News for hackers. Stuff that matters.
Re:Local privilege escalation vulnerabilities in Linux by bombcar on Wednesday November 04, 2026 @07:23PM (#50373349)
The dirty secret is multi-user died in the 90s and privilege escalation has basically been considered table-stakes since then.
Re:Local privilege escalation vulnerabilities in Linux by tptacek on Wednesday November 04, 2026 @07:56PM (#50373614)
I think this is basically true, but it didn't "die" in the sense that we gave up on it; it just never worked. Systems software was much worse in the 1990s than it today; you could breathe on something with a string of AAAA's and get a 0x41414141 register core dump.
Re:Local privilege escalation vulnerabilities in Linux by blooalien on Wednesday November 04, 2026 @08:46PM (#50374029)
> ... it didn't "die" in the sense that we gave up on it ...

It died in the sense that the "people in charge" hired us for our expertise and then ignored our every suggestion and fought us tooth and nail every inch of the way when we suggested that security or reliability ever mattered in the slightest until after the disaster happened, and then straight-up scapegoated us for "not pushing back harder" against the threats of "go work somewhere else then, code-monkey!" until we gave up and did the "code-monkey" thing for our paycheck and no longer cared about quality or "a job well done".

Re:Local privilege escalation vulnerabilities in Linux by bombcar on Wednesday November 04, 2026 @09:17PM (#50374278)
It died because personal computers got too powerful so nobody bothered designing and building “true” multiuser systems (that bored college students were trying to break).
Re:Local privilege escalation vulnerabilities in Linux by dolmen on Thursday November 05, 2026 @08:57AM (#50379114)
s/trying to break/casually breaking/
Re:Local privilege escalation vulnerabilities in Linux by hibikir on Wednesday November 04, 2026 @08:34PM (#50373929)
Back in the 90s, it's not as if any semi competent cs student couldn't slice your typical college server like swiss cheese. People thought null terminated strings were fine back then, and patching everything immediately was rare. So multi user was already dubious.
Re:Local privilege escalation vulnerabilities in Linux by petesergeant on Wednesday November 04, 2026 @11:56PM (#50375379)
If memory serves, we were also still also using telnet and broadcasting passwords in the clear for almost all network services.
Re:Local privilege escalation vulnerabilities in Linux by dTal on Thursday November 05, 2026 @08:27AM (#50378816)
We keep paying ever higher architectural prices for system isolation: user accounts, memory protection, unix permissions, capabilities... and it's all for nothing, when a determined program can almost always escape its sandbox. Should we just give up and assume that all software on a machine is cooperative and non-malicious, and just do our best to make sure we don't run malware in the first place? "Defense in depth" soon slips into "don't worry too much about this layer, the next layer will catch it.

tl;dr Just run as root bro, focus on the exterior attack surface, and don't download random crap.

Re:Local privilege escalation vulnerabilities in Linux by 0xDEAFBEAD on Thursday November 05, 2026 @09:59AM (#50379912)
[delayed]
Re:Local privilege escalation vulnerabilities in Linux by umbra07 on Thursday November 05, 2026 @03:31PM (#50384079)
> so LLMs will refuse to decompile it.

Doesn't that just give away the entire game?

Re:Local privilege escalation vulnerabilities in Linux by pianopatrick on Thursday November 05, 2026 @12:20PM (#50381723)
I heard a story that before there was the internet, when various defense labs with computers wanted to send data to each other they would load the data onto a drive and then send it over to the other defense lab using a truck and a couple armed Army guys.

That seems like it would still be secure. These days you could even encrypt the drive...

Re:Local privilege escalation vulnerabilities in Linux by bombcar on Thursday November 05, 2026 @03:27PM (#50384040)
This is also from the era (and probably still true today) where it is easier as a mid-level dude in the Army to get an armed escort to another location than it is to get permission to mail something USPS.