4 ms·

I guess I'll have to stop running $ sudo git clone ...

• jrockway 6y ago
  I don't think that smugly not running as root saves normal users; while malware running as your user can't trash your laptop, they can get your Google cookie and read and send emails as you, spend your money, view your private photos, etc.
  • fulafel 6y ago
    And it can run sudo as your user after you warm it up. Or use any number of frequently disclosed OS vulnerabilities for local privilege escalation.
    • Wowfunhappy 6y ago
      > And it can run sudo as your user after you warm it up. How is it getting my root password?
      • edgyquant 6y ago
        I set sudo to NOPASSWD, so it doesn’t need one for my workstation
      • thelopa 6y ago
        Sudo persists authorization for a short period of time so that you don’t need to re-authorize for back-to-back commands. Also, once they get ACE they can modify your bashrc to make sudo an alias for “sudo rm -rf / ;” or all sorts of other evil trickery.
      • VMG 6y ago
        it could also alias sudo to some other command
        • JetSpiegel 6y ago
          Like "doas".
  • selfhoster11 6y ago
    Relevant XKCD: https://xkcd.com/1200/ https://xkcd.com/1200/
• yjftsjthsd-h 6y ago
  I mean, there are... not-totally-unreasonable workflows that do clones as root. Edit: although I am struggling to think of one that clones from an untrusted source.
  • krick 6y ago
    > not-totally-unreasonable workflows that do clones as root Uh... really? Like what?
    • yjftsjthsd-h 6y ago
      etckeeper and friends (I have a git checkout in /etc/nixos on nixos machines), portage sync on funtoo, pulling ports tree or even system source on a BSD, grabbing setup scripts during install of Arch before a non-root user exists
      • t0astbread 6y ago
        So, basically workflows where the cloned code gets run as root without further inspection anyways.