3 ms·

It's also interesting how on both Windows and Linux normal-privilege local accounts are, practically, root equivalent. In Linux, we train people to type "sudo"

It's also interesting how on both Windows and Linux normal-privilege local accounts are, practically, root equivalent. In Linux, we train people to type "sudo" in front of anything system relevant. On Windows, we train users to click through UAC prompts. When was the last time sudo said "no" to somebody for a reason other than a password typo? (UAC is marginally better than sudo: UAC is system managed UI, while sudo is just a program. An attacker can plug in a malicious shell alias for sudo and steal your password.) IMHO, it'd be more convenient for users and more reflective of actual security posture to get rid of both sudo and UAC (in the default setup of course) and stop pretending that there's a firm security boundary between root and the primary human local user account.

a2128 2y ago
On Linux, most modern user-facing applications are using polkit instead of sudo. You can actually just use pkexec instead of sudo in the terminal as well. Instead of just running arbitrary commands as root, applications can use specific pre-defined actions like "org.freedesktop.udisks2.filesystem-mount". This shows a nice localized message to the end user about what the app is trying to do, so they can decide whether to allow it or not. The system administrator can also configure certain actions to not even require authentication, useful for e.g. flatpak updates, or to block certain actions altogether.
adrian_b 2y ago
On Linux, I do not install sudo, because I do not need very often to become root, and when I need that I usually want to do multiple operations. I believe that "sudo" is useful only on multi-user computers (including company-owned and company-managed computers), where the administrator may want to give to some users the power to do only a restricted set of privileged operations. I always use a different user account than root, mainly not for security, but to avoid any accidental mistakes, when I could delete or overwrite other files than intended. I believe that this is a good enough reason to justify the need to type infrequently a password in order to change roles.
dwattttt 2y ago
I think an equivalent way to phrase this that feels very different is: "On both Windows and Linux the default installed users are, practically, root equivalent". I guess on the basis that the user performing the installation should be in control of the system (I mean, they are; they could've just not done the installation. Where are your access controls now, blank system!) > When was the last time sudo said "no" to somebody for a reason other than a password typo? Sudo doesn't say no to people, much like UAC doesn't say "no" to people. In both cases, people (admins) are meant to say "no" when they don't expect to be performing an administrative operation. People who are not admins and yet need to do such operations need an administrator to authorise it. In both cases, if it's not a single-person system, whoever is setting the machine up should be setting up limited accounts for regular use.
jeroenhd 2y ago
In my experience (on Gnome at least), Linux is moving towards Windows-style sudo protection. It lacks the "press ctrl+alt+delete to verify" trick. Windows has the advantage that you don't need to script everything. You can wrap `runas`/`System.Management.Automation.PSCredential` around every other tool if you want to, you just don't need to in most cases.

a2128 2y ago

On Linux, most modern user-facing applications are using polkit instead of sudo. You can actually just use pkexec instead of sudo in the terminal as well. Instead of just running arbitrary commands as root, applications can use specific pre-defined actions like "org.freedesktop.udisks2.filesystem-mount". This shows a nice localized message to the end user about what the app is trying to do, so they can decide whether to allow it or not. The system administrator can also configure certain actions to not even require authentication, useful for e.g. flatpak updates, or to block certain actions altogether.

adrian_b 2y ago

On Linux, I do not install sudo, because I do not need very often to become root, and when I need that I usually want to do multiple operations. I believe that "sudo" is useful only on multi-user computers (including company-owned and company-managed computers), where the administrator may want to give to some users the power to do only a restricted set of privileged operations. I always use a different user account than root, mainly not for security, but to avoid any accidental mistakes, when I could delete or overwrite other files than intended. I believe that this is a good enough reason to justify the need to type infrequently a password in order to change roles.

dwattttt 2y ago

I think an equivalent way to phrase this that feels very different is: "On both Windows and Linux the default installed users are, practically, root equivalent". I guess on the basis that the user performing the installation should be in control of the system (I mean, they are; they could've just not done the installation. Where are your access controls now, blank system!) > When was the last time sudo said "no" to somebody for a reason other than a password typo? Sudo doesn't say no to people, much like UAC doesn't say "no" to people. In both cases, people (admins) are meant to say "no" when they don't expect to be performing an administrative operation. People who are not admins and yet need to do such operations need an administrator to authorise it. In both cases, if it's not a single-person system, whoever is setting the machine up should be setting up limited accounts for regular use.

jeroenhd 2y ago

In my experience (on Gnome at least), Linux is moving towards Windows-style sudo protection. It lacks the "press ctrl+alt+delete to verify" trick. Windows has the advantage that you don't need to script everything. You can wrap `runas`/`System.Management.Automation.PSCredential` around every other tool if you want to, you just don't need to in most cases.