5 ms·
These two have been caught. How many haven't yet been caught? Traditional Unix file permissions are pretty much a joke for the way developer computers get used
by frou_dh 7y ago
These two have been caught. How many haven't yet been caught?
Traditional Unix file permissions are pretty much a joke for the way developer computers get used (one user - does everything). Real process sandboxing is needed.
- pornel 7y agoAnd it's not just the developer machine that's at risk. Even if you protect your own system, you will still be shipping malware to your users, who may be vulnerable. And you'll be lending your credibility to the malicious libraries you distribute.
- deleted 7y ago[deleted]
- pnutjam 7y agoNot everything needs to run as root.
- frou_dh 7y agoIt's all running as john
- OJFord 7y ago$ pkgman install hip2019pretty-ls $ su sandboxeduser prettyls ... nobody does that. Sure daemons might run as different user(s), but on ~100% of developer machines, the logged in user launches a shell as themself, and runs programs in that shell as themself.
- pnutjam 7y agoNobody can make you use account isolation, but you should.
- swebs 7y agoOk, but your private keys are stored in your home directory. No root access required.
- otachack 7y agoFor sure, but does applying a password on pub-priv key creation encrypt it? Haven't tried it myself yet but may later when I'm back at my computer.
- mikorym 7y agoYes, if you use OpenSSL it will ask if you want to encrypt with a password. You can verify this by just opening the file in a text editor and you'll see that the contents are obfuscated via that password.
- eikenberry 7y agoBut they are encrypted and so are of no use to anyone.