Yeah ok, but then a) the software should probably not run under root. In fact it should probably not run at all, if you haven't done any kind of audit on it/the

Yeah ok, but then a) the software should probably not run under root. In fact it should probably not run at all, if you haven't done any kind of audit on it/the developer. And b) assuming you have done your due diligence on the developer in the first place, why not trust him with access to your machine? And again - you shouldn't grant him root of course, but a shell account with privileges similar to the application would be fine. But really - Purchasing a script from some back-alley developer you have no knowledge of and placing it on your production server? That's the reckless part.