5 ms·

I never understood the obsession with sudo. Why not just be root in the first place?

• aplummer 10y ago
  You're running code you didn't write or entirely read yourself.
  • minitech 10y ago
    https://xkcd.com/1200/ https://xkcd.com/1200/ (Privilege separation is great, but running things as your main account is approximately equal to running them as root.)
• elmigranto 10y ago
  Maybe better approach is to make stuff not require sudo in the first place.
• woodruffw 10y ago
  Isolate your concerns and risks. There's no reason to drop into an interactive root shell for a single command, and your chances of forgetting your current privilege level and running the wrong thing are not insignificant.
  • TekMol 10y ago
    What special "wrong thing" can root do? There might os level files that only root can edit or delete. I don't care about those. I can reinstall the os anytime if I should ever mess it up. All the value is in my data.
    • phyalow 10y ago
      >>There might os level files that only root can edit or delete Nailed it. >>I can reinstall the os anytime if I should ever mess it up Not everyone has the luxury or time to do this. Why break it in the first place? >>All the value is in my data. ? Cool story.
    • besselheim 10y ago
      One example relating to OS X is that malware running as root can defeat anti-keylogger protections such as this: https://developer.apple.com/library/content/technotes/tn2150/_index.html#//apple_ref/doc/uid/DTS10004249 https://developer.apple.com/library/content/technotes/tn2150... If you were running your web browser as root, and a malicious website used a vulnerability to drop some malware on your system, then it would have complete power to do what it liked without needing to escalate privilege using another vulnerability.
    • ajdlinux 10y ago
      When you're doing maintenance on a production environment which is serving hundreds or thousands of customers, in many cases you can't just "reinstall the OS anytime". Sure, ideally your environment is set up with redundancy and you fail over nicely, but still...
      • PetahNZ 10y ago
        To be fair, if you are serving hundreds or thousands of customers, I hope you have some form of redundancy.
    • woodruffw 10y ago
      For most people, accidentally destroying various system files and "only" having to reinstall the OS would be considered a serious inconvenience. If you want an example of something that could cause lasting damage, it's probably pretty easy to put your Apple product into a non-booting state by fiddling with NVRAM or PRAM settings as root. I'm not familiar with them off the top of my head, though.
      • ascagnel_ 10y ago
        With the advent of EFI booting, you can brick basically any motherboard by wiping it's EFI partitions.
    • tskaiser 10y ago
      Worse than destruction is undetected malicious modification. Say you decompress a specially crafted archieve which overwrites certain parts of the system enabling a backdoor. As a common user this would be blocked, but as root you'd probably not notice the malicious sideeffect.
• partycoder 10y ago
  Because you don't want every process to have control over the file system and other processes. This limits the impact of a misconfigured service, a compromised service, or just a plain malicious service... or users of such services. Then, it doesn't necessarily have to be malicious, you can also harm your system by accident. I have done it many times.