of knowing who you are. It can’t tell if you’re really you, or just someone who walked by and started using your computer while you got up to go to the bathroom. If you really think the threat model is outdated, why not just run everything as root? Also, you know you can configure sudo to not ask you for a password, right? So why do you need to use a whole new framework and privilege model to ba…

The system does know who I am: the command is coming from me. An attacker doesn't need to elevate privileges to compromise me: he can steal whatever he needs without becoming root. He can replace sudo and steal my password too. The whole concept of my personal user account needing to elevate to root to make "system" changes is a relict of long-gone days of BBSes, shell accounts, and time sharing. These days, we shoul…

Your first paragraph is obviously wrong, so maybe dial back the pronouncements.

What you are advocating for was a disaster for Windows, btw.

Re: When was the famous "sudo warning" introduced? (2019)

#124

Post by Aloha »

bigstrat2003 wrote: post #118
aerzen wrote: post #105

Earlier quoted context omitted.

What kind of sysadmins are they then? I don't want to sound dismissive, but is a "windows sysadmins" a thing? Do companies run windows on servers?

Companies absolutely run Windows servers. In fact, every single company I've ever worked for (except one very small company) has had them. Usually at a minimum, you will have servers running Active Directory, and perhaps DNS (because AD-integrated DNS zones are useful). Then, more often than not companies are MS Exchange shops, plus Sharepoint is common enough. Generally people aren't running web servers on Windows,…

> Generally people aren't running web servers on Windows, but the internal IT infrastructure world uses a ton of Windows servers.

With good reason I'd note, its a use case which windows is profoundly good at - whereas web servers are not something I would say windows is very good at.

Re: When was the famous "sudo warning" introduced? (2019)

#125

Post by TacticalCoder »

I've got no "sudo" command on my main Linux workstation: the only way to log in as root is by using a Yubikey, from another computer, which is on a private LAN only shared between my workstation and my "terminal" (an old laptop which I know only use as some kind of remote console/terminal to log in as root on my workstation). So on my workstation I allow ssh root login, but only using keys (no password) (and only on that private LAN). Getting in as root without the Yubikey means finding a remote exploit in sshd.

And in all my containers: no sudo command installed either.

As you may have guessed I'm not a big fan of sudo.

Re: When was the famous "sudo warning" introduced? (2019)

#126

Post by mixmastamyk »

TacticalCoder wrote: post #125

I've got no "sudo" command on my main Linux workstation: the only way to log in as root is by using a Yubikey, from another computer, which is on a private LAN only shared between my workstation and my "terminal" (an old laptop which I know only use as some kind of remote console/terminal to log in as root on my workstation). So on my workstation I allow ssh root login, but only using keys (no password) (and only on…

Is installing sudo in a container common? Don’t think I’ve ever seen that.

Re: When was the famous "sudo warning" introduced? (2019)

#127

Post by culi »

amalcon wrote: post #108
ksymph wrote: post #93

Earlier quoted context omitted.

For anyone else who hasn't heard it before, a bush lawyer is "One who is not qualified in law yet attempts to expound on legal matters." https://en.m.wiktionary.org/wiki/bush_lawyer

TIL, this was my first time seeing the term. I just assumed that the poster had left out the second word of "bush league". That would mean something similar but subtly different, though (a lawyer not up to professional standards).

I'd imagine both terms are derogatory, no? "Bush" is usually a derogitroy descriptor of aboriginal peoples as "primitive" or "unsophisticated"

Re: When was the famous "sudo warning" introduced? (2019)

#128

Post by urxvtcd »

furyofantares wrote: post #86
ggm wrote: post #16

Back in the 90s we were told ostentatiously to include "unauthorised access is not permitted" to the login prompt. Why? Because the login prompt said "please login:" and this was being read by some bush lawyer as an invitation to connect, and therefore would impede a case if we had a hacker login with a stolen password. I think it was founded on urban myth, but I assure you this is what we were told to do: add text t…

As a kid I saw a sign going into the bathroom at Sears that said "prohibited behavior not allowed". I had to ask my mom what prohibited meant and was quite surprised when she explained that it means "not allowed".

Similar feeling with "No trespassing"... like, duh!

Re: When was the famous "sudo warning" introduced? (2019)

#129

Post by sanarothe »

VeninVidiaVicii wrote: post #38
Daneel_ wrote: post #27

Earlier quoted context omitted.

Interesting comment actually. I would have assumed that the vast majority of people using Linux are still sysadmins in small and large companies - this is certainly my personal experience. I wonder how many home users there are versus systems managed by sysadmins. I would still think there’s more in the corporate world, while I would think the opposite for Windows.

I hate to sound elitist, but I straight-up can’t do any serious coding on anything other than a Linux box. Most of what I do these days is statistical inference on bacterial genomes in the context of antibiotic treatment. I understand that I’m not the average user, but then again, nobody really is.

If one is really hard pressed to use a windows box, I have found WSL to be a godsend. (eg at work, which is luckily at a relatively small company where IT isn't as locked down as other places I've worked.)

On the other hand, I tried to use powershell the other day for some simple admin tasks and ooooh wow I sure don't have anything nice to say.

Also my living is made on the Windows side, and not the Linux side, so I guess I don't know the pain points of WSL.

Re: When was the famous "sudo warning" introduced? (2019)

#130

Post by e145bc455f1 »

cedws wrote: post #34
weitendorf wrote: post #20

Earlier quoted context omitted.

I think this is underrated as a design flaw for how Linux tends to be used in 2024. At its most benign it's an anachronism and potential source of complexity, as its worst it's a major source of security vulnerabilities and unintended behavior (eg linux multitenancy was designed for two people in the same lab sharing a server, not for running completely untrusted workloads at huge scale, so it doesn't really implemen…

I agree that multi-user should go away for modern server workloads, however, users are used as a blast door. Mainly because Linux's security model is lacking. systemd for example commonly runs services under separate users to make it more difficult for a compromised application to elevate privileges. Android does something similar AFAIK. Users should have never became a security boundary to isolate applications, but…

>systemd for example commonly runs services under separate users

Doesn't this have to be manually setup. Can i make systemd to run a service under a temporary user automatically.

Post reply on HN