Hacker News Reader

Comment by Jaruzel | Hacker News Reader

I literally wrote something identical just over a week ago; even called it sudo as well. Mine's in .NET as a little EXE. It's about 10 lines of code. I am not dissing this effort though. Far from it. Open Source is cool.

It's annoying that you still have to navigate the UAC dialog though - not sure how to get around that, without compromising security.

For those talking about right-click on the EXE... If you live in the command prompt, having to reach for the mouse just to elevate is irritating as hell.

View on HN

I mean, you can easily bypass the UAC dialog by duplicating the token of a already elevated process. Here is an example of this I saw before in powershell: https://gist.github.com/tyranid/9ffef5962a642d4a1bb8e4ee7e3b...

This is very cool but as someone who's not a pro with Windows API or powershell, how safe is this thing assuming a user-space process has been hijacked by an attacker?

Yes, If any malicious program is running in user land in windows, it can easily bypass UAC. But, as was mentioned when this was being discussed on reddit[0], UAC was never meant to be a fix-all security boundary.

0: https://www.reddit.com/r/netsec/comments/6e1uft/a_poc_demons...

The main point of sudo is that it eliminates the need to enter the password for a while.

Does your "something identical in 10 lines" do that?

It's obviously how I word things... :( Why are you focusing on my '10 lines' comment? It's not a competition. I only stated the line amount as it's quite a trivial problem to solve, but as others have asked - why is it not a command by default in Windows?

> The main point of sudo is that it eliminates the need to enter the password for a while.

I disagree, that's just an additional feature of it. The main point is that you can carry out admin tasks from an otherwise more restricted environment, so you only elevate your power when necessary. Otherwise, users might be tempted to always run whole sessions as an admin/root for convenience.

Reply on news.ycombinator.com