Printable View
The XMMS2 help says this for one it's command line options:
One of the first things I learned about Linux, was, to not run programs as root. And I've seen this all over (this one is a little more extreme, though). And until I saw this, I've assumed that it was for security concerns.Quote:
--yes-run-as-root Give me enough rope to shoot myself in the foot
Why is so bad to run programs, including trusted programs, as root?
Because if you are running as root you can kill your system. That is part of the UNIX security model; if you cannot run your app as a mere mortal you have to ask yourself as to why you need to do this. If you follow the rules and just run as a user the worst you can do is screw up your home directory. Running as root (God-mode) will allow you to kill anything on your system, whether you meant to or not.....
It is for security concerns.
trusted programs can have bugs that can wipe out your harddrive, too.Quote:
trusted programs
Untrusted programs should never be run, not even as a user. At least not outside a sandbox.
Even trusted programs may contain bugs, or give access to other untrustworthy programs to run as root.Quote:
Originally Posted by Yarin
Especially on an operating system as Linux where trusted programs are open-source and easy to recompile with malign code.
The problem with running as root is that malicious code can then spy on other users. Data destruction is an overblown fear -- the data owned by root is easily replaced (just reinstall) and the data owned by the users is also protected (you ARE backing up regularly, right?)
The possibility of malicious code silently tracking everything you are doing is much greater than damage done to your system.
Rolls eyes.Quote:
Originally Posted by Mario F.
Yes but common sense dictates that if you have the source for the programs you can check them yourself; with closed source you are in a 100% trust or not-trust situation. I prefer the former. At the end of the day the choice it up to each individual user.
Do I want to check the source for everything I install as root? No of course not. However this becomes a fundamental question of "don't want to" versus "can't". Besides *I* don't have to check each individual piece of software as there are a lot of eyeballs going over the source. If you stick with Debian security/maturity model, staying with 'stable' will guarantee Mario's hallucinations to be nothing but a dream...
Security through obscurity is not and never will be the best form of system security. I am not here to expound one OS/language over another, even if I personally think so. Lies cannot go unchallenged, regardless of how smart or ignorant the speaker is...
This reminds me of Ken Thompson's Reflections on Trusting Trust... but wait, I cannot even trust code that I totally created myself :o
I think that many people are in a nearly 100% trust or not-trust situation either way. They may trust the closed source software because they paid for it, or they may trust the open source software because they reason that...Quote:
Originally Posted by jeffcobb
Quote:
Originally Posted by jeffcobb
LOL. What the heck.Quote:
Especially on an operating system as Linux where trusted programs are open-source and easy to recompile with malign code.
How about you run my version of cmd.exe? I don't even need to "recompile with malign code". I can just compile malign code.
It's all about where you got it from. Open source or not.
At first I thought this root stuff can't be that bad. Then I noticed people getting kicked out of some linux IRC channels by bots for logging in as root. :-p
Running any internet-facing application as root when it doesn't need the privileges (and IRC sure as hell doesn't) is just insanity. You never know what bugs lurk in there that allow a hostile remote system to make your program execute code.
Basically, any internet-facing application is a potential remote access vulnerability.
Any application running as root is a potential privilege escalation vulnerability.
If those two groups stay separated, the attacker needs two exploits to gain remote root access to your machine. But if you have a program that faces the internet and runs as root, you only need one exploit.
Laserlight pretty much answered your comments. But here's two different and equally dangerous scenarios for you:Quote:
Originally Posted by jeffcobb
(assuming you like to run as root)
- Get away from your laptop for 5 minutes and have a disgruntled workmate access it with a replacement of your favorite command line program.
- Download the latest version of your favorite program which does unfortunately include a bug that corrupts your repository.
I trust my mother for a great dinner, but I couldn't trust Mozilla, Debian, or even the Linux Kernel for a clean and hassle free piece of software any more than I would Microsoft. As noted before we shouldn't even trust our own code to do what we expect it to.
The point of fact is that Linux offers a security model for a reason. One quickly learns from advise everywhere (or on the worst case, from experience) the dangers of ignoring this model. Damage, accidentally or purposely, become a possibility.
The hallucination is believing:
a) everyone checks the source code prior to install
b) programs cannot come with damaging bugs
c) the open source model is immune to malign code or intentions
a) can only be a joke. b) is a simple lie as we well know.
C) is a lot more interesting and worth a debate of its own. Believing the open source model, even the established projects are immune to malign intentions is really a bad, bad, move. One individual can insert malign code into the program and rely on the project often too-complex-for-its-own-good or completely-non-existing code revision methods in order to get the code into the released state. If there is one thing that oopsies like the Android Bug teach us, is that the open source model can be a victim of bad quality control and completely insane logic as any other type of code. And to add to that, there's not even on many cases a clear develop-test-release cycle on many open source projects who offer nightly-builds or simply dump their code to the public on a schedule basis.
