Comment by leothetechguy
13 hours ago
Wow. This never crossed my mind but of course that's so simple. There really needs to be a better solution.
13 hours ago
Wow. This never crossed my mind but of course that's so simple. There really needs to be a better solution.
There is. Simply do not install sudo and do not allow access to root at runtime. I am serious. There is absolutely nothing you cannot run unprivileged these days. Can even run sshd from a systemd user unit in your home folder, and even assign port 22 to it if needed with Linux Capabilities.
How do you update the kernel?
See my reply here: https://news.ycombinator.com/item?id=49504775
Idk why we need to use sudo to update kernel. In macos, we don't need sudo access?
Just don't be in the sudo group.
So the solution is to make your computer basically unusable. I guess that's one way to secure things.
1 reply →
But what exactly are you protecting then?
Linux root/regular-user model comes from an ancient time with multi-user architecture where you defended against one user taking over a big machine they didn't own.
But today on personal computers all the good stuff is inside regular users accounts, and there is nothing valuable to be gained by becoming root.
So the whole security model is broken, it protects the OS system files that nobody cares about, while allowing any piece of software complete access to valuable user files.
Well you of course want to sub-divide every application in user space either with gvisor or a hypervisor, like QubesOS.
If someone pwns your personal browser they should pop out into an environment where nothing exists but that browser, with no idea the work browser is in a sibling vm.
on Windows the UAC (GUI sudo equivalent) requires actual user input (keyboard, mouse) on a dialog presented in a secure way (can't be faked by malware)
UAC is only a sudo equivalent when running under a non-admin user account, at which point it's nearly as convenient to simply run admin commands from a command prompt running as a separate user, or a separate desktop session entirely.
Windows and Mac each have well thought through and secure solutions to these problems. It just doesn't exist on Linux without serious sacrifice of UX.