5 ms·

And that's why we should 1) switch from using "sudo some-command --some-argument" to "some-command --some-argument" in which some-command authenticates and ele

And that's why we should 1) switch from using "sudo some-command --some-argument" to "some-command --some-argument" in which some-command authenticates and elevates via polkit, and 2) configure polkit to allow the initial human user of the machine to elevate without typing a password. #2 is just a default, and special configurations can of course override it and return a configuration much like what we have today. But Jesus Christ Almighty Batman, if I'm installing Ubuntu on my laptop and I, as my regular user, want to install audacity, I shouldn't have to re-enter my password!

monsieurbanana 2y ago
Would biometrics that actually work solve the problem of the password for you? Because I'm not sure it's a good idea to not require passwords. At the very least it's a way to make people pause and ask themselves if they really want to give admin rights to whatever program they're running.
dhosek 2y ago
The problem is that any command that elevates privileges introduces a potential hacking vector so while having to enter your password or provide some other authentication at points where privileges get escalated is not an unreasonable ask.
- quotemstr 2y ago
  A command running in my usual shell context can just change my dotfiles to do whatever it wanted anyway. There's little value these days in the traditional root-user separation. You don't actually need "admin rights" to do practically anything malware might want to do.
- alwayslikethis 2y ago
  I don't think privilege escalation is a big concern on most personal systems. If you run any malicious code, even unprivileged, you're basically already screwed anyways since the code can access all of your home, upload it, delete/encrypt it, etc. https://xkcd.com/1200/ https://xkcd.com/1200/
- tadfisher 2y ago
  No, the problem is that the command elevates privileges. Installing and running software should not be an admin-level operation, because its blast radius should be limited to data under the user account (at worst). Flatpak and other sandboxing technologies solves this for the most part.
zoky 2y ago
Sounds like an opaque, finicky, and non-portable solution to a relatively minor problem.
- quotemstr 2y ago
  It's a major annoyance. The system knows perfectly well who I am. I shouldn't have to type my password repeatedly to do things the system knows I can do. The threat model no longer reflects the real world.
  - zoky 2y ago
    The system has no way of knowing who you are. It can’t tell if you’re really you, or just someone who walked by and started using your computer while you got up to go to the bathroom. If you really think the threat model is outdated, why not just run everything as root? Also, you know you can configure sudo to not ask you for a password, right? So why do you need to use a whole new framework and privilege model to basically save yourself from typing four letters?
    - quotemstr 2y ago
      The system does know who I am: the command is coming from me. An attacker doesn't need to elevate privileges to compromise me: he can steal whatever he needs without becoming root. He can replace sudo and steal my password too. The whole concept of my personal user account needing to elevate to root to make "system" changes is a relict of long-gone days of BBSes, shell accounts, and time sharing. These days, we should minimize friction between the user (almost always singular) and operation of his system. Apps, not users, should be sandboxed. I think this is another one of those paradigm shifts accomplished only after a lot of people retire.
      - dizhn 2y ago
        Most distros already sort of elevate the initial users permissions so they can use sound, reboot without a password etc. So this is certainly doable. But doing it systemwise would also allow "rm -rf /" (which is specifically guarded nowadays I know). It's just an additional step. It's also why on most distros the prompt turns red when you're root. I don't have an opinion regarding if this is the right way. I have run as root in the past too. It's been mostly fine.
varenc 2y ago
You can turn off password checking on `sudo` completely. Shamefully, I have done this in some limited contexts.
fsckboy 2y ago
>if I'm installing Ubuntu on my laptop and I, as my regular user, want to install audacity, I shouldn't have to re-enter my password! I may be overgeneralizing, or I may not. I feel like people who hate retyping their passwords (it's most of people) are impatient people apt to take other shortcuts when they can, and therefore can't either be trusted with things like C pointers. Just don't take shortcuts, life's too short for shortcuts. I retype all my passwords all the time, and I don't let my browsers remember them either. It really doesn't bother me, and a side benefit is, I never forget my passwords.

monsieurbanana 2y ago

Would biometrics that actually work solve the problem of the password for you? Because I'm not sure it's a good idea to not require passwords. At the very least it's a way to make people pause and ask themselves if they really want to give admin rights to whatever program they're running.

dhosek 2y ago

The problem is that any command that elevates privileges introduces a potential hacking vector so while having to enter your password or provide some other authentication at points where privileges get escalated is not an unreasonable ask.

quotemstr 2y ago
A command running in my usual shell context can just change my dotfiles to do whatever it wanted anyway. There's little value these days in the traditional root-user separation. You don't actually need "admin rights" to do practically anything malware might want to do.
alwayslikethis 2y ago
I don't think privilege escalation is a big concern on most personal systems. If you run any malicious code, even unprivileged, you're basically already screwed anyways since the code can access all of your home, upload it, delete/encrypt it, etc. https://xkcd.com/1200/ https://xkcd.com/1200/
tadfisher 2y ago
No, the problem is that the command elevates privileges. Installing and running software should not be an admin-level operation, because its blast radius should be limited to data under the user account (at worst). Flatpak and other sandboxing technologies solves this for the most part.

zoky 2y ago

Sounds like an opaque, finicky, and non-portable solution to a relatively minor problem.

quotemstr 2y ago
It's a major annoyance. The system knows perfectly well who I am. I shouldn't have to type my password repeatedly to do things the system knows I can do. The threat model no longer reflects the real world.
- zoky 2y ago
  The system has no way of knowing who you are. It can’t tell if you’re really you, or just someone who walked by and started using your computer while you got up to go to the bathroom. If you really think the threat model is outdated, why not just run everything as root? Also, you know you can configure sudo to not ask you for a password, right? So why do you need to use a whole new framework and privilege model to basically save yourself from typing four letters?
  - quotemstr 2y ago
    The system does know who I am: the command is coming from me. An attacker doesn't need to elevate privileges to compromise me: he can steal whatever he needs without becoming root. He can replace sudo and steal my password too. The whole concept of my personal user account needing to elevate to root to make "system" changes is a relict of long-gone days of BBSes, shell accounts, and time sharing. These days, we should minimize friction between the user (almost always singular) and operation of his system. Apps, not users, should be sandboxed. I think this is another one of those paradigm shifts accomplished only after a lot of people retire.
    - dizhn 2y ago
      Most distros already sort of elevate the initial users permissions so they can use sound, reboot without a password etc. So this is certainly doable. But doing it systemwise would also allow "rm -rf /" (which is specifically guarded nowadays I know). It's just an additional step. It's also why on most distros the prompt turns red when you're root. I don't have an opinion regarding if this is the right way. I have run as root in the past too. It's been mostly fine.

varenc 2y ago

You can turn off password checking on `sudo` completely. Shamefully, I have done this in some limited contexts.

fsckboy 2y ago

>if I'm installing Ubuntu on my laptop and I, as my regular user, want to install audacity, I shouldn't have to re-enter my password! I may be overgeneralizing, or I may not. I feel like people who hate retyping their passwords (it's most of people) are impatient people apt to take other shortcuts when they can, and therefore can't either be trusted with things like C pointers. Just don't take shortcuts, life's too short for shortcuts. I retype all my passwords all the time, and I don't let my browsers remember them either. It really doesn't bother me, and a side benefit is, I never forget my passwords.