[ale] Sunday 05-22-05 6PM RUN-AS-ROOT CHALLENGE

[Jason Day]

On Thu, May 19, 2005 at 01:54:39PM -0400, Jim Popovitch wrote:
> On Thu, 2005-05-19 at 10:59 -0400, Jason Day wrote:
> > On Wed, May 18, 2005 at 08:19:11PM -0400, Jim Popovitch wrote:
> > > On Wed, 2005-05-18 at 19:10 -0400, Michael B. Trausch wrote:
> > > >
> > > > You completely ignored the "if not root, software is harder to install
> > > > and viruses which attack the OS are harder to catch and such things are
> > > > harder to propegate".
> > > 
> > > I didn't completely ignore it, I just don't think it is relevant.  If a
> > > virus can "attack" anything in /home/user that is already a much worse
> > > situation.  If something "owns" /bin/ls I've already got worse problems.
> > > The fact that the virus could make it to /home/user (where user UID=0 or
> > > UID=10001) is the problem to solve, not saving the rest of the (already)
> > > sinking ship at that point.
> > 
> > This is the point I've tried to make over and over that you completely
> > miss.  
> 
> I haven't missed it, I've just focused on the real issue. ;-)

No, you've missed it.  Completely.  Again.  What I'm trying to explain
to you, again, is that the user's data is *not* the only thing that
matters.  There are other things to consider.

> > Your argument is that to the user, the data is the only thing
> > that matters.  
> 
> BINGO!

You say that like it's some kind of revelation, or something.  I've
recognized, from my first post to this thread, that you think the user's
data is the only thing that matters.  I just don't agree with you.

> > My argument is that the user has (or, in reality, should
> > have) an obligation as a "net citizen" to properly secure their box and
> > prevent the spread of malware.
> 
> The are not mutually exclusive.  User data can be destroyed via root or
> non-root.

Where are you going with this?  I never said otherwise.

> Net citizenship is a whole other discussion, and not really

No, that's my counter claim.  Users who are connected to the internet
with an always-on connection need to worry about more than just their
data.  Like, for instance, whether their computer is sending thousands
of spam messages, or trying to spread a worm.  Some ISPs even take the
same position, and have started disconnecting compromised computers.

> even a user one.  Everyday people (the ones still needing to adopt
> Linux) with computers don't think of themselves as net citizens.

No, they don't.  And that is a problem.  Maybe more everyday people will
get their accounts suspended because of malware.  Maybe then they will
start thinking of themselves as net citizens.

> > In your view, a user can become infected with malware that turns their
> > box into a spam relay, a drone in a distributed botnet, a repository for
> > illegal porn or software, but as long as the user's home directory is
> > untouched none of that matters.  Users can remain blissfully unaware of
> > how their computers are used for nefarious purposes, because their data
> > is left alone.
> 
> You are mixing apples w/ oranges and producing a fruity argument. ;-)

How, exactly, am I mixing apples and oranges?  You claim that the user's
data is the only thing that matters.  I disagree and point out several
more things that matter, and the only response you can come up with is
that I'm mixing apples and oranges?

> > > > This is also fact.
> > > 
> > > Yes, but not one that applies.
> > 
> > Finally, you admit that the spread of malware is made more difficult as
> > non-root.  
> 
> No.  Malware is spread via non-root means every second. i.e. SPAM,
> phishing scams, viruses.  None of those require "root".

Read that sentence again.  It's right there: "more difficult".  6 lines
up.  I never said the spread of malware *requires* root.  I said it's
more difficult without root.  Actually, Michael said it and you agreed
with him.

> ;-) so with a user account you think you can cause havoc?  Who's
> argument are you advocating?

First, I've never once claimed or even hinted that you must be root to
cause havoc.  I have said, over and over again, that it is much easier
to cause havoc as root.  Second, who said I want to cause havoc?  I just
want to use your bandwidth.  As long as I don't touch your data, that's
ok, right?

I'm done with this thread by the way.  It's clear that you don't care
about the merits of your argument, that you're arguing just for the sake
of arguing.  I'm sure you'll reply to this message anyway, because it
seems that you just can't stand to let anybody else get the last word.
-- 
Jason Day                                       jasonday at
http://jasonday.home.att.net                    worldnet dot att dot net
 
"Of course I'm paranoid, everyone is trying to kill me."
    -- Weyoun-6, Star Trek: Deep Space 9