As a decade long linux user here's my take:
New users should probably obey the recommendation, since you can do accidentally destructive stuff. Once upon a time, I busted glibc. That will ruin everything.
On the other hand, it's hard to see how you will learn to be responsible unless you take responsibility. Like, it would have been impossible for me to ruin glibc as a normal user, but it did not happen just because I was root.
What's implied is that you will never be using the system as root much, or that no one does. That's a lie.
I never use anything but root, and that's always been true. Very occasionally I will log in as a normal user in order to test something that way during development. Also occasionally to sandbox untrusted code if glancing thru it makes me suspicious. Otherwise never. I cannot stand having to use sudo and enter a password to issue commands I consider normal. Other than that glibc thing years and years ago, this has never EVEN ONCE caused me ANY PROBLEMS at all. (I also don't use a reversible delete, aka trashcan, and the number of files I have accidently erased and gone whoops! would be <1 per year.)
So, Yarin, I think you are a reasonably smart guy who is also a programmer and can forget your "yarin" account. Just use root. All those warnings are just to let people know that they can do stupid things that way -- but it will not happen because, eg, XMMS is psychotic or something. Totally not true. Like I said, years and years, I have never seen such a problem.
And open source stuff is BY DEFINITION much less likely to contain malicious code than closed source simply because you will get caught -- no ifs, ands, or buts -- if you put something malicious into open source code. So, in fact, "the open source model is immune to malign code or intentions" in large measure. Bugs are a different issue, but it would have to be a very weird bug to lead to anything beyond just that app failing, etc.
I second MK27. I've been using Linux since 1994 and always as root. I did, however, attempt to create "normal" users way back in the day, but I too was having too much problems with doing the common things -- like mount (which, back in the day was ONLY a manual thing from the COMMAND LINE) -- so I changed all my users to be root accounts.
I even have the MOST ILLITERATE computer user in the world running an embedded system I built back in Feb of 1994 (using Linux). To date, the only data corruptions I have _EVER_ had were 2 times -- once my mistake when I did a rm -r * from / thinking I was in another directory, but you cannot fix stupid -- the second was a kernel error in the Reiserfs module -- logging in as root or no would not have made a difference.
Use root if you know enough about Linux -- don't if you don't.
*cackle*
Too funny.
So this is the final answer it seems. "Nothing bad ever happened to me, so go ahead and do it, Yeehaa!"
In your case I recommend staying at home instead Mario. Just to be safe :PQuote:
Originally Posted by Mario F.
It all comes down to this:
Principle of least privilege - Wikipedia, the free encyclopedia
Your application doesn't need root privileges, so it should not have root privileges.
There are two distinct principles at work. 1) You can do ANYTHING as root, including accidently destroy your system. 2) A malicious process run as root can also do anything.Quote:
Originally Posted by nvoigt
The caveat to new users is because of #1.
WRT to #2, don't run malicious processes! Or,
sudo -u nobody someapp
It may not need root privileges, but I do. (The only problem with this one is GUI's must run as the same user as the X.)
In essence, it's quite irrelevant if I know my system well enough or not. To that I would also have to add a few other variables, like where I get my software from, under which conditions I'm running my computer, even if I'm feeling particularly drowsy from so much work, or even distracted by something else.
To grab the whole issue of security and pretend to put it in a box called "Experience" is quite extraordinary after so many years of common computer usage. It just feels like some people still don't want to learn the lesson... or pretend there is no lesson to be learned. One can play hardcore all they want, but the simple matter of fact is that running Linux as root is disregarding security and call it a bluff. All simply because one's lazy and thinks "sudo is too much work". Or because they think that impresses the chics.
But being that the case (security in Linux being a bluff). Necessarily These guys would be full of it and Bugs in the kernel or in other code that can be the target of exploits never existed.
Forgetting for a moment that if Yarin asked it already means he needs to use Linux as a normal user and assuming for a moment that Yarin would be a top Linux user and kernel coder with over 10 years of experience, there's also one fundamental aspect he would be forgetting when he chose to run his linux machine as root all the time:
That security is about prevention, not resolution. Your security can fail even before any attempt against it is made or any damage is done. So, it is quite alright whatever you decide to do with your machine. But don't hide your lazyness or whatever other motivations you may have to run your system as root all the time behind a false veil of security. You are ignoring security. And that simply means your whole experience is resumed to "Nothing happened so far. I'm ok".
I guess the author of that XMMS2 line just shares Mario's sentiments.
Quote:
Just use root.
I'm not paranoid, but that can't be good advice.Quote:
I second MK27. I've been using Linux since 1994 and always as root.
