Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why GNU su does not support the `wheel' group (2002)

ftp.gnu.org

Post reply on HN
Print view View original

21–30 of 150 posts

Re: Why GNU su does not support the `wheel' group (2002)

#21

Post by cookiengineer »

jml7c5 wrote: post #16
nine_k wrote: post #3

It shows how old is that, and how things changed. Back in the day, it was about multiple OS users on one big machine, maintained by a university or a corporation. Now I'm the only human user of my several machines. I have more than one interactive user account on some of them. I put these accounts to the wheel group, to avoid ever using a root password. (Void Linux has it pre-configured in /etc/sudoers.)

Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case. Basically https://xkcd.com/1200/

The irony behind it is that one could argue that we are using UNIX wrong, because technically each program should run as its own user with its own groups. Which is what apparmor and firejail/sandboxes kind of want to embrace but in practice people just care too less.

Re: Why GNU su does not support the `wheel' group (2002)

#22

Post by not2b »

cookiengineer wrote: post #21
jml7c5 wrote: post #16

Earlier quoted context omitted.

Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case. Basically https://xkcd.com/1200/

The irony behind it is that one could argue that we are using UNIX wrong, because technically each program should run as its own user with its own groups. Which is what apparmor and firejail/sandboxes kind of want to embrace but in practice people just care too less.

That's what Android does: each app runs as a different user.

Re: Why GNU su does not support the `wheel' group (2002)

#23

Post by rvnx »

voz_ wrote: post #4
bell-cot wrote: post #2

Reaction: Mr. Stallman's idyllic worldview does not seem to admit that someone may actually own the computer system in question, or otherwise have legal rights to set limits on who uses the system, when, and for what purposes. And what was allowed by the social norms of the tiny 1980's *nix computing world, or what you can get away with when you're as famous as Mr. Stallman...those may not translate well to other con…

I can’t stand his holier than thou writing. No amount of brilliance or clever code makes someone less of an asshole.

Some people are so dazzled by singing and dancing skills, that they consider their singer to be a hero and a nice guy.

Similarly, Stallman's coding expertise can sometimes overshadow any potential shortcomings in the non-IT subjects.

Re: Why GNU su does not support the `wheel' group (2002)

#24

Post by bee_rider »

fsflover wrote: post #20
jml7c5 wrote: post #16

Earlier quoted context omitted.

Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case. Basically https://xkcd.com/1200/

The solution is to use https://qubes-os.org . My daily driver, can't recommend it enough.

Qubes is one of those things that, I think, everyone knows is better but it seems just far enough away to not want to change.

How big of a change is it? If you are, say, a Linux terminal native can you just pick up and run?

Re: Why GNU su does not support the `wheel' group (2002)

#26

Post by _lvbh »

fsflover wrote: post #20
jml7c5 wrote: post #16

Earlier quoted context omitted.

Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case. Basically https://xkcd.com/1200/

The solution is to use https://qubes-os.org . My daily driver, can't recommend it enough.

I tried it for a week. Feels like overkill so I instead went for Fedora Silverblue & have everything in isolated podman containers.

Of course, I’m not being targeted by the state so my threat model is much lower.

Re: Why GNU su does not support the `wheel' group (2002)

#27

Post by ye-olde-sysrq »

aquova wrote: post #15
ye-olde-sysrq wrote: post #8

Earlier quoted context omitted.

> If you are used to supporting the bosses and sysadmins in whatever they do, you might find this idea strange at first. Should this be that far-fetched though? That employees might not be simple thralls of the capitalist, whose agency extends only as far as his master permits? It reminds me of something I'd read that one of the reasons modern capitalism is so borked is because the founding fathers weren't conceiving…

> It reminds me of something I'd read that one of the reasons modern capitalism is so borked is because the founding fathers weren't conceiving of things like "Amazon" existing, where one entity employs a staggeringly large number of employees. Or that a small number of companies would employ such a large percentage of workers. I'm not quite sure I buy that argument. They lived in the time of the East India Company,…

Yeah, there's definitely counterexamples. I thought of East India too. I really wonder what operating a huge company like that looked like in an era where the fastest way to transport messages was to have fresh horses pre-positioned every X miles and have someone gallop your message non-stop. I assume it was very different from Amazon employees peeing in bottles to avoid getting dinged for metrics.

Re: Why GNU su does not support the `wheel' group (2002)

#28

Post by nisegami »

bell-cot wrote: post #2

Reaction: Mr. Stallman's idyllic worldview does not seem to admit that someone may actually own the computer system in question, or otherwise have legal rights to set limits on who uses the system, when, and for what purposes. And what was allowed by the social norms of the tiny 1980's *nix computing world, or what you can get away with when you're as famous as Mr. Stallman...those may not translate well to other con…

Legal rights are not moral rights.

Re: Why GNU su does not support the `wheel' group (2002)

#29

Post by fsflover »

bee_rider wrote: post #24
fsflover wrote: post #20

Earlier quoted context omitted.

The solution is to use https://qubes-os.org . My daily driver, can't recommend it enough.

Qubes is one of those things that, I think, everyone knows is better but it seems just far enough away to not want to change. How big of a change is it? If you are, say, a Linux terminal native can you just pick up and run?

All software runs in Linux VMs, so it is practically the same as running several Linux operating systems with a nice UI.

Re: Why GNU su does not support the `wheel' group (2002)

#30

Post by nine_k »

bee_rider wrote: post #24
fsflover wrote: post #20

Earlier quoted context omitted.

The solution is to use https://qubes-os.org . My daily driver, can't recommend it enough.

Qubes is one of those things that, I think, everyone knows is better but it seems just far enough away to not want to change. How big of a change is it? If you are, say, a Linux terminal native can you just pick up and run?

You would feel at home more as a cloud native, because everything runs in its own VM, spun up and down on demand.
Post reply on HN