7 ms·

Richard Stallman, su, and the 'wheel' group (2004)

userbinator 2y ago
Isn't the existence of GNU su itself an inconsistency? It seems like RMS' vision was an environment in which everyone is effectively root, and su wouldn't be necessary.
- sokoloff 2y ago
  Every user can become root at will is different than every user is root at every moment.
helb 2y ago
Related: "Why GNU su does not support the `wheel' group (2002)", https://news.ycombinator.com/item?id=37175754 https://news.ycombinator.com/item?id=37175754, 143 comments
kelnos 2y ago
I suppose RMS's came up in a very different time when it came to computing, and pre-modern-internet computing had much less an emphasis on security, but his takes on things like this always seem so bizarre to me.
- cmelbye 2y ago
  Thinking about the circumstances of the time compared to today helped me to find relevance. We’re using GNU/Linux differently now than he was when that message was written. Symbolically, the ability to ”operate” the machine is provisional, and able to be taken away at any point by the true owner.
zer00eyz 2y ago
Ahhh Stallman! Stallman is open sources resident lunatic. And for better or worse he's ours and we should embrace him. Not because we think what he says is right, rather for his purity of vision and conviction. You don't have to agree with him, but you have to respect how far he's willing to go to make a point. And this: https://www.youtube.com/watch?v=Pube5Aynsls https://www.youtube.com/watch?v=Pube5Aynsls
- jraph 2y ago
  I believe he would rather be described as free software's resident lunatic though.
  - userbinator 2y ago
    He does emphasise source code and equate it to freedom, despite it possible to have freedom without open source (it's called public domain software.)
    - jraph 2y ago
      I believe you are mixing up many things. > He does emphasise source code This is not relevant to the free software movement vs the open source movement. > it possible to have freedom without open source No, because the open source definition is more or less equivalent to the free software definition, and something not open source is therefore not free either. > it's called public domain software. Public domain software is necessarily¹ open source provided you have the source code. If you don't, you don't have freedom either. 1 ("well, actually"): many countries don't allow you to willingly put something into the public domain yourself, so in those country, it is not clear you have any right to use software someone put in the public domain because it's not in public domain in those country. You'd need an explicit license like CC0 to do this.
      - userbinator 2y ago
        No, because the open source definition is more or less equivalent to the free software definition, and something not open source is therefore not free either. Wrong. Public domain software is necessarily open source provided you have the source code. If you don't, you don't have freedom either. Wrong. This is precisely the idiotic focus on source code I'm talking about. Decompilers are even better now than they were in the 80s when people, even Stallman himself admits, would just disassemble and then modify software that way. As long as you have the power to change the bytes that make up the software, and doing that is legal, that should be enough to qualify as free software. How it was made doesn't matter one bit (pun intended).
asimovfan 2y ago
As i was reading the the quote by stallman i became somewhat introspective and i thought for a while and the then the shallowness of the last sentence of the blog post itself was like a cup of water thrown in my face.
hestefisk 2y ago
I always thought wheel was a BSD thing?
- fhars 2y ago
  Yes. Although I have a vague recollection that some non-BSD tools supported a wheel group if you compiled with -DHAVE_FASCIST_SYSADMIN (see also "opinionated" elsewhere in this thread). But I can't find any trace of that using common search engines anymore, maybe I am misremembering some usenet flamewar.
perbu 2y ago
It is hard to imagine a more opinionated system than GNU.
- squigz 2y ago
  Could you elaborate on this? And why a system like Apple's OS isn't quite as opinionated in your view?
- amelius 2y ago
  Do you prefer a system where every decision is left to the user? I.e. where nobody and nothing can make any assumptions about the system without keeping track of a long list of settings that are active? For example, imagine "/" is the path separator for some users and "\" is the path separator for some other users, depending on some setting. Would you like that?
  - deleted 2y ago
    [deleted]
tgma 2y ago
I think it is worthwhile to understand and steelman Stallman [lolz]: Stallman is not anti-security and is indeed pro-privacy[1], i.e. you should be able to deploy security systems to keep your data secure from adversaries. However, a security system should be deployed to protect the user from adversaries, not protect admins from the users and give admins power over the user. It's the power asymmetry that is used to oppress the users that bugs him. (In fact, time and time again, the actual security of the system is a joke, as was in his particular story, but nevertheless the boogeyman is there and is set up by the admins to restrict the users.) Note that we are talking about a different era and deployment of computer systems. I have seen firsthand university systems that are effectively run by students as peers for the most part, but some power-hungry clueless hired admin inevitably comes up and wants to deploy spyware and overprotective policies on the students. [1]: another example of this is Secure Boot. He has no problem with Secure Boot in principle as long as the keys are under the control of the user, not the manufacturer.
- hulitu 2y ago
  > However, a security system should be deployed to protect the user from adversaries They all (Google, Microsoft and Apple) say that . The problem is that they do the exact opposite. All your user data belongs to Google, Microsoft and Apple because they protect the root user. But all data is in your user account.
  - delusional 2y ago
    Notice how that dovetails into stallman's main ideological point. The reason they can want "security" for the user, while actually only protecting themselves, is that they've already perpetrated the original sin of proprietary software. The "user account" isn't an abstraction used to help you, it's an abstraction that serves the companies.
  - kalleboo 2y ago
    Huh, but it's Google and Apple operating systems that are the only ones that actually protect user data by sandboxing apps from each other so they can only access their own data? It's the open source operating systems (and MS) that only protect the root account, because they're designed for servers or academic/corporate campuses and not personal computers. If I install a program from a package manager on Linux, it has access to my whole home directory. If I install an app from the Apple App Store, it only has access to the files I specifically tell the OS to open with it.
kasabali 2y ago
> Stallman is definitely not someone I’d want in charge of the security of my system. ..but you'd be ok Microsoft being in charge of signing kernel images for secure boot, right?
mesrik 2y ago
By far most nuisance for me has been that Linux distros that ship with wheel GID different than it's BSD side 0 (zero). Debian hasn't been shipping with wheel group by default, but Red Hat and many its descendants it's GID 10. The macOS and BSD's don't ship with root group, Linuxen either doesn't ship with wheel group or it's GID mismatch what's on BSD side. The difference will cause issues and system tools misbehaving. Bit different if NAS is BSD based and using NFSv4 or newer, since user and group mapping is based names and not any more ID values they were earlier. But NFS GID mapping does not work properly whichever NFS is used, it's just different kind of misbehaving. This can be fixed linux (debian etc, missing), add "wheel:x:0:" line /etc/group, right after root group. And with Red Hat based changing that GID 10 to 0. Of course then /etc/idmap.conf the usual " [Mapping] Nobody-User = nobody Nobody-Group = nogroup [Translation] Method = nsswitch " Is worth checking also. The rationale adding secondary GID 0 "wheel" after first original root GID 0 is that, if you check how std nix tools work, when those look up by name they will use GID what's set there, and when they look up by GID they quit looking after they find matching first value that was found. Therefore above solution works both ways, and your NFS shares from BSD's always shows correct value and correct group name that matches the value. I think I've learned this workaround about 30 years back now.
- DEADMINCE 2y ago
  A group with a GID of 0 i just the root group, regardless of what it is called. wheel isn't meant to be another name for root, and putting users in a root group is not a better solution, better than what the wheel group already solves. Leave the GID for the wheel group at 10.
1vuio0pswjnm7 2y ago
"Stallman is definitely not someone I'd want in charge of the security of my system." That is Stallman's point. Some users do not want to place someone else, maybe a so-called "tech" company, in charge of the security of the user's system.