I'll just stick with POLA. :)
Ah, messing up glibc (assuming you know that's what you broke) is an easy fix. I can image much worse.Quote:
Once upon a time, I busted glibc. That will ruin everything.
There are plenty of programs that you can, and need to, run as root that have the ability, and are often designed specifically, to modify your system/repository. I think a fear of bugs is a bad reason not to run as root.Quote:
Download the latest version of your favorite program which does unfortunately include a bug that corrupts your repository.
But wow though, that Android bug is scary - and even more so funny. :D
Thanks for the replies.
You can configure sudo to not ask for a password. Even that is more secure than running as root all the time.
Erm... but that should be your top reason. And another important one, if you are into using that stuff, is fear of Web Applications and Public Networks or otherwise untrusted services.Quote:
Originally Posted by Yarin
While I mentioned it, I understand some would like to debate the importance of securing against malicious code creeping out from Open Source programs. I understand they may want to debate it, but don't see how any debate could ever exist. But whatever.
Instead do not dismiss software bugs as an issue that cannot affect you in terms of security.
I guess what is the most funny thing to me is that the avid hater of Linux would say not to use root.
As in, I hate Linux so much that I KNOW FOR A FACT that using root is VERY DANGEROUS.
You are obviously correct in your assessment of root@linxbox Mario. How much Linux experience to you have again?
Quote:
Originally Posted by Mario F.
Yes, it is a contentious issue, and some of the people on one side like to be patronizing and imply there are fearsome monsters lurking under the bed there when there are not. You are free to do what you like (I should not really have said "just use root" :p), just to let you know: it is not unusual to run normally as root, and it will not create any strange problems. If you don't want to, you don't have to...Quote:
Originally Posted by Yarin
I wasn't into programming, beyond shell scripting, at the time. I actually didn't know exactly what had gone wrong. Later it occurred to me it was because I tried to rebuild the C library in place (never mind why), and did not understand that EVERYTHING links to it. I had a rescue disk to get my data off the partition, but I had to re-install and start over a years worth of tinkering.Quote:
Ah, messing up glibc (assuming you know that's what you broke) is an easy fix. I can image much worse.
The funny part -- as in funny strange, not really ha ha -- was that it occurred in Aug 2001. When I had to pick a host name for the system, I could not be bothered to come up with anything (I used to use like "red.flower.poem" and stuff) but didn't want the default "localhost" so I used the date of the re-install, 9.01.01. So for a long time after that my bootup message was ""Welcome to 9.01.01". And I still wasn't sure what had gone wrong, just that it went very wrong and couldn't be fixed. Eerie. Still gives me the shivers, actually.
I was expecting this type of argumentation. Not just from you, kennedy. I'm honestly surprised. So help me here. I lost touch with these things. What am I supposed to call you now? Linux lover? And where does it get to the time we start with the insults. That usually is the most exciting part.Quote:
Originally Posted by Kennedy
FYI, I don't hate Linux. Quite on the contrary. You just don't frequent these forums frequently enough to know that, it seems. And help me here too... because I'm starting to doubt your own judgment... exactly where does User Experience fits with defending or arguing against the decision to run as root all the time? I'm dying to know.
Well first the makers of XMMS are trying hard to hit you with a cluebat with this:
That said, there are three primary dangers of using root fulltime (unless you are ready to throw your box away and reburn at a moments notice):Quote:
--yes-run-as-root Give me enough rope to shoot myself in the foot
1. Malicious code: Back doors, etc. This was tried recently, caught fast (< 24 hours and fixed)
2. Buggy code: This is one of the key benefits of the Debian maturity model. I can find exact dates on this for the interested but it goes like something like this:
There are three primary classes of code in the Debian repository: stable, unstable and testing. If a package is in the stable branch, that means there have been no bugs or malicious code found in it in over 18 months. Old? Yes but freaking rock-solid. Unstable means no show-stoppers have been logged in something like 12 months; a package here may have seen some cosmetic changes but fundamentally the package is sound. Testing is just what it sound like: It hasn't eaten anyones cat recently but beyond that, not promises are given.
With this setup you can pick your poison. For Internet-facing boxen, I stick with stable (mail and web for one thing). For home servers I do unstable to get newer releases and for dev laptops that can go south at any time...well still stick with unstable.
The thing is this limits by a great deal how much code auditing you have to or need to do. If you run everything as root, the simple truth is you are one password away from being owned.
Reason 3: Your own stupidity: in which case you have yourself to blame and it matters not which OS you run you are an accident waiting to happen. Some folks are not meant to run anything more complex than an iPod...it's just that simple. By the fact that this is a coders board I would put few if any in that group.
