News for hackers. Stuff that matters.

A comment on Sudo: Heap-based overflow with small passwords. Parent comment

Re:Sudo: Heap-based overflow with small passwords by candiddevmike on Friday November 04, 2022 @09:58AM (#33466766)
For desktop use, sudo let's you elevate your permissions as necessary (polkit kinda replaces some sudo stuff, but similar concept). The reason you want this is when you run anything, it will _by default_ run as your unprivileged user, not root. That is a huge security benefit and pretty standard across desktop OS these days.

Now on a server, sudo for a single user probably doesn't make sense, just use root and keep it simple.

[ Parent | on HN ]
Re:Sudo: Heap-based overflow with small passwords by portabelllaa on Friday November 04, 2022 @10:20AM (#33467116)
> That is a huge security benefit and pretty standard across desktop OS these days.

But is it really though? That's the parent was alluding to.

I have the same feelings - all my important data are readable/writeable as my user, if I somehow manages to run a malicious program as my normal user it's game over as far as I'm concerned, having root would cause no extra damage.

[ Parent | on HN ]
Re:Sudo: Heap-based overflow with small passwords by candiddevmike on Friday November 04, 2022 @01:32PM (#33470567)
Root access can be more insidious, like adding a crypto miner in the background or some other kind of virus masquerading as a system process. Your data would still be there, just silently being exfiltrated, along with your keystrokes/passwords.
[ Parent | on HN ]
Re:Sudo: Heap-based overflow with small passwords by ehutch79 on Friday November 04, 2022 @01:21PM (#33470360)
Are you suggesting running everything as root?

As in when you setup a new vm or whatnot, that you shouldn't create a user account to run thing as?

Does this include things like nginx not dropping privileges to run as a user?

[ Parent | on HN ]
Re:Sudo: Heap-based overflow with small passwords by candiddevmike on Friday November 04, 2022 @01:29PM (#33470512)
With just one user managing the server, for sysadmin tasks like SSH, use root, especially if you're going to sudo everything you do anyways. For services, they should still run as unprivileged users.
[ Parent | on HN ]