If you're not in the user community of a tool, having an opinion on whether or not the replacement should work doesn't seem like it should matter to you at all.
With NOPASSWD you would also invite someone pulling a `.deb` via `curl` as part of a supply chain attack in a some non-descript NPM package via a git hook or something.
If you're not in the user community of a tool, having an opinion on whether or not the replacement should work doesn't seem like it should matter to you at all.
The complexity of tools and the associated danger absolutely matters.
What are you doing wrong?
Like.... apt-get?
`sudo apt install my-custom-backdoor-script.deb`
With NOPASSWD you would also invite someone pulling a `.deb` via `curl` as part of a supply chain attack in a some non-descript NPM package via a git hook or something.
So you want users to be able to install any package? So that the attack surface is now literally all the Debian archive?
Yeah, no.
You either use `sudo` when you want full root access or for something completely trivial.
My sudoers is set up to let me run update and upgrade (with no args) without a challenge, but not install.
1 reply →