• LainTrain ( LainTrain@lemmy.dbzer0.com ) 
    50·
    2 years ago

    If you make users sign in too much, they will just make their passwords short and easy to remember, even 24hrs is too much and people bitch about it all the time, especially since we have password managers enforced, meaning every time they need to Auth they need to Auth into their system, Auth into their password manager, copy the password, auth into their phone, look at the 2FA code and type that in.

    Doing this every day just to open email is understandably fucking enraging even to me as a security “”“engineer”“”/analyst/${bullshitblueteamemailreaderjob}

    Press it harder and they will use simple passwords that will inevitably be passed through to something external (e.g. cockpit which even I can bruteforce) or reused somewhere at some point, and then someone just has to get lucky once and run whatever run0 sudo su to bypass all protections.

  • exu ( exu@feditown.com ) English
    29·
    2 years ago

    I might try run0 for fun, but I don’t think it’ll replace sudo any time soon.
    The biggest issue I see is run0 purposely not copying any environment variables except for TERM.
    You’d have to specify which editor to use, the current directory, stuff like PATH and HOME every time you run a command.

  • Kaity ( Kyatto@leminal.space ) English
    11·
    2 years ago

    As it is running sudo with a long process is annoying missing and having to reenter my password or missing and the process timing out if I go afk to wait, I can’t imagine having to type my password every few moments when I run an upgrade. Surely this is not the pitch. This is already looking dead in the water if so, and god help me if I have to remember to type run0.

  • mexicancartel ( mexicancartel@lemmy.dbzer0.com ) English
    9·
    2 years ago

    su is the best. I mean, i should be using the admin (root) password for admin things, not the user password of user who is already logged in. And there needs to be a root service already running to make user have root previlages which is dumb imo. Sudo vulnerability could cause previlage escalation but if there is no root process managing this, then it can’t leak the root access. Only kernel security issue(or other root processes) will leak root access if that was the case, which i think is better.

    • Cryxtalix ( Cryxtalix@programming.dev ) 
      4·
      2 years ago

      The permission to do admin things is given by the root user, to your account. So you have to verify your identity by entering your password.

      Isn’t that how it is? I though that was analogous to how almost everything worked IRL. Whether withdrawing funds from a bank or engaging government services, you prove your identity as a customer/citizen to get the relevant services. At no point do you login to bank or government computers with full privileges.

      • mexicancartel ( mexicancartel@lemmy.dbzer0.com ) English
        2·
        2 years ago

        If you own your own bank, then i think you login as the one with full previlages. Yes when doing administrator things, you have to use sudo. The problem with root with sudo is, you authenticate as a user, then gain full permission from root, i.e analogous to login in to bank with full previlages.

        As a person who need to run sudo command its better to just verify yourself as root user to gain “full access”. I’m not saying about partial previlages. That is i just need a script which is just su -c with environment variables being copied

      • electricprism ( electricprism@lemmy.ml ) 
        2·
        2 years ago

        My complaint was mostly targeting the big picture of everything living in /bin/

        I inferred the ‘user 0’ thing to their credit like you, it just still felt really strange as numerals are kind of a no no when programming – you can’t begin variable and other names with them and I guess having them as a suffix feels strange too as it’s not common practice.

        It will definitely be the only utility I recall that uses a numeral.

        To me the whole numeral systems are archaic, User ID numbers don’t line up when transferring data from hard drives from another machine eg 1000-1005.

        The numeral permission system is archaic and requires explicit knowledge to know the difference between a 7 6 and 4. In GUI Immutability is separate when it should be more integrated as a file control. The octal permissions are from another decade and modern platforms have permissions on whether a executible can access the internet, access input devices like camera or microphone, or sensitive data like contacts, pictures, etc…

        I think file tagging should be greatly expanded, IDv3 meta data for example was a workaround for the limitations and the core filesystem should have robust enough tagging to make it unnecessary.

        I’ll be controversial now – eliminate the . prefix to hide files. Yes I know it had been this way for decades and was grandfathered in as a feature after a bug, that should have been in the filesystem properties like chattr +I and you shouldn’t need .hidden indexes to hide files just like windows and osx litters zip files with MDF or inf or whatever (memory is fuzzy from non use).

        Some people say “4 character” limit, that needs to go too – FHS naming structure is confusing and not self evident what it does to people trying to learn who already have IT training. /etc/ having 2 or more bins /bin vs /usr/bin – ‘what does usr mean the new it ponders’ ‘oh it must mean ‘user’ I guess’. – weird stuff like that.

        To systemd credit they have no problem being controversial and relentlessly persuing their vision in a practical way, hell I use their stuff hapilly.

        I just feel like the run0 thing is a band aid on bigger problems, and AI critique would be very fascinating to make these human interfaces you know… more for us humans :P

        If not systemd, maybe the rust people or someone else will be baller enough to try to tackle these funny ackward quirks that have accumulated over the years and straighten it all out.