We here at Casa Cobb do the sudo route so that all rootly-things are at least logged, run rktoolkit to watch for things that seem fishy and always use our own accounts/PW. We do not allow remote root login access so anyone trying to get it would need to know at least two passwords to get past the front-door.
No system is perfect; in our case after running Windows for <deity> knows how long in a Fix or Repair Daily mode, moving to Linux was hard at first (wife is still learning but doing excellent) but well worth the investment in time. Is it for everyone? Absolutely Not. But it works for us and works damned well. No malware, no virii, just turn it on an go.
Yes, please do so.Quote:
Originally Posted by Mario F.
I have no tact, so, please explain how what I said was insulting.Quote:
Originally Posted by Mario f.
Okay, however, you have posted 3 times in the Linux forum:Quote:
Originally Posted by Mario F.
And in other places you have been "Not so Linux friendly". You should understand why one would think that with statements likeQuote:
Originally Posted by Search Results
which seems to me to be a naysayer's statement against Open Source coding, specifically GNU/Linux. -- perhaps, however, I misjudged such a statement.Quote:
Originally Posted by Mario F.
Show me a software system (embedded, desktop, server, etc) that has existed, WITH USERS, that has had few or no problems. Probably very few. But why is this? Are you going to 100% assure me that these systems have had breakdowns _BECAUSE_ these were run as root? Are you going to tell me, again with 100% surety, that these systems/applications would have had X% greater failures if had been run as root? Is it possible to use a system as root/administrator without screwing it up? Is it possible to screw up a system running the system as an unprivileged user? In every case of the unprivileged user screwing up a machine how many of these are due to the fact that they sudo (or runas) the software that chunks the machine?Quote:
Originally Posted by Mario F.
My answers to these questions are as follows:
breakdowns becase these were run as root: No.
greater failures if had been run as root: No
root without screwing it up: Yes
running the system as an unprivileged user: YES
sudo the software that chunks the machine: NO.
I have numerous cases of my parents chunking their machine (and I don't give them admin rights -- which they complain about often) due to their incredible ability to really hose up the software, routinely. Even without administrator privileges they still find ways to complete crap up there machine such that I spend hours fixing their install.
Running as root is safe if you are willing to accept the risk. If you, however, go out surfing for porn or other crap (where malicious code is known to exist) as super user, you can expect your machine to go down in flames. If you are only using your computer for specific purposes that are not so risky, you'll be fine.
Writing code for your machine, in my opinion, is quite safe as root.
Surfing for answers to your coding questions as root, in my opinion, is about 75% safe.
Frequenting this web site hourly as root, in my opinion, is very safe.
Looking for peer-to-peer programs to illegally take others programs/music/videos/pictures/etc as root -- probably not a good idea.
Looking for those same type things legally: as before stated you'll get all sorts of nasties on your box anyway -- especially as super user.
So, if you as a developer, ask me: Is it safe to run all my applications as root? I will believe you to be asking me from the first group of users: Yes. I would not even consider that a developer (with the full knowledge of all the evils that are out there) would expect that it would be a good idea to be in group two, thus I would not answer for that group unless specifically asked.
Whoa...one thing to keep in mind folks is that everyone has to pick their own comfort zone. Want to run as root with all services exposed? Be my guest. People smarter than anyone else here thought the idea of root or admin priv. separation was a good thing. If you have users using sudo to muck up their boxes, the answer is blindingly simple: remove them from the sudoers file. Remember root is meant to be run by an admin or someone with their act together and has only been made available to the mere mortal when joe-sixpack wanted to give it a spin. At the end of the day, it is still a multiuser system with many layers of trust and access in place. If you don't use them you are as lost as the Windows user that just plugs his or her box straight into the cable modem (DSL, etc) with no firewall/protection. If you think that the world is NOT trying to get into your box (rootly or not) just open an ssh port and log it for a month. You will find zombies trying coordinated attacks at password guessing called the "slow hack" where the zombies will only try once every N minutes, usually not enough to trigger an alarm to the admin. They are out there, make no mistake, particularly if you own a static IP....
Pretty much that, yes.
But a few notes in answer to Kennedy.
Indeed you have. You see, I don't take a stance in life in which I defend to death anything I believe in. All things (or at least all things I can think of at the moment) have their issues along with their advantages. But mostly, you - or anyone else for that matter -- can ever convince me that we found perfection in Open Source. Open Source is ran by humans and equally susceptible to their whims. It's obvious that a part of the strategy is spent checking contributed code to make sure nothing bad comes out of it. So, even open source developers are aware of the risk. Be it the potential for a bug or a new submission with suspicious code.Quote:
which seems to me to be a naysayer's statement against Open Source coding, specifically GNU/Linux. -- perhaps, however, I misjudged such a statement.
