Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

When was the famous "sudo warning" introduced? (2019)

retrocomputing.stackexchange.com

Post reply on HN
Print view View original

61–70 of 180 posts

Re: When was the famous "sudo warning" introduced? (2019)

#61

Post by goodpoint »

cedws wrote: post #34
weitendorf wrote: post #20

Earlier quoted context omitted.

I think this is underrated as a design flaw for how Linux tends to be used in 2024. At its most benign it's an anachronism and potential source of complexity, as its worst it's a major source of security vulnerabilities and unintended behavior (eg linux multitenancy was designed for two people in the same lab sharing a server, not for running completely untrusted workloads at huge scale, so it doesn't really implemen…

I agree that multi-user should go away for modern server workloads, however, users are used as a blast door. Mainly because Linux's security model is lacking. systemd for example commonly runs services under separate users to make it more difficult for a compromised application to elevate privileges. Android does something similar AFAIK. Users should have never became a security boundary to isolate applications, but…

> Linux's security model is lacking

It's not lacking at all. The root + users model is common not only across OSes but also all sort of physical devices.

Re: When was the famous "sudo warning" introduced? (2019)

#62

Post by bowsamic »

VeninVidiaVicii wrote: post #38
Daneel_ wrote: post #27

Earlier quoted context omitted.

Interesting comment actually. I would have assumed that the vast majority of people using Linux are still sysadmins in small and large companies - this is certainly my personal experience. I wonder how many home users there are versus systems managed by sysadmins. I would still think there’s more in the corporate world, while I would think the opposite for Windows.

I hate to sound elitist, but I straight-up can’t do any serious coding on anything other than a Linux box. Most of what I do these days is statistical inference on bacterial genomes in the context of antibiotic treatment. I understand that I’m not the average user, but then again, nobody really is.

That sounds like scientific coding, not serious coding

Re: When was the famous "sudo warning" introduced? (2019)

#63

Post by RulerOf »

godelski wrote: post #44
3eb7988a1663 wrote: post #30

Earlier quoted context omitted.

Actually, I have been wondering if using a Linux system as multi-user could be a boon in security. As single user, each and every process has full and complete control of $HOME. Instead, I would prefer all applications were sandboxed to their own little respective areas with minimal access to data unless explicitly authorized. Without going full QubeOS, get some amount of application separation so my photo utility do…

> Instead, I would prefer all applications were sandboxed to their own little respective areas with minimal access to data unless explicitly authorized. You’ll be interested to learn about systemd-nspawn. You can sandbox stuff with it really easily. It is like chroot so not really resource intensive, lighter than a container. I think a pretty useful thing you can do is boot ephemeral instances. So whatever someone do…

I read a good chunk of that wiki link, but didn't really come away with an understanding of how it differs from just using Docker for sandboxing an app.

Did you have any insight there you might share?

Re: When was the famous "sudo warning" introduced? (2019)

#64

Post by xyse53 »

nonrandomstring wrote: post #2

Not sure what the connection with Colorado U might be but I read this [0] a couple of days ago. Steve Bellovin had a few connections with formative Unix security and worked/studied with Fred Brooks and Ken Thompson, In the (linked) talk he says that Brooks taught him "about responsibility. Someone with the root password has not just the right but the responsibility to use it." This caught my attention because I'm wri…

https://en.m.wikipedia.org/wiki/Evi_Nemeth was part of the early development of sudo. I did a double take years ago running "The Woz Lab" at CU Boulder, reading the sudoers man page and seeing the 128.138 address space in the examples that I was managing subnets of.

Re: When was the famous "sudo warning" introduced? (2019)

#65

Post by sigmoid10 »

horeszko wrote: post #28
ggm wrote: post #16

Back in the 90s we were told ostentatiously to include "unauthorised access is not permitted" to the login prompt. Why? Because the login prompt said "please login:" and this was being read by some bush lawyer as an invitation to connect, and therefore would impede a case if we had a hacker login with a stolen password. I think it was founded on urban myth, but I assure you this is what we were told to do: add text t…

My networking instructor still suggests this today when configuring the login for routers and switches

Perhaps it is useful for countries that still don't have any real computer crime laws? Because in most western nations it would be totally pointless.

Re: When was the famous "sudo warning" introduced? (2019)

#67

Post by guappa »

3eb7988a1663 wrote: post #30
weitendorf wrote: post #20

Earlier quoted context omitted.

I think this is underrated as a design flaw for how Linux tends to be used in 2024. At its most benign it's an anachronism and potential source of complexity, as its worst it's a major source of security vulnerabilities and unintended behavior (eg linux multitenancy was designed for two people in the same lab sharing a server, not for running completely untrusted workloads at huge scale, so it doesn't really implemen…

Actually, I have been wondering if using a Linux system as multi-user could be a boon in security. As single user, each and every process has full and complete control of $HOME. Instead, I would prefer all applications were sandboxed to their own little respective areas with minimal access to data unless explicitly authorized. Without going full QubeOS, get some amount of application separation so my photo utility do…

If only firejail existed to do exactly that… it could come packaged in most distributions with sensible profiles that are easy to enable.

It might even have a github project that people might reach, something like this https://github.com/netblue30/firejail

Re: When was the famous "sudo warning" introduced? (2019)

#68

Post by guappa »

RulerOf wrote: post #63
godelski wrote: post #44

Earlier quoted context omitted.

> Instead, I would prefer all applications were sandboxed to their own little respective areas with minimal access to data unless explicitly authorized. You’ll be interested to learn about systemd-nspawn. You can sandbox stuff with it really easily. It is like chroot so not really resource intensive, lighter than a container. I think a pretty useful thing you can do is boot ephemeral instances. So whatever someone do…

I read a good chunk of that wiki link, but didn't really come away with an understanding of how it differs from just using Docker for sandboxing an app. Did you have any insight there you might share?

It's basically the same as docker but it doesn't use proprietary cloud stuff such as dockerhub.

Also occupies like 100kb instead of 40mb because it's C and not go.

Re: When was the famous "sudo warning" introduced? (2019)

#69

Post by sp8 »

ggm wrote: post #16

Back in the 90s we were told ostentatiously to include "unauthorised access is not permitted" to the login prompt. Why? Because the login prompt said "please login:" and this was being read by some bush lawyer as an invitation to connect, and therefore would impede a case if we had a hacker login with a stolen password. I think it was founded on urban myth, but I assure you this is what we were told to do: add text t…

I did a similar thing once (off my own back - I was young and naive) on a dead simple web app I wrote. I put a footer that said something like "all access is logged, unauthorised access will be investigated" with the current IP address to try to demonstrate that I had the data to do it. I didn't. And nothing of the sort was logged or investigated. I just hoped it would put people off!

Re: When was the famous "sudo warning" introduced? (2019)

#70

Post by smidgeon »

My first experience of Unix was on a dumb terminal on a university AIX (?) machine, I had heard that "man" was how you got to the documentation, so duly typed "man", the resulting

   Apropos what?
made me laugh out loud, and the others in the room gave me a funny look.
Post reply on HN