Message-Id: <200908281120.09494.prb@lava.net>
Date: Fri, 28 Aug 2009 11:20:09 -1000
From: Peter Besenbruch <prb@...a.net>
To: "full-disclosure@...ts.grok.org.uk" <full-disclosure@...ts.grok.org.uk>
Subject: Re: [Fwd: Re:  windows future]

> > The OS on my machines will not allow a person to run an administrative
> > desktop. It enforces the separation between the administrator and a
> > normal user by requiring the creation of at least one normal user at
> > install. Only that normal user can log in.

On Friday 28 August 2009 09:30:26 Thor (Hammer of God) wrote:
> Oh, now that's cool.  I didn't know that.  The "force to create a normal
> user and only use that" was not something I was aware of.
>
> What's the OS?  So, even if you wanted to, you couldn't log on as
> administrator and just do whatever you needed to?  I'm not sure if I like
> that, but I assume this is customizable behavior, yes?

The OS is Debian Linux. Virtually all behavior in Debian is customizable, but 
you would have to look look long and hard to find a Debian user who would 
want to allow logging into an administrative desktop. You may become 
administrator in a terminal or shell. All administrative tasks can be run 
from the shell (sometimes called the command line in Windows) in Linux. On a 
