Timeline for sudo without password: More of an issue on Apple?
Current License: CC BY-SA 3.0
15 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 24, 2015 at 19:40 | comment | added | goldilocks♦ | I strongly recommend you don't revise it -- there's already answers here that deal with the Apple thing, etc. Write a fresh question asking what security risks this poses and what alternatives there are. You can even answer it yourself (there should be a "Answer your own question" button at the bottom of the "Compose question" page). | |
| Jul 24, 2015 at 19:37 | comment | added | bobstro | Good point, @goldilocks, and I'll revise the question (again) to emphasize the point. Again, the Apple exploit is undeniably bad, although I think offset somewhat by the fact that access is required, which requires creation of an untrusted user to be meaningful. The RPi exposure is immediate upon connecting to a network. I'm thinking of the number of RPis I'm seeing pressed into duty as servers more than home users here, although a lot of home users seem to be slapping them on the Internet without much thought to securing them. Not saying Apple is forgiven by any means! I own one. | |
| Jul 24, 2015 at 12:08 | comment | added | goldilocks♦ |
WRT your question, I think you are getting the close/down votes not because people think the pi user isn't a risk, but because of the parallel to the new OSX problem. As joan says, you'd be better to rephrase this and make no mention of that at all -- I think its relevance is perhaps that it prompted you to think about this and consider the default Raspbian configuration. Which is great, but the issue is easier to explain to others just by explaining it (without the parallel).
|
|
| Jul 24, 2015 at 12:08 | comment | added | goldilocks♦ | My answer is that it's less of an issue because it's intentional, yes, but more significantly that it doesn't have "equivalent consequences" because it is easily undone by intention. With the Apple bug, you just have to cross your fingers, watch your computer, and hope they fix it soon. That's consequences. | |
| Jul 24, 2015 at 8:47 | comment | added | bobstro | @joan: Perhaps "this community" would be more correct. I'll edit the original question (which surprisingly to me seems to be encouraged) to emphasize this is an RPF issue and not raspbian or debian or linux per se. I don't think it's incorrect to say that raspbian as provided by RPF is a popular install for new users. | |
| Jul 24, 2015 at 8:43 | comment | added | joan | @bobstro I don't think "The community" are at all okay with the insecure defaults but they are limited in their influence over the Foundation's practices. I repeat I don't think this is a Raspbian problem. It's a problem with the image built for download by the Foundation. Raspbian is based on Debian which has neither of the core failings of sudo without password and a default password which the user is not forced to change. | |
| Jul 24, 2015 at 8:32 | comment | added | bobstro | @joan: Thanks for feedback, but it's actually the perception that I'm asking about. "The community" seems OK with the fact that an insecure default is shipping with remote access enabled on a device that is clearly winding up in exposed installations. There seems to be tolerance of that when the platform is a favorite toy, which I find curious. | |
| Jul 24, 2015 at 7:45 | comment | added | joan | @bobstro Perhaps you should pose a more relevant question such as "What precautions should a new user of a Raspberry Pi take?". That would allow an answer of change your password immediately, disable the use of sudo without the need to quote a password, don't install software from any old web-site without being confident it can be trusted, etc. etc. If that question has not been asked and answered then it certainly needs to be. | |
| Jul 24, 2015 at 2:13 | comment | added | bobstro | Interesting point about certification/licensing users, although focus of RPi on "education" leaves room for debate about whether teaching security fundamentals should be part of that. So is your answer that it's less of an issue on the RPi because it's by design and not the equivalent consequences? Please refrain from lines like "in case you don't get that." | |
| Jul 24, 2015 at 1:00 | comment | added | goldilocks♦ | It is good you have brought this up to help other people understand, but it isn't a flaw in the same sense that brakes stopping a car is not a flaw just because they don't work if you don't use them. In case you don't get that, we licence drivers. But we don't license computer users the same way we don't license cake bakers; if you screw up, boo-hoo that sucks, but not in a serious way for others, so you are free to try, buy, and experiment with what you want. I presume that the Raspbian folks made a decision they would stand by. In any case, it isn't a genuine security flaw. | |
| Jul 24, 2015 at 0:58 | comment | added | goldilocks♦ | The thing about users being left "completely unaware" is certainly already an industry standard, even if it is hidden behind "tick the box to agree you agree" legalities. Has Apple made any effort to inform users about this latest vulnerability? I'm not intending to bad-mouth them, or to use their practices as a defense of anything, but just to point out that using computers does require a certain amount of literacy, and the organizations and such involved with them do not, on any scale, accept liability for your ignorance.. | |
| Jul 24, 2015 at 0:57 | comment | added | goldilocks♦ | I want to emphasize again, 1) That this really isn't a "security threat" of the same order, 2) What Apple is, as a hierarchical legal entity, vs. the realm which made the pi possible. IMO this choice was not well advised on behalf of Raspbian, but realize there's some arm's length between them and the Rpi Foundation...and between them and Debian, and Debian and GNU, and GNU and Linux. Who's responsibility is it to inform all Rpi users of this issue? They are not linux customers, or Debian customers, or GNU customers, and ultimately, not even Raspbian "customers". | |
| Jul 23, 2015 at 22:25 | comment | added | bobstro | A few points: Apple does generally provide cautions about allowing remote access. To your point on explicit, the creators of raspbian made that explicit decision, but I think many new users are completely unaware of it. Being familiar with Linux in general, I was quite surprised. Again, question is, intentional or not, what is distinction if end result is the same? As to the intended audience: Witness the questions here regarding doing things not expected of an educational device. I worry about the security impact. These things show up in workplaces or on the Internet, regardless of "plan". | |
| Jul 23, 2015 at 20:47 | history | edited | goldilocks♦ | CC BY-SA 3.0 |
added 10 characters in body
|
| Jul 23, 2015 at 20:40 | history | answered | goldilocks♦ | CC BY-SA 3.0 |