4 ms·
Yes, don't give your main account admin sudo access without a password. Keep backups on an external file store just in case. Use a filesystem that has snapsho
by warmwaffles 5y ago
Yes, don't give your main account admin sudo access without a password.
Keep backups on an external file store just in case.
Use a filesystem that has snapshot capabilities.
- Gigachad 5y agoWhat is the point of that. Sudo doesn't give access to anything important. Very much reminds me of this https://xkcd.com/1200/ https://xkcd.com/1200/ Snapshots on an external system is useful but few are disciplined enough to take regular enough snapshots.
- randomhodler84 5y agoIt kinda does… root can write to places that the user cannot. Like Boot partitions, or entire device nodes, or load kernel modules that the user cannot see. That xkcd is a funny historical joke, but the root/user distinction is still a critical part of operating system security today.
- derkades 5y agoBut it is true. Who cares if the program can write to your system configuration when it can encrypt your entire home directory and use your private SSH keys to encrypt all your servers as well. I'd argue the root/normal user separation is largely useless on single user desktop computers.
- randomhodler84 5y agoPresumably only the homedirs of the servers. You want a world where a browser exploit can drop a bootkit? Nahhh
- Gigachad 5y agoThey could just drop something in bashrc or somewhere else for a persistent exploit. The system files contain nothing worth touching on a personal device.
- randomhodler84 5y agoPersistent userspace. And while I understand privesc in major platforms is not the insurmountable problem it seems, it is still a layer of protection important to the model of preventing SMM, hypervisor efi boot and root level persistence, without something else up its sleeves.