3 ms·

I feel it relevant to point out that any application running as a user that can run sudo, can just steal your sudo password. https://gist.github.com/lrvick/b0f

by lrvick 4y ago

I feel it relevant to point out that any application running as a user that can run sudo, can just steal your sudo password. https://gist.github.com/lrvick/b0f4b744ab277582b1f9c50e0eb87e9e#file-gistfile1-txt-L24 https://gist.github.com/lrvick/b0f4b744ab277582b1f9c50e0eb87... Having a password or a key or any other nonsense to run sudo is security theater. If you do not want all applications to have real root access, use Qubes to isolate applications into VMs, or at the very least have your daily driver user not have root access and have a separate admin user.

j0057 4y ago
Yes, it took me some thinking but it's the conclusion I arrived at as well; the password is useless because as soon as somebody or something can run a bad process it's game over, first of all because all the files I really care about are owned by and writeable by me, and secondly because the bad process can just mess with .bashrc and get root access later. About the only benefit I could think of is slowing down an opportunistic attacker that finds my device unlocked, but even that could be game over with a quick `curl ... | bash` if the attacker is prepared enough. 'Security theater' was my conclusion as well, and I was surprised by it, why is everybody doing this?