Hacker News Reader

Comment by jjcm | Hacker News Reader

His entire blog post is based on the assumption that linux wouldn't have as much malware - however keep in mind that the greatest risk to a system is the user themselves. It doesn't matter how hardened the system is or how many protection schemes are built in, if you have a pop up telling the user "ENTER YOUR ROOT PASSWORD AND WIN $$$ NOW!" eventually someone is going to do it.

At some point users will cry out for a system that doesn't require a password to install stuff, and someone will react to provide that product to the market.

Remember that there's a lot more to computer security than computers.

View on HN

No need for root password, user privileges are fine for typical malware.

On most popular systems, $HOME is mounted without noexec, and programs are not isolated from writing everywhere in $HOME. Then all the malware have to is to alias sudo to itself (or hijack it with SUDO_ASKPASS, huh) and wait.

It should be noted, though, that GNU/Linux is one step ahead — when those holes will be exploited in the wild, distro builders will start putting browsers in sandboxes, enabling AppArmor/SELinux/... by default, perventing from running executables from $HOME and whatever would be required. Everything is here, just disabled for users' convenience, trading less security for more usability.

Uh, in fact, the malware is already here. Just take a peek at /var/log/auth.log (or wherever you're getting sshd messages). Unless you've set up denyhosts or something alike, you'll see lots of attempts to log in with various typical usernames and passwords. And somewhere in the world, those attempts surely succeed.

Agreed, though there's still something to be said about strong default settings.

And there's a huge difference between something asking for a password than something installing something drive-by without any notification whatsoever. From a social engineering perspective, it's a lot harder to get someone to enter a password than it is to get them to simply click on something.

Yes, there'd still be malware because of stupid users, but there'd be a lot less of it.

this is where package management is great. The user that will enter their root password to win $$$ is also the user who is way less likely to open up a config file and add an untrusted repo. Not to mention the benefit of automatic software updates. The iphone appstore has already trained users to use what is essentially a package management system (without the option to add other repos).

Once the program has sudo privileges, it can pretty much add a pirate repo (or replace an official one), changing crypto keys and so on...

OTOH, Linux users don't google program names and download executables they run as admins from the first hit they get.

> "ENTER YOUR ROOT PASSWORD AND WIN $$$ NOW!" eventually someone is going to do it.

None of my Linux boxes has a root password.

"ENTER THE PASSWORD THAT LETS YOU DO STUFF AND WIN $$$ NOW"

You do understand your plan is getting less and less likely to work, right? If it doesn't work on Macs why would it fare better on Linux?

Are you saying there's no malware for Macs?

While I understand there is some malware that runs on OSX (as there are on Linux and even on *BSD), it's nowhere near what could be considered a huge problem.

I never saw one, BTW.

I don't know many dudes name Katherine.

Personally, I tend to use "he" if I'm going to tear apart a poorly written or researched tech article, because using "she" might call attention to the gender of the author which might be misinterpreted as an ad hominem. In fields where there isn't a large mismatch between the number of men and women, I'd check the name and use "he" or "she" depending on my guess as to which is more likely based on the name.

Reply on news.ycombinator.com