Sadly this is not complete protection. Many Linux distributions configure sudo to prompt for the password only once every 15 minutes or so. If you have successfully executed sudo in your terminal within the last 15 minutes, any malicious code that you run can silently escalate its privileges to root just by starting with "sudo -i;".

You need to have the following in /etc/sudoers in order to be truly protected by not being logged-in as root:

    Defaults timestamp_timeout=0

I always thought this concept to be silly unless you are a sysadmin.

For most people who are not sysadmins losing ~ is much worse than losing /. Go ahead and wipe my OS, I just care for my photos to be safe.

Could you please tell me in which directory your ~ directory is and in which directory that directory is?

You either enjoy pointless nitpicking or have entirely missed my point.

No, he did not: typing rm -rf / into a root shell will delete the OS and your home directory.

It is a little more complicated than that, but the complications do not really affect very much. Last time I installed Debian around 2005 the documentation encouraged me to give /home its own partition, in which case rm -rf / will not get it. But on OS X the default is to put everything in one big partition and I kind get the feeling that Linux has moved that way, too. And even if /home is on its own partition, there are many ways for the malefactor to get /home, e.g., rm -rf /home.

Yes, you both did. To a user losing / is just as bad as losing ~, because ~ is all she cares about, not her OS settings, hence why I think the idea that running as root is worse than running as an unprivileged user is silly in this context.

They are effectively the same: an unknown script executing "rm -rf ~" with an unprivileged user is going to cause as much grief as root running "rm -rf /".

I couldn't care less that the system is still up if all my data is gone.

Also, I believe “rm -r” traverses mount points.

at a place I used to worked they aliased rm to rm -i by default. It was kind of annoying but we all knew why they did it.

Not to mention that it's sysadminny-types that you turn to when your OS is hosed and you want to recover data from your drive - having little or no sysadmin skills means recovery and reinstall is very much not trivial.

Even if you're not root, if you're having trouble setting something up (which is why you're copying things off the web in the first place), you likely have a fresh sudo timestamp, so the attacker could become root anyway.

True, though not very comforting since it's presumably running in a shell that has access to all your files and is where you do all your work.

I think that's bad advice: you would likely be running as your user account, the one owning all your important data.

Well, if I had really wanted to build a serious attack instead of a harmless PoC, I'd have downloaded a second stage via `curl <url> | sh`, and that script would, for example, set aliases in your shell for `su` and `sudo` that call the real commands but log your password in the background. Unless you're using requiretty, of course, but I don't assume that you're using a real tty.