So? I like Windows too and you will hardly see me post on the windows forum. Try something else. I don't feel I need to ask or answer anything on that forum. All I need to learn from Linux, I learn somewhere else.Quote:
Okay, however, you have posted 3 times in the Linux forum
Anyway, from later to earliest:
- I've finally been using Linux full-time for a little over 1 year. I like it and I like it a lot.
- I've been in and out of Linux pretty much around your time too. My first distro was SUSE back in 95 or 96, I believe. I used it until June 98. Know it well because it coincided with a job that would change my life but would also force me to concentrate on Windows.
- I used Unix back in University pretty much everyday for 3 years.
Contrary to you, however I never found sudo to get in my way. Go figure.
...
My true experience with Linux is thus limited. Currently I'm using Arch and it's been a decision of mine to become a regular user a little over an year ago and let me tell you:
- It's an operating system. Not my mother. As such if I have something bad to publicly say about it, I will. And I do.
- I do enjoy it. As much as it annoys me the fact the only problem with Linux is not the operating system, but the people that use it and can't think for themselves.
- I use apache, mysql, svn, I program in it, I install, delete and reinstall libraries, programs, and whatever. I save porn. I watch movies, I move stuff, I repartion, I have it networked on my home, I experiment a lot as part of my apprenticeship, I compile the kernel, I experiment changing the code for Gnome, etc etc etc...
and never, not even once, not even in my dreams did I ever felt sudo was getting in my way.
So then we come to the point of the arguments for both sides: (to reiterate what -- it think ??Jeff?? -- said) it is a matter of choice and what you are comfortable with. Either choice you make, however, does not make you foolish or asking for trouble. If you know the risks and are okay with those risks, then it is great for you.Quote:
Originally Posted by Mario F.
In your case, if you are okay with sudo'ing everything, fine. I don't like the hassle and therefore don't. In the end, the only way to know if either of us is right or wrong is if the other's machine takes a flaming nose dive. Then, and only then, would the other be able to say "See, I told you so."
I'm not so sure that I'm a firm believer in the idea that using Linux as root is "asking for trouble".
@JeffCobb: I know at least one person on the SELinux team -- I _AM_ smarter than him.
But you have to be if you hope to ever get a job as a security consultant. No one will take you seriously otherwise.Quote:
Originally Posted by Kennedy
I think if you are working on a box that is shared (or accessed) by several users, then you should only run as root when absolutely necessary. On the other hand, if this is your home machine, then do whatever your feel comfortable with.Quote:
Originally Posted by Mario F.
Personally, I have no problem using sudo.
Geez will there be a torrent of locusts or something coming next? Mario and I finally found something to agree up ^__^
As for Kennedy being smarted than folks on the SELinux team (and I was more referring to the original OS designers) I guess we will have to take you word on that one...
Btw, it's the second time you make that quote about Linus Torvalds, Kennedy. I don't think you ever understood the context. Let me explain it to you in few words so you drop it for good:
I don't need to know what Linus Torvalds thinks of spaces vs tabs. I don't care. Neither should you or anyone else, when it is common knowledge one or another are either a personal choice or an imposition at your working place. So, for all purposes as far as answering the question of what is best, tabs or spaces, Linus is a nobody just like anyone else.
In fact, Linus is a nobody on many other things he wrote or opinionated about before. But that's cool. So am I, you and everyone else. The issue is not the debate. But the fact some people actually think that quoting Linus Torvalds on tabs vs. spaces is going to actually give some strength to one side of the fence.
Is it clear now?
I don't run linux/unix, but in Windows XP, I use the administrator account only for installing software and changing system settings.
For everything else ie. work, internet, games, I use a limited user account, which can't install any software, or change fundamental settings, other than their own basic settings like screensaver.
I've never had a virus, trojan, malware.
Crystal. But, I'll still poke at you about it. It seems to get you spinning in a hurry (this is the second time that you have corrected me on it -- the first you asked me if sarcasm is lost on me -- apparently so ;)).Quote:
Originally Posted by Mario F.
Ah! You got me there :p
Fair enough.
I don't have any problems surfing porn* either.Quote:
Originally Posted by Kennedy
As for Mario F., I really like him or I wouldn't argue so much ;) but he does come across as a "linux hater". His assertions that the whole thing is somehow untrustworthy again fits in with those patronizing assertions that lean heavily on the <i>implication</i> that it is in reality "experimental" or a "fringe operation".
This kind of ignores the FACT that MOST of the INTERNET is run on LINUX.
Maybe "most of the internet" still is experimental and fringe, but I continue to give it credits for effort ;)
I do accept that running as root opens up some security issues. But, as with many things, I count myself in a minority here and so can also count on these facts
1) that most users DON'T run that way and so board idiots will not spontaneously target them in their board idiotic way, they will be out trying to sink MS ships.
