5 ms·

I’m going to repost this from the Mac thread: What exactly is the point of sudo/UAC these days of single-user machines? I think https://xkcd.com/1200 https://x

I’m going to repost this from the Mac thread: What exactly is the point of sudo/UAC these days of single-user machines? I think https://xkcd.com/1200 https://xkcd.com/1200 put it well. Anything running as an unelevated user account can access my browser sessions where it can steal my passwords, emails, other other private info. It can turn on my microphone and camera. It can read all of my documents. Those are the things I care about protecting, not whatever special things root can do like install drivers and create virtual network interfaces. The best configuration for WSL sudo is probably to just allow all commands without any authentication.

kiwijamo 6y ago
Have you forgotten what life was like before windows got UAC? Just because a machine is single user doesn't mean it's a good idea for all processes to run as root/Admin.
- fock 6y ago
  back then I remember that people generally had a single computer, used by the whole family! It's definitely not good for kids to trivially install a banking trojan when downloading stuff. Nowadays: all my data belongs to a single user, I am the only user on 5 machines. The only thing for which root is good, is to secure fw updating and deleting ZFS/BTRFS-snapshots. Unfortunately there's still setuid-binaried weakening this security model.
kyriakos 6y ago
Even a single user machine is really not single user because your applications are also users on your machine and being Internet connected/updated you better have control over what they can do.
eneville 6y ago
Hello, author of please (https://gitlab.com/edneville/please https://gitlab.com/edneville/please) here, where I've taken a different approach to make permitting grnular things simple. Permiting everything is no different really to browsing the web as root. Permitting granular things in sudo and doas isn't easy. For what it is worth, many of the systems I work on on have many more than just one user and I am sure that other people work on bigger environments too. When you have multiple users, you run the risk of delegating more access than you should and thus compromise content, hence why I think access should simple!
jeroenhd 6y ago
On Windows, it's a malware thing. Windows XP applications were designed with horrible security issues disguised as features because of it, partially causing the massive pain everybody felt when migrating to Windows Vista. Your favourite text editor could be the reason your graphics card would randomly make the screen go green, or that your flash drive didn't work, or that your system bluescreened and you'd have no idea of knowing because *anything* could be causing those problems. Modern Windows has permission levels and capabilities that segregate background processes and system services. If your browser, running in low integrity mode, gets exploited, there's a whole layer of security that needs to be bypassed to read the keys you type or to install tasks at startup. On Linux, I think it's mostly an anti-fuckup-thing. You can't accidentally delete system files if you're not root, you can't accidentally restart the wrong service, you can't accidentally edit the system config when you want to edit the user config. Badly-written tools can't mutate something when I ask them to just read. It also works for the same reasons as UAC does for Windows, though the Linux permission model is much simpler than the Windows one for most use cases. If you run everything as root, the first compromise rootkits your computer. If you use proper user segregation additional steps need to be executed in order to trick you into getting the malware hooked deep into your system. For WSL, the problem is similar to Linux, because WSL is just a well-integrated Linux VM. Dev tools such as npm download and execute random code from the internet, which can be infected somewhere six levels down the dependency chain. If you run those as root, you're giving that malware full access to your system whereas your local user account can only modify some of the files outside of WSL. It doesn't protect you from theft of your unlocked laptop. It does protect you from bad software, at least partially.
- throwaway8581 6y ago
  It’s true that the pre-UAC situation in Windows was bad, but the function of UAC was to encourage app developers to do the right thing. Raymond Chen agrees: ”UAC is not a security feature. It’s a convenience feature that acts as a forcing function to get software developers to get their act together.” https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105 https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94... On a single user machine, it does nothing for user security, because all of the things worth protecting, like your data, don’t require elevation anyway. As for preventing fuckups, it prevents the wrong fuckups. Deleting my user files is a bad fuckup. A program trashing my files and emptying my bank account is a bad fuckup. Trashing my OS install, the only thing root can do that my user account can’t, is an inconvenience.

kiwijamo 6y ago

Have you forgotten what life was like before windows got UAC? Just because a machine is single user doesn't mean it's a good idea for all processes to run as root/Admin.

fock 6y ago
back then I remember that people generally had a single computer, used by the whole family! It's definitely not good for kids to trivially install a banking trojan when downloading stuff. Nowadays: all my data belongs to a single user, I am the only user on 5 machines. The only thing for which root is good, is to secure fw updating and deleting ZFS/BTRFS-snapshots. Unfortunately there's still setuid-binaried weakening this security model.

kyriakos 6y ago

Even a single user machine is really not single user because your applications are also users on your machine and being Internet connected/updated you better have control over what they can do.

eneville 6y ago

Hello, author of please (https://gitlab.com/edneville/please https://gitlab.com/edneville/please) here, where I've taken a different approach to make permitting grnular things simple. Permiting everything is no different really to browsing the web as root. Permitting granular things in sudo and doas isn't easy. For what it is worth, many of the systems I work on on have many more than just one user and I am sure that other people work on bigger environments too. When you have multiple users, you run the risk of delegating more access than you should and thus compromise content, hence why I think access should simple!

jeroenhd 6y ago

On Windows, it's a malware thing. Windows XP applications were designed with horrible security issues disguised as features because of it, partially causing the massive pain everybody felt when migrating to Windows Vista. Your favourite text editor could be the reason your graphics card would randomly make the screen go green, or that your flash drive didn't work, or that your system bluescreened and you'd have no idea of knowing because *anything* could be causing those problems. Modern Windows has permission levels and capabilities that segregate background processes and system services. If your browser, running in low integrity mode, gets exploited, there's a whole layer of security that needs to be bypassed to read the keys you type or to install tasks at startup. On Linux, I think it's mostly an anti-fuckup-thing. You can't accidentally delete system files if you're not root, you can't accidentally restart the wrong service, you can't accidentally edit the system config when you want to edit the user config. Badly-written tools can't mutate something when I ask them to just read. It also works for the same reasons as UAC does for Windows, though the Linux permission model is much simpler than the Windows one for most use cases. If you run everything as root, the first compromise rootkits your computer. If you use proper user segregation additional steps need to be executed in order to trick you into getting the malware hooked deep into your system. For WSL, the problem is similar to Linux, because WSL is just a well-integrated Linux VM. Dev tools such as npm download and execute random code from the internet, which can be infected somewhere six levels down the dependency chain. If you run those as root, you're giving that malware full access to your system whereas your local user account can only modify some of the files outside of WSL. It doesn't protect you from theft of your unlocked laptop. It does protect you from bad software, at least partially.

throwaway8581 6y ago
It’s true that the pre-UAC situation in Windows was bad, but the function of UAC was to encourage app developers to do the right thing. Raymond Chen agrees: ”UAC is not a security feature. It’s a convenience feature that acts as a forcing function to get software developers to get their act together.” https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94105 https://devblogs.microsoft.com/oldnewthing/20160816-00/?p=94... On a single user machine, it does nothing for user security, because all of the things worth protecting, like your data, don’t require elevation anyway. As for preventing fuckups, it prevents the wrong fuckups. Deleting my user files is a bad fuckup. A program trashing my files and emptying my bank account is a bad fuckup. Trashing my OS install, the only thing root can do that my user account can’t, is an inconvenience.