5 ms·
> because /etc/passwd is world-readable by design for some arcane reason that I can’t find on Google Because it maps user IDs to names so that you can see name
by kps 5y ago
> because /etc/passwd is world-readable by design for some arcane reason that I can’t find on Google
Because it maps user IDs to names so that you can see names in `ls -l` and `who` and such.
- notacoward 5y agoAlso things like "finger" looking up their home directory and showing you their .plan file. Not saying it was a good choice then, let alone now, but the number of Chesterton's Fence violations in this presentation is pretty high.
- lexicality 5y ago> the number of Chesterton's Fence violations in this presentation is pretty high The article's tagged as satire, I'm not sure you should be expecting good logic and sources
- notacoward 5y agoIs there anything besides the tag to indicate that it's satire, in a sense that any teacher or student of writing would recognize? People have used "just kidding" as a way to duck criticism since time immemorial, but that doesn't mean we have to accept it unthinkingly.
- xena 5y ago> This is a partially satirical talk. It is intended to be mostly factually accurate, however some of the details are stretched for comedic effect. I'd think this would cover all the bases. But what do I know, I just wrote the talk.
- shawn-butler 5y agoYou wrote it badly. I would have walked out.
- notacoward 5y agoHey, I'm supposed to be the Bad Guy here, and even I think that was uncalled for.
- shawn-butler 5y agoJust giving clear non-satirical and honest feedback. The basic facts/history are incorrect. Not to mention the not-so implicit disrespect to the contributors (Sun, lolz! C modules oh-no omgz). If I was watching this in a 30-second tiktok maybe I would have thought it was funny, or maybe the audience for the talk was expecting such low-grade content? Can't say I wasn't there.
- dogecoinbase 5y agoPlay Devil's Advocate, and devils sometimes show up to be advocated for.
- deleted 5y ago[deleted]
- notacoward 5y agoYes, you did, and it was a good talk. I actually did enjoy the snarky tone. PAM is a mess. On the other hand, I don't think that disclaimer really does cover all the bases. You yourself say it's partially satirical, implying that other parts are sincerely meant. Why shouldn't those be subject to the same discussion, correction, or even criticism as any other sincerely meant opinion in any other thing linked here? I'm pretty sure you can handle that back-and-forth better than Sir Lexicality gives you credit for. And if anyone's still offended: my comments are partially satirical too. There, I'm immunized.
- butwhywhyoh 5y agoThis is the perfect cover to do whatever you want at all times. I made an incorrect statement? Don't worry, I _meant_ to get that part wrong. This part here that was insightful and you enjoyed? I meant that part 100%.
- pxc 5y agoOn the other hand, if it hadn't been playful and glib about the decisions that led up to PAM as we know it, we might have had fewer of these lovely greybeards pop up to teach us some PAM and Unix history in the discussion :) maybe Xe can address their comments in a followup, perhaps even after consulting with them a bit on the project itself
- throwawayboise 5y agoAnd the sensitive parts were split off into the root-only /etc/shadow a long time ago.
- Spivak 5y agoBut that doesn't really answer the question. Nothing was really stopping a setuid program from granting access to the non-sensitive bits of the passwd/group files.
- p_l 5y agoEfficiency (spawning setuid program for every line printed by ls -alv is a bit too much), and you don't want to make too privileged programs too (suid ls?)
- Spivak 5y agoI mean the hypothetical program would have just dumped the whole file minus the sensitive bits.
- chungy 5y agoAnd then you've reinvented /etc/shadow but worse. :)
- mindwok 5y agoExposing a setuid program that prints the file would be more dangerous though. The result is the same (you can read /etc/passwd) except now you have a vector for gaining root access through an exploit to this setuid program.
- a-dub 5y agosee getpwnam, which was already public for years and linked by everything. it queries one record at a time.
- tremon 5y agogetpwnam() gets its data by parsing /etc/{passwd,shadow}[0]. It isn't a magical system call that elevates the privileges of the calling program. [0] assuming your nsswitch says so
- saghm 5y agoSounds like maybe "passwd" wasn't the best name for this file, then
- jandrese 5y agoNot anymore, but it is way too late to change it now, especially since it has been user readable since it was created. It's really just "accountdetails" now, with the real password living in a different file. Of course I remember the old "yp" system that would blast the whole file with passwords over the network to anyone who asked. The old Unix guys had a lot of faith in their hash algorithms.
- fulafel 5y agoAlso because there wasn't anything deemed secret there, as the passwords were salted and encrypted. Knowledge about password crackers and crypto became widespread only much later. The pw encryption algorithm was also pretty feeble, a version of some ww2 era rotor machine IIRC.