2) I have like 3 usb keys I cycle thru for backups, plus CDs, and remote storage, all of that near daily with things that are important to me. Also, I have a FLOPPY DISK drive and have never written code longer than 1.44 mb source, and could care less about anything that isn't code.
I don't run SELinux on my primary install. What's more -- I don't have ANY secondary users and sudo is NOT EVEN INSTALLED. I do have them on the more normal installs I use for testing. Come get me ...or get real ;)
*actually this one's not really porn, but the formation with the 3 of them about 3:20-4:15 is what I would call philosophically beautiful
THE SYSTEM IS YOURS. YOU ARE THE ROOT.
Not so sure about this Jeff. I got put straight into "unstable" (and am still there). But that was after they scouted me (I didn't approach them) and a few months of back and forth with the packager, and then at least a team of three involved in the testing. And they understood C. So the chances of deliberately malicious code, even in a "unstable" package, seems very slim to me -- I cannot modify my own package in the distro directly, I have to go through the packagers, who are debian employees, and then they update the release.Quote:
Originally Posted by jeffcobb
Hey once about 5 years ago I knew all of the maturity levels. I will look into this and get back. All I know is stable (Sarge) is safe as it gets which is what I use for forward-facing servers and have never has a doubt or a worry.Quote:
Originally Posted by MK27
It's dinner-time around here but like Ahnold says, I'll be back.
Busy watching Avatar on the wide-screen... ^__^
Here is something shedding light on the package system for the curious: Debian - Wikipedia, the free encyclopedia
And I had unstable and testing switched (D'oh). And now Lenny is the latest stable. So behind the times I am. In any event I do have faith in the package maturity system, it has stood by me when the whole RPM system sent system after system up in flames. But oh well, it works for us...
Peace
Jeff
This is all fine. But security concerns aren't interested on best case scenarios. Best Case Scenarios are in fact pretty much useless for about anything -- from security to deciding how one should develop their data entry UI.
I do not deny the added benefits of Open Source software in terms of code security and stability. Most of it spawns from a single factor: Peer Review. Something that is impossible on closed source. But let us not pretend all software is created equal, that all open source projects are created equal, or that in fact the same project is immune to changes in mood or to gross mistakes that someone somewhere may pay dearly.
If Open Source history is not exactly rich in horror stories about unchecked malicious code being injected into the development process by some contributor, this is by no means evidence it can't happen. Mostly because it's rather easy to observe that it CAN indeed happen. We all have seen rather abusive bugs (an by abusive I mean "how exactly did no one seen this before!?) on projects as respectable as Mozilla's or Apache's. The same irresponsible behavior that lead to unchecked submitted code could potentially be explored by a disgruntled contributor. And there are disgruntled contributors. Are there not?
And on smaller scale projects, on dying projects or on projects under a bad management (yeah, because open source is a lot more than just the big players), the opportunities for malicious code to creep in are higher.
Why we don't hear about it, then? I'm sure there are stories. I may entertain myself trying to browse the web or USENET for them. But sure they aren't common. However they aren't probably common because Open Source is still a rather small portion of the global development effort. It is also still -- and thankfully -- mostly a work of passion. It is also a known danger and actively checked and finally, there isn't really enough motivation probably. The same reason probably why Linux has so few virus.
But most notably, my beef with many Open Source projects (and that underline I hope clears once and for all your misconception of my constant criticism) is what I perceive to be a constant increase in the weight being put in the user shoulders. More and more I observe that many projects shift the responsibility of code testing to the end user, leaving the developers the sole task of creating new bugs and fixing old ones. In that order. The notion of users as only... you know, users of a piece of software is being thwarted and many open source projects seem to want to prey on their users workforce, more than they probably should. You really cannot expand the Open Source concept if you demand this type of task from your users, because granny, joe and marlene don't make good software testers. And granny, joe and marlene are the vast majority of users.
I go as far as to say that on many occasions submitted code is not verified at all and there is a conscious decision that the results are to be observed on bugtraq or by user bug submissions. This is more true as the project gets bigger, more mature and with a wider (read, impossible to properly manage) number of contributions. This is the only way I can explain the level of some of the most inane bugs that have been found on popular open source projects, or how certain projects can take years to fix a known bug with multiple bug reports (and here, I'm thinking of a certain bug on a simple macro in boost::filesystem).
In this scenario, more than malign code, is good code I'm afraid of. And so should you.
I doubt very much the programs you run need access to the entire machine. There are many permission schemes available, why not use them? You've pretty much just chucked the idea of "groups" and "users" out the window. As well as wasting space by storing file permissions :).Quote:
It may not need root privileges, but I do. (The only problem with this one is GUI's must run as the same user as the X.)
