8 ms·

Huh?! Explain your position here, please.

brazzledazzle 7y ago
Not the OP but: Some sysadmins and devs work in institutions where this wouldn’t be allowed or be practical to support (e.g. schools, some healthcare, etc.). It’s not universally applicable to every environment but it’s easy to get in the mindset that it is after you’ve seen what a determined idiot can do.
- twodave 7y ago
  Oh, I agree there are plenty of scenarios where you want to restrict a user's ability to do something. But to draw that line at the admin level seems a bit overkill to me (and de-values the idea of having varying levels of privilege, which is more or less exactly what's going to happen for organizational users anyway). I'm not super familiar with Apple's business features but in a Microsoft shop this would (to an extent) be managed through group policy on the domain controller anyway.
filleduchaos 7y ago
I'm curious about _your_ position, actually. If a user doesn't have admin privileges and doesn't have the credentials to gain admin privileges, that's a clear indication that they both do not own the device _and_ haven't been trusted by the owner of the device to do whatever they want with it. Why exactly should they then be able to install and run random untrusted software on it?
- twodave 7y ago
  My position is nobody ought to probably be running as admin for the vast majority of tasks, and having to elevate to an admin account in order to "download anything" would be a nightmare for any substantial IT department to support. Accounts ought to be granted privileges based on the user's need to get things done. Most consumer laptops and PCs I've seen (and I've seen a lot) don't even have a non-admin user account setup.
  - filleduchaos 7y ago
    I don't quite see how an IT nightmare follows. Where do you work that people are downloading and installing software on work computers every day? > Most consumer laptops and PCs I've seen (and I've seen a lot) don't even have a non-admin user account setup. Have you ever used macOS or are you basing this on Windows laptops?
    - twodave 7y ago
      I work on both, have friends and family and coworkers and acquaintances who use both. If they really didn’t want grandma running as admin they would make it harder to find.
  - pilif 7y ago
    >My position is nobody ought to probably be running as admin for the vast majority of tasks in macOS, even if you run as admin, the only thing that gives you is `sudo` access. Your "admin" user still is a normal user, but it's allowed to gain elevated privileges by supplying their password (or doing biometric auth). The only difference between running as an admin and not running as an admin is that in the former case you don't have to type in your user name. >having to elevate to an admin account in order to "download anything" would be a nightmare for any substantial IT department to support normal users can download all they want. They can't execute it though. That's absolutely what I would like my machine to be configured as.
  - Someone 7y ago
    ”My position is nobody ought to probably be running as admin for the vast majority of tasks” Who disagrees with that? For most users, by a long shot, installing software is only a tiny fraction of the tasks they perform. Anybody, including that substantial IT department has to elevate to an admin account to install software, and that is a good thing. Any halfway smart IT department won’t have to type an admin password on every machine or even visit every machine, though.
- SmellyGeekBoy 7y ago
  I'm the owner of my device and use a non-admin account day-to-day. Is it really that unusual?
  - filleduchaos 7y ago
    The account you choose to use does not change the fact that you are the de facto admin.
  - dkonofalski 7y ago
    This response seems very pedantic. If you are the owner of the device and know the admin password, you are the admin regardless of what user account you're using.
    - twodave 7y ago
      No, it’s not pedantic in my opinion. Using the least privileged account you can get away with is the best practice I was referring to in OP. I’d hate to have to login into my domain admin account for something my daily job required, for instance. Reduce your own ability to shoot your self (and your employer) in the foot.

Not the OP but: Some sysadmins and devs work in institutions where this wouldn’t be allowed or be practical to support (e.g. schools, some healthcare, etc.). It’s not universally applicable to every environment but it’s easy to get in the mindset that it is after you’ve seen what a determined idiot can do.

twodave 7y ago
Oh, I agree there are plenty of scenarios where you want to restrict a user's ability to do something. But to draw that line at the admin level seems a bit overkill to me (and de-values the idea of having varying levels of privilege, which is more or less exactly what's going to happen for organizational users anyway). I'm not super familiar with Apple's business features but in a Microsoft shop this would (to an extent) be managed through group policy on the domain controller anyway.

filleduchaos 7y ago

I'm curious about _your_ position, actually. If a user doesn't have admin privileges and doesn't have the credentials to gain admin privileges, that's a clear indication that they both do not own the device _and_ haven't been trusted by the owner of the device to do whatever they want with it. Why exactly should they then be able to install and run random untrusted software on it?

twodave 7y ago
My position is nobody ought to probably be running as admin for the vast majority of tasks, and having to elevate to an admin account in order to "download anything" would be a nightmare for any substantial IT department to support. Accounts ought to be granted privileges based on the user's need to get things done. Most consumer laptops and PCs I've seen (and I've seen a lot) don't even have a non-admin user account setup.
- filleduchaos 7y ago
  I don't quite see how an IT nightmare follows. Where do you work that people are downloading and installing software on work computers every day? > Most consumer laptops and PCs I've seen (and I've seen a lot) don't even have a non-admin user account setup. Have you ever used macOS or are you basing this on Windows laptops?
  - twodave 7y ago
    I work on both, have friends and family and coworkers and acquaintances who use both. If they really didn’t want grandma running as admin they would make it harder to find.
- pilif 7y ago
  >My position is nobody ought to probably be running as admin for the vast majority of tasks in macOS, even if you run as admin, the only thing that gives you is `sudo` access. Your "admin" user still is a normal user, but it's allowed to gain elevated privileges by supplying their password (or doing biometric auth). The only difference between running as an admin and not running as an admin is that in the former case you don't have to type in your user name. >having to elevate to an admin account in order to "download anything" would be a nightmare for any substantial IT department to support normal users can download all they want. They can't execute it though. That's absolutely what I would like my machine to be configured as.
- Someone 7y ago
  ”My position is nobody ought to probably be running as admin for the vast majority of tasks” Who disagrees with that? For most users, by a long shot, installing software is only a tiny fraction of the tasks they perform. Anybody, including that substantial IT department has to elevate to an admin account to install software, and that is a good thing. Any halfway smart IT department won’t have to type an admin password on every machine or even visit every machine, though.
SmellyGeekBoy 7y ago
I'm the owner of my device and use a non-admin account day-to-day. Is it really that unusual?
- filleduchaos 7y ago
  The account you choose to use does not change the fact that you are the de facto admin.
- dkonofalski 7y ago
  This response seems very pedantic. If you are the owner of the device and know the admin password, you are the admin regardless of what user account you're using.
  - twodave 7y ago
    No, it’s not pedantic in my opinion. Using the least privileged account you can get away with is the best practice I was referring to in OP. I’d hate to have to login into my domain admin account for something my daily job required, for instance. Reduce your own ability to shoot your self (and your employer) in the foot.