5 ms·

At work I'm required to use a locked-down Windows 7 machine, which has antivirus software I can't disable. (I would disable it if I could.) At home I use Linux

by teach 13y ago

At work I'm required to use a locked-down Windows 7 machine, which has antivirus software I can't disable. (I would disable it if I could.) At home I use Linux and do not use antivirus software. I also always log in as root. I like to live dangerously. :)

dlitz 13y ago
If you read about the technical implementation of the AV software that's been analyzed, you might not think it's that dangerous after all: http://www.cso.com.au/article/441070/google_security_researcher_keep_sophos_away_from_high_value_systems/ http://www.cso.com.au/article/441070/google_security_researc...
pwnna 13y ago
> I also always log in as root. I like to live dangerously. :) Man... I cannot even begin to express how bad this is. Especially if there are drive-by attacks.
- toomuchtodo 13y ago
  Running as a privileged user protects other users and the OS, not you. If code runs as you, it has access to your data, your cookies, your cache, etc.
  - state_machine 13y ago
    Protecting the OS does protect you: stealing my data/cookies today is different than installing OS level backdoor / keylogger and stealing my bank password, tax prep, etc next month/year/etc.
    - Vektorweg 13y ago
      So, installing a backdoor / keylogger in user level isn't that bad? why?
    - toomuchtodo 13y ago
      If they've stolen your cookies, they can already login as you. The keylogger is already going to run in user space, as you. You don't need to compromise root/a privileged user in order to get the keys to the kingdom. Once I've compromised whatever user your browser environment runs as, mission accomplished.
tlarkworthy 13y ago
its really not a big deal to type sudo when installing stuff. Also if you have any hope of dealing with servers in the wider world, you want to shake that habit pronto (and learn ssh keys). Also your ironically complaining you can't disable your anti-virus software, but the fact is you have a sloppy approach to security that your IT department is protecting everyone in the company from.
- teach 13y ago
  I only stay logged in as root on my personal server. For more public servers I of course disable password logins, ssh in using a key file, etc. (I wonder what about my post makes you think you should talk down to me and make (incorrect) assumptions about my approach to security?)
kunai 13y ago
> I also always log in as root. I like to live dangerously. :) Noob mistake. Never log in as root. Isn't sudo enough for you?
- teach 13y ago
  Why on earth would I "never log in as root"? And I'm pretty sure it's not a "noob mistake" if I've been using Unix since 1994.
  - NateDad 13y ago
    Because then any malware that gets installed by you (or a program you run, like, say, your browser) has root privileges. If you were not logged in as root, anything running as you would not have root privileges and therefore would have much less power to ruin your computer. It's not a controversial statement. It's security 101. Hell, even Windows Vista implemented the same strategy once Microsoft realized logging in with admin rights was a bad idea.
    - teach 13y ago
      I'm logged in as root to a headless server that doesn't even run a GUI. I pretty much only install software from the Ubuntu repository. The server is only used by me. I think it's okay if I log in as root if I want.

by teach 13y ago

dlitz 13y ago

If you read about the technical implementation of the AV software that's been analyzed, you might not think it's that dangerous after all: http://www.cso.com.au/article/441070/google_security_researcher_keep_sophos_away_from_high_value_systems/ http://www.cso.com.au/article/441070/google_security_researc...

pwnna 13y ago

> I also always log in as root. I like to live dangerously. :) Man... I cannot even begin to express how bad this is. Especially if there are drive-by attacks.

toomuchtodo 13y ago
Running as a privileged user protects other users and the OS, not you. If code runs as you, it has access to your data, your cookies, your cache, etc.
- state_machine 13y ago
  Protecting the OS does protect you: stealing my data/cookies today is different than installing OS level backdoor / keylogger and stealing my bank password, tax prep, etc next month/year/etc.
  - Vektorweg 13y ago
    So, installing a backdoor / keylogger in user level isn't that bad? why?
  - toomuchtodo 13y ago
    If they've stolen your cookies, they can already login as you. The keylogger is already going to run in user space, as you. You don't need to compromise root/a privileged user in order to get the keys to the kingdom. Once I've compromised whatever user your browser environment runs as, mission accomplished.

tlarkworthy 13y ago

its really not a big deal to type sudo when installing stuff. Also if you have any hope of dealing with servers in the wider world, you want to shake that habit pronto (and learn ssh keys). Also your ironically complaining you can't disable your anti-virus software, but the fact is you have a sloppy approach to security that your IT department is protecting everyone in the company from.

teach 13y ago
I only stay logged in as root on my personal server. For more public servers I of course disable password logins, ssh in using a key file, etc. (I wonder what about my post makes you think you should talk down to me and make (incorrect) assumptions about my approach to security?)

kunai 13y ago

> I also always log in as root. I like to live dangerously. :) Noob mistake. Never log in as root. Isn't sudo enough for you?

teach 13y ago
Why on earth would I "never log in as root"? And I'm pretty sure it's not a "noob mistake" if I've been using Unix since 1994.
- NateDad 13y ago
  Because then any malware that gets installed by you (or a program you run, like, say, your browser) has root privileges. If you were not logged in as root, anything running as you would not have root privileges and therefore would have much less power to ruin your computer. It's not a controversial statement. It's security 101. Hell, even Windows Vista implemented the same strategy once Microsoft realized logging in with admin rights was a bad idea.
  - teach 13y ago
    I'm logged in as root to a headless server that doesn't even run a GUI. I pretty much only install software from the Ubuntu repository. The server is only used by me. I think it's okay if I log in as root if I want.