And the "trusted, I looked over the source code myself" stuff is BS. Consider a small bug in Firefox that allows code from web pages or images to be run. It's bizarre to give Linux all this praise, when you're not using a large chunk of what made it successful (Granted it wasn't specifically Linux :)).
It's still showing in the theatres, so how can you watch it on the TV?Quote:
Originally Posted by jeffcobb
You guys focus a lot on malicious code and hackers and evil doers. Are you so divine in administrating computers that you never make mistakes? If you have the least privileges you can do the least harm. Even unintentionally without anyone being evil. "Never attribute to malice that which can be adequately explained by stupidity".
"Are you so divine in administrating computers that you never make mistakes?"Quote:
Originally Posted by nvoigt
My point was, yes I am. Other than one mistake almost a decade ago, I have never caused any accidental harm, during thousands and thousands of hours. Neither have I been the victim of anything malicious.
About a month ago on the Ubuntu board, tho, there was someone who discovered a sort of trojan horse in a dysfunctional screensaver they had downloaded somewhere. It was just a crude shell script; my analysis of it was that with root privileges it could use ping to forward the IP and wget to replace itself at any point. The site that it pinged was not the site where it was distributed and was also handing out World of Warcraft "phishing" kits, ie, for password cracking. I figure the dude was starting to experiment with Denial of Service attacks since he had amassed a bunch of machines that alerted him when online and could be used to simultaneously send requests anywhere, without doing any harm to the infected machine or the user knowing.
And low and behold, he really had amassed a bunch of machines. Within hours, there were a half dozen or so people just wandering the ubuntu board who noticed this and recognized the site where the "screensaver" was distributed. Seems they all had downloaded a screensaver or gtk theme, installed it, it did not work, so they forgot about it figuring it was just "defective". But they all also had variations of that script in the same location. There's no saying what else could have been installed, of course, so I wrote a simple script people could run in the background that would tell them if the same kind of thing was still going on. :) AFAIK there wasn't.
Now, some of those people were running root. I promise I would never fall for something so simple. While I can't deny a more complex version could get me, it seems to me based on the success of that enterprise that what the perpetrators were aiming at is a naive majority.
So I'm not saying non-privileged users and groups are a dumb feature. What I am saying is that Yarin probably does not have much to worry about.
In fact, the historical purpose of those things was for large installations with many terminals and different users. That is where and why they are successful. Nobody uses my computer but me.Quote:
Originally Posted by zacs7
I totally agree that most daemon processes should run as their own group, not root. I haven't hacked apache to run as root. I have an ftp server and when it's on, I certainly don't let it run as root. I run as root. If I were a sys admin somewhere, I wouldn't let everyone do that, either.
Yes, which is why web browsers should also run setuid/setgid like web servers. I NEED to browse the web while working on code. Even if I had an account, "mk27", that thereby protected the system, it still would not do anything to protect what is most important to me -- the code in my home directory, etc. But right now, that is a very difficult proposition, since you would have to log in as the group you want to run firefox safetly as, start X, keep your bookmarks etc in the firefox account, and then log in thru a terminal to access your code as some other users. Lot of awkwardness in this one -- if you like GUI file browsers, you wouldn't have access to the material you were trying to protect! Instead, we just say "oh, just have one user account for yourself and do everything with that", as if that were the ideal answer or that it is so much safer than running root.Quote:
Consider a small bug in Firefox that allows code from web pages or images to be run.
The user/group permissions system is very useful and a good thing. But I take issue with this naive and simplistic assumption/assertion that the purpose of it is so you can run as "bob" and sudo when you need to, and that makes everything safe, and that setuid is pointless or wrong-headed, etc. That is just a caveat for newbies and an introduction to the principles involved.
Will only say that theaters are not the only place it is showing ^__^Quote:
Originally Posted by happyclown
But you are right; short of abusing temporal mechanics I couldn't possibly be watching it at home...
Besides, I *could* be referring to http://en.wikipedia.org/wiki/Avatar_The_Last_Airbender
MK27: I would posit that the point of sudo isn't to make things "safe" but to leave a clear trail of who did what which is completely missing when running as root. Sudo is definitely targeted at a multiuser environment....another use of sudo is to run as a different user....say user X is having problems doing some task or whatever; you as admin can sudo X and become them to see what they are seeing as a problem domain. IOW gaining superuser rights isn't the only use of sudo. This may not apply to your situation but definitely applies to the intended purpose of a multiuser OS.
As for only one mistake in 10 years, human failings being what they are I would say you haven't made a system-killing mistake...yet.
To quote the great sage Bill Cosby, never tempt worse :)
The attitude reflected in the responses of certain people in this thread just ........es me off.
