> If he had used a separate non-root account for Redis, the damage would have been limited to that single user account. Probably not. The attacker would have g

> If he had used a separate non-root account for Redis, the damage would have been limited to that single user account. Probably not. The attacker would have gotten access to the machine. As there is a lot of software installed locally some probably have holes, which allows for full root access. So I don't really believe it makes much difference for serious attacker if the attacker gets root access or normal access.