Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Codex just found a "workaround" of not having sudo on my PC

twitter.com

Post reply on HN
Print view View original

191–200 of 330 posts

Re: Codex just found a "workaround" of not having sudo on my PC

#191

Post by PokestarFan »

eximius wrote: post #174
Root_Denied wrote: post #131

Earlier quoted context omitted.

My understanding is that docker will expose the ports to the host machine's network interfaces, which is a crucial difference. For my home server running docker that means exposed to the LAN, but not the WAN unless I add in a port forwarding rule on my router. Similarly in an enterprise environment you would be exposing the port on whatever VLAN the host is connected to, which hopefully doesn't have directly transit…

If you ever suddenly get IPv6, it may become globally reputable without you realizing.

Most modern equipment bans inbound traffic that doesn't match an existing outbound traffic flow

Re: Codex just found a "workaround" of not having sudo on my PC

#192

Post by gruez »

MrDrMcCoy wrote: post #126
0xbadcafebee wrote: post #104

Earlier quoted context omitted.

curl -fsSL https://get.docker.com/rootless | sh

Please stop spreading this toxic curl|sh nonsense. It's wildly corrosive to security and system stability.

Is it really that much worse than using a package manager that drops a binary that you're not going to inspect anyways?

Re: Codex just found a "workaround" of not having sudo on my PC

#193

Post by Kaliboy »

smarnach wrote: post #187
Kaliboy wrote: post #181

Earlier quoted context omitted.

But there it's a feature.

Except for the M in LAMP.

Let's hope the M at least has a root password.

But you are right, that would be nasty. In my time the LAMP tutorials used the distribution packages so they always had sensible defaults.

Re: Codex just found a "workaround" of not having sudo on my PC

#195

Post by tominous »

worik wrote: post #103
fpoling wrote: post #27

Earlier quoted context omitted.

User namespaces significantly rise the risk of exploits and many setups disable them. One may argue that Docker should have used them when they were available, but that would break too many useful setups involving privileged containers.

> User namespaces significantly rise the risk of exploits How?

Here's one (CIFSwitch) from a couple of days ago: https://heyitsas.im/posts/cifswitch/

Re: Codex just found a "workaround" of not having sudo on my PC

#196

Post by dangus »

jon-wood wrote: post #53
dangus wrote: post #3

Earlier quoted context omitted.

Right, why is their login user in the docker group? Mine sure isn’t.

Because it effectively makes no difference to my security posture. My user account also has sudo access (it requests TouchID but I also wouldn't die on the hill if someone said they have no password sudo access), and realistically everything of value on this machine exists in my home directory. Being able to escalate to root really doesn't give an attacker very much that they don't already have if they've got access…

Maybe you don’t do anything with your computer but for me the difference between my sudo+password/fingerprint and sudoless access to my linux user is huge.

For one thing, 1Password unlocks with system authentication unless it’s been inactive for a certain amount of time or if the system has been restarted.

Without sudo you can’t modify my firewall rules, can’t modify my kernel, boot partition, install/run privileged software, and the list goes on and on.

Sure, having my local account compromised would be really bad, but security is done in layers. I’m not going to give my local user permanent root access via docker just because I didn’t feel like typing “sudo.” That’s not enough of a benefit to leave that door wide open.

Think about it this way: there could be an exploit where you could run something as my user without knowing my password. Maybe some program my user is running has an exploit, let’s say yet another npm package gets compromised and I unwittingly run it. If you can now run anything in docker as root with that blast radius just got way worse.

Re: Codex just found a "workaround" of not having sudo on my PC

#197

Post by jeswin »

Docker must always be installed rootless on Linux - https://docs.docker.com/engine/security/rootless/

There's even an install script for it: curl -fsSL https://get.docker.com/rootless | sh

This has been there for a while. The root install option should be removed.

Re: Codex just found a "workaround" of not having sudo on my PC

#198

Post by amarant »

f33d5173 wrote: post #93
embedding-shape wrote: post #39

Earlier quoted context omitted.

Because of how Docker works, not because of how Unix permissions work.

Unix has always had incredibly weak protections between users. You shouldn't rely on it as a security boundary. Think of it as a "keep honest users honest" protection. And llms are not honest.

I've seen this sentiment a few times on HN recently I wonder where it comes from?

The only thing I can think of is that if the protected files are on a unencrypted drive, then you could boot from a live-usb(or similar) where you have root and read anything. But that's completely irrelevant as we're talking about a piece of software running on a system without root. In this scenario Unix user permissions are safe, barring user error (such as accidentally granting root, like in this instance)

Of course security holes happens, such as copy-fail, but it's pretty rare in the grand scheme of things, and tend to get patched quickly(like copy-fail was)

Re: Codex just found a "workaround" of not having sudo on my PC

#199

Post by b65e8bee43c2ed0 »

alsetmusic wrote: post #169
itintheory wrote: post #163

Earlier quoted context omitted.

This feels like using sudo is just inherently unsafe.

This feels like using a computer is inherently unsafe. On the plus side, once we outlaw them we'll shut down the ability for conspiratorial thinking to spread easily and the world will slowly heal from the last couple of decades (the previous one in particular). Hooray! We're finally doing something about the harms of social media. Smash your computer today!

I think we're only a few decades away from these things being said unironically.

Re: Codex just found a "workaround" of not having sudo on my PC

#200

Post by CGamesPlay »

jeswin wrote: post #197

Docker must always be installed rootless on Linux - https://docs.docker.com/engine/security/rootless/ There's even an install script for it: curl -fsSL https://get.docker.com/rootless | sh This has been there for a while. The root install option should be removed.

I'll accept that it shouldn't be default, but just because your web app runs in rootless docker does not mean that root docker has no place. There are several limitations: https://docs.docker.com/engine/security/rootless/troubleshoo...
Post reply on HN