Comment by jchw | Hacker News Reader

Comment by jchw | Hacker News Reader

Sigh. It's disappointing to hear that this is the default in Ubuntu Server. As long as I'm understanding it, it doesn't appear to be an immediate concern, but it does demonstrate that the security design is quite a bit half-baked at least in this specific area.

I don't think every Linux distribution needs to aspire to be as proactive about security as OpenBSD, but it would be nice to see better care put into features like this to make sure they're restricting capabilities as expected, with at least more than one mechanism protecting the system from compromise.

Unfortunately my kneejerk reaction is to assume that most of the work on Ubuntu Server is going into development of Snap-based Ubuntu Core, wherein the security model is completely different and none of this applies, perhaps? But a ton of people deploy ordinary Ubuntu Server today, possibly more than Core... so that doesn't bode well.

(OK, maybe I really do just want OpenBSD.)

edit: Wait a minute. This post says "brand new", which made me think this was stock configuration. However, is it? I would feel immediately relieved, and my entire comment would be irrelevant, if that wasn't the case.

The post doesn't do a good job explaining whether this is the stock configuration or purely a hypothetical. My initial reaction was the same as yours, but upon further reflection I get the feeling it's just a thought exercise.

Not stock in 23.10, as far as I can tell.

I'm a bit miffed that people are getting downvoted for not realizing this is not the default behavior, when I have no idea how you were supposed to gather that from reading the article. I did actually check to see (in Ubuntu 23.04) but honestly, that doesn't clear up much given that I have no idea what different installation modes of Ubuntu may yield.

Yeah, it's fair enough that it completely negates all of the points to be made about distro security, but also, it's not really our fault that the article is unclear.

People don't get downvoted. Posts get downvoted, sometimes for inaccuracy. Tough break.

Yeah, nobody really cares about the dumb number next to the posts anyway. What's actually annoying is being misunderstood, because the article seems to have produced mainly two comments:

1. "That's a pretty bad default." (it would be, after all.)

2. "That scenario is quite contrived."

The former is just a misunderstanding, but I think the reason why it happened is simple: the article is written in a way that doesn't really make it clear whether it is a condition they added or a condition they observed. On the other hand, giving someone the benefit of the doubt, I personally assumed that it was unlikely someone would intentionally add this, since it's, well, you know... Quite contrived.

I think I understand the purpose now (it's intentionally contrived, merely for practice with probably a less contrived setup in the future) and I hate to be overly harsh on the article, since it's perfectly fine for someone's personal blog, but when I see something on HN's frontpage, I generally have some expectation for how interesting it is. After all, plenty of genuinely very interesting things die in new, why would this make it out? Alas, sometimes it just happens.

My takeaway from reading all this is that there is no reason this article should have made it to the front page of HN, as all it did was create confusion and burn 10 minutes of my time trying to clarify what was happening. Nothing about this article or the discussion it has created is interesting, just frustrating.

"Please don't comment about the voting on comments. It never does any good, and it makes boring reading."

https://news.ycombinator.com/newsguidelines.html

It's also a bit disingenuous to make a third-person reference to your own post ('people are getting downvoted').

I don't think it's really fair to say that this has anything to do with Ubuntu Server at all, or that it reflects on Ubuntu's security. After all, this issue only occurs if you decide to enable a sudo command for a user and, if you're doing that, it's on you to understand the risks; risks which you'd have to take into consideration regardless of the distro.

For example, if I told you that I've identified a security risk in giving sudo access to a user for the command "rm -rf /", would you conclude that Ubuntu is an insecure distro?

If Ubuntu Server shipped with a configuration out of the box that let a user run 'sudo rm -rf /' _by default_ then yes, I would conclude that Ubuntu is an insecure distro.

Would you not?

The missing context is that I misinterpreted the article to mean that this sudoers rule was here by default. It's not... which makes this an entirely different story. I had an inkling that this was the case, but I was too busy to verify personally and by the time I had actually realized, it was too late to delete/edit the comment.

Which makes this whole thing annoying. The article shouldn't be flagged, because there's nothing technically wrong with it. I just found it confusing, and I wonder if maybe part of the reason why it was deemed interesting enough to be propelled to the frontpage is due to similar misinterpretation. (After all, I would find it VERY interesting if this WAS a default.)

Reply on news.ycombinator.com