Isn't the existence of GNU su itself an inconsistency? It seems like RMS' vision was an environment in which everyone is effectively root, and su wouldn't be necessary.

sokoloff 2y ago
Every user can become root at will is different than every user is root at every moment.

helb 2y ago

Related: "Why GNU su does not support the `wheel' group (2002)", https://news.ycombinator.com/item?id=37175754 https://news.ycombinator.com/item?id=37175754, 143 comments

kelnos 2y ago

I suppose RMS's came up in a very different time when it came to computing, and pre-modern-internet computing had much less an emphasis on security, but his takes on things like this always seem so bizarre to me.

cmelbye 2y ago
Thinking about the circumstances of the time compared to today helped me to find relevance. We’re using GNU/Linux differently now than he was when that message was written. Symbolically, the ability to ”operate” the machine is provisional, and able to be taken away at any point by the true owner.

zer00eyz 2y ago

Ahhh Stallman! Stallman is open sources resident lunatic. And for better or worse he's ours and we should embrace him. Not because we think what he says is right, rather for his purity of vision and conviction. You don't have to agree with him, but you have to respect how far he's willing to go to make a point. And this: https://www.youtube.com/watch?v=Pube5Aynsls https://www.youtube.com/watch?v=Pube5Aynsls

jraph 2y ago
I believe he would rather be described as free software's resident lunatic though.
- userbinator 2y ago
  He does emphasise source code and equate it to freedom, despite it possible to have freedom without open source (it's called public domain software.)
  - jraph 2y ago
    I believe you are mixing up many things. > He does emphasise source code This is not relevant to the free software movement vs the open source movement. > it possible to have freedom without open source No, because the open source definition is more or less equivalent to the free software definition, and something not open source is therefore not free either. > it's called public domain software. Public domain software is necessarily¹ open source provided you have the source code. If you don't, you don't have freedom either. 1 ("well, actually"): many countries don't allow you to willingly put something into the public domain yourself, so in those country, it is not clear you have any right to use software someone put in the public domain because it's not in public domain in those country. You'd need an explicit license like CC0 to do this.
    - userbinator 2y ago
      No, because the open source definition is more or less equivalent to the free software definition, and something not open source is therefore not free either. Wrong. Public domain software is necessarily open source provided you have the source code. If you don't, you don't have freedom either. Wrong. This is precisely the idiotic focus on source code I'm talking about. Decompilers are even better now than they were in the 80s when people, even Stallman himself admits, would just disassemble and then modify software that way. As long as you have the power to change the bytes that make up the software, and doing that is legal, that should be enough to qualify as free software. How it was made doesn't matter one bit (pun intended).