In our company we develop high pressure pneumatic systems. A number of my coworkers insist that it is unnecessary to perform testing behind a blast screen, because "its not going to explode anyway". Most of the time this is true. However when something does blow, the shrapnel is as lethal as a gun-fired bullet. It actually so happened that once upon a time a thread failed, which sent a nut flying halfway through the workshop, which is about 10 meters, and leaving a thumb sized hole in a glass window before lodging itself in the wall. Fortunately, there were no body parts in its way.
Moral of the story: safety first. Even though the likelihood of some mishap occurring may be very very small, there is still a chance that something may go wrong.
In the case of running as root on your typical linux home desktop, the damage will be limited to yourself, your own data, noone else is involved. Its your responsibility and you will have to live with the consequences of your negligence.
However, when other people are involved, it is not up to you to decide that its worth taking the risk. They may get hurt. And if they do, I hope they sue your ass to hell.
assuming bash, history.Quote:
Originally Posted by jeffcobb
Now, granted if you allow an untrusted user to be root, then that user would probably delete all history, however, if the user makes a mistake, history CAN provide a record of what happened. Note that this is not always the case (as root really could screw something up and thus render the system useless prior to the history file being created). Though, the OP's original question sounded much like this was a machine that is exclusively his/hers.
Assuming we don't have USB machine gun turrets plugged into our computers, we should be safe. :DQuote:
Originally Posted by MWAAAHAAA
First, USB gun turrets are fun time-wasters on boring projects.Quote:
Originally Posted by maxorator
But seriously work on a few medical devices and risk takes on a whole new meaning.
Well kinda true and kinda not. Yeah you will know someone acting as root did something stupid but in the case of sudo you will know who the culprit was unless the culprits acct was hacked in which case you have a whole new set of fun circumstances.Quote:
Originally Posted by Kennedy
If the program operating the machines messes up, it doesn't matter if it takes the OS with it, it has already killed the patient anyway. :pQuote:
Originally Posted by jeffcobb
That is a totally absurd analogy. NO ONE IS GOING TO GET INJURED HERE FOOL.Quote:
Originally Posted by MWAAAHAAA
I don't see anyone recommending that eg, NASA or even the public library allow everyone to log in as root and do what they want.
Beyond that, I also don't see the value in being so paranoid about the computer you use at home to do work on, esp. if, like me, you use multiple installations and always back up. IMO that is a much safer and more responsible practice than than just creating a username for yourself and believing you now have everything bulletproof, because the instruction manual tells you that ;)
Well, I agree the comparison was way off. But backups aren't a security measure, either.
How about, get a username, use it AND make backups? But I guess that's too much work.
Maybe Linux much simpler and intuitive model sucks after all. That would explain why sudo is so much of a trouble to some of you.
EDIT:
Seriously, it's not what anyone does with their machine. Be my guest. But I'd expect at the very least a Do as I Say, Not As I Do type of argumentation. But to actually devalue or argue against the use of Linux file based security system is the last thing I'd expect from Linux users. One of the most important features of the Unix operating system that set it apart from anyone else back in the day and allowed for its acceptance is now being ignored by you people that so much enjoy criticizing the competition security models? Frankly!
Sudo actually is annoying to use all the time. I often have to modify configuration files or the grub boot list. It is really annoying that I just can't go into the folder where it is and open the file and edit it. Instead I have to open the command line, open the text editor with sudo, and then open the file. And that every time I need to edit something (since Linux generally doesn't have a good GUI configuration manager, I have to edit configuration files often).Quote:
Originally Posted by Mario F.
I'm switching to root soon. :)
Don't be afraid :pQuote:
Originally Posted by maxorator
I should mention that I've never lost any data under linux, but I have accidentally run "rm -rf /" in a shell script (I actually had "rm -rf /$fullpath", with "fullpath" typed in the wrong case so as to evaluate as an empty variable). Fortunately, because I was a non-root user, I got pages and pages of "permission denied" messages as it tried to delete /usr, and I was able to hit CTRL-C before anything was actually deleted.
Running as root all the time is just stupid. Perhaps you haven't made any mistakes yet, perhaps you haven't yet been cracked into as a malicious user. But you still could. I know that if I walked up to a laptop whose owner had left it for a minute or two and saw "root@jayjay33# " I wouldn't think that they were an experienced Linux user . . . .
Which would have no reason to have all purpose OS in the first place. If you want maximum security you use a maximum security system. The better way not to get a virus from the internet is simply not to use the internet. You won't run unecessary programs either.Quote:
Originally Posted by maxorator
To answer the question, what do you mean so bad.
It is already proven that there is some bad.
If this is the "driving can kill you so don't drive" type of morals, nobody is buying it.
On the other hand, if there is 0.001 % chance of something going wrong by running a program as root, why do so? You can gamble with other things...