41–50 of 150 posts
Earlier quoted context omitted.
The solution is to use https://qubes-os.org . My daily driver, can't recommend it enough.
It's one of those things I keep thinking I'd like to try but actually implementing it seems like it'd be a huge pain in the posterior at first. Am I wrong about that?
I read the page and don't understand what's going on. What is special about the 'wheel' group and what is su even "checking" in the first place? Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check? And I also don't get: if someone has the root password, can't they change what groups they're a member of?
What is special about the 'wheel' group and what is su even "checking" in the first place? Users who aren't in the wheel group aren't supposed to be able to become root, even if they have the password. Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check? Someone who steals the root password (say, by looking over the sysadmin's shoulder) would be able…
Or is the wheel group not really about being able to sudo?
Reaction: Mr. Stallman's idyllic worldview does not seem to admit that someone may actually own the computer system in question, or otherwise have legal rights to set limits on who uses the system, when, and for what purposes. And what was allowed by the social norms of the tiny 1980's *nix computing world, or what you can get away with when you're as famous as Mr. Stallman...those may not translate well to other con…
Legal rights are not moral rights.
A different reason why it's good that it doesn't support wheel: - it makes it smaller, less code which can go wrong - su isn't limited to "set user root" but wheel tends to be - it avoids having to handle many kind of subtle problems with group based permission handling in linux It's just not a bad idea to have a very minimalist program like su and then delegate all more complicated "acting as user" permission handli…
Have you seen the number of flags every command has? ls has almost the entire alphabet taken.
Earlier quoted context omitted.
legal rights? "I'm on the side of the masses, not that of the rulers." He is pretty clear...
Reaction: How does that ideal play out, when a few kiddies start running fork bombs on a *nix system that Mr. Stallman wants to use?
rms famously refused to secure his account @gnu.ai.mit.edu, and so the machine basically became an open shell server for every hacker in the world, ca. 1992.
Lots of hijinks ensued, and it was usually not possible to do anything useful in that account, since it was usually broken or pwned in remarkable ways. But they were wild, fun times.
It shows how old is that, and how things changed. Back in the day, it was about multiple OS users on one big machine, maintained by a university or a corporation. Now I'm the only human user of my several machines. I have more than one interactive user account on some of them. I put these accounts to the wheel group, to avoid ever using a root password. (Void Linux has it pre-configured in /etc/sudoers.)
Yes, Unix was designed to protect users from each other but the modern need is to protect applications/invocations from each other. It is unfortunate that Unix wasn't really designed for the modern use case. Basically https://xkcd.com/1200/
Reaction: Mr. Stallman's idyllic worldview does not seem to admit that someone may actually own the computer system in question, or otherwise have legal rights to set limits on who uses the system, when, and for what purposes. And what was allowed by the social norms of the tiny 1980's *nix computing world, or what you can get away with when you're as famous as Mr. Stallman...those may not translate well to other con…
One of my favorites is extensive rights management. Especially on CMS. More ofte than not it is part of a buying decision, but used Stallman style soon after.
The observation that these credentials leak is correct. Or that you grow permissions over time for no other reason than doing work. A wheel group would today quickly attract users, too.
So let it be. The latest iteration is "basically let everyone, but audited and short term only". I find that very close to Stallmanns idea, for very different reasons.
Earlier quoted context omitted.
What is special about the 'wheel' group and what is su even "checking" in the first place? Users who aren't in the wheel group aren't supposed to be able to become root, even if they have the password. Isn't it just supposed to switch user? And what are the implications of not-checking whatever it was supposed to check? Someone who steals the root password (say, by looking over the sysadmin's shoulder) would be able…
Native question: if you can `sudo`, can't you just `sudo bash`? What can you do with `su` that you couldn't do with `sudo bash`? Or is the wheel group not really about being able to sudo?