asimovfan 2y ago

As i was reading the the quote by stallman i became somewhat introspective and i thought for a while and the then the shallowness of the last sentence of the blog post itself was like a cup of water thrown in my face.

hestefisk 2y ago

I always thought wheel was a BSD thing?

fhars 2y ago
Yes. Although I have a vague recollection that some non-BSD tools supported a wheel group if you compiled with -DHAVE_FASCIST_SYSADMIN (see also "opinionated" elsewhere in this thread). But I can't find any trace of that using common search engines anymore, maybe I am misremembering some usenet flamewar.

perbu 2y ago

It is hard to imagine a more opinionated system than GNU.

squigz 2y ago
Could you elaborate on this? And why a system like Apple's OS isn't quite as opinionated in your view?
amelius 2y ago
Do you prefer a system where every decision is left to the user? I.e. where nobody and nothing can make any assumptions about the system without keeping track of a long list of settings that are active? For example, imagine "/" is the path separator for some users and "\" is the path separator for some other users, depending on some setting. Would you like that?
- deleted 2y ago
  [deleted]

tgma 2y ago

I think it is worthwhile to understand and steelman Stallman [lolz]: Stallman is not anti-security and is indeed pro-privacy[1], i.e. you should be able to deploy security systems to keep your data secure from adversaries. However, a security system should be deployed to protect the user from adversaries, not protect admins from the users and give admins power over the user. It's the power asymmetry that is used to oppress the users that bugs him. (In fact, time and time again, the actual security of the system is a joke, as was in his particular story, but nevertheless the boogeyman is there and is set up by the admins to restrict the users.) Note that we are talking about a different era and deployment of computer systems. I have seen firsthand university systems that are effectively run by students as peers for the most part, but some power-hungry clueless hired admin inevitably comes up and wants to deploy spyware and overprotective policies on the students. [1]: another example of this is Secure Boot. He has no problem with Secure Boot in principle as long as the keys are under the control of the user, not the manufacturer.

hulitu 2y ago
> However, a security system should be deployed to protect the user from adversaries They all (Google, Microsoft and Apple) say that . The problem is that they do the exact opposite. All your user data belongs to Google, Microsoft and Apple because they protect the root user. But all data is in your user account.
- delusional 2y ago
  Notice how that dovetails into stallman's main ideological point. The reason they can want "security" for the user, while actually only protecting themselves, is that they've already perpetrated the original sin of proprietary software. The "user account" isn't an abstraction used to help you, it's an abstraction that serves the companies.
- kalleboo 2y ago
  Huh, but it's Google and Apple operating systems that are the only ones that actually protect user data by sandboxing apps from each other so they can only access their own data? It's the open source operating systems (and MS) that only protect the root account, because they're designed for servers or academic/corporate campuses and not personal computers. If I install a program from a package manager on Linux, it has access to my whole home directory. If I install an app from the Apple App Store, it only has access to the files I specifically tell the OS to open with it.

kasabali 2y ago

> Stallman is definitely not someone I’d want in charge of the security of my system. ..but you'd be ok Microsoft being in charge of signing kernel images for secure boot, right?

mesrik 2y ago

By far most nuisance for me has been that Linux distros that ship with wheel GID different than it's BSD side 0 (zero). Debian hasn't been shipping with wheel group by default, but Red Hat and many its descendants it's GID 10. The macOS and BSD's don't ship with root group, Linuxen either doesn't ship with wheel group or it's GID mismatch what's on BSD side. The difference will cause issues and system tools misbehaving. Bit different if NAS is BSD based and using NFSv4 or newer, since user and group mapping is based names and not any more ID values they were earlier. But NFS GID mapping does not work properly whichever NFS is used, it's just different kind of misbehaving. This can be fixed linux (debian etc, missing), add "wheel:x:0:" line /etc/group, right after root group. And with Red Hat based changing that GID 10 to 0. Of course then /etc/idmap.conf the usual " [Mapping] Nobody-User = nobody Nobody-Group = nogroup [Translation] Method = nsswitch " Is worth checking also. The rationale adding secondary GID 0 "wheel" after first original root GID 0 is that, if you check how std nix tools work, when those look up by name they will use GID what's set there, and when they look up by GID they quit looking after they find matching first value that was found. Therefore above solution works both ways, and your NFS shares from BSD's always shows correct value and correct group name that matches the value. I think I've learned this workaround about 30 years back now.

DEADMINCE 2y ago
A group with a GID of 0 i just the root group, regardless of what it is called. wheel isn't meant to be another name for root, and putting users in a root group is not a better solution, better than what the wheel group already solves. Leave the GID for the wheel group at 10.

1vuio0pswjnm7 2y ago

"Stallman is definitely not someone I'd want in charge of the security of my system." That is Stallman's point. Some users do not want to place someone else, maybe a so-called "tech" company, in charge of the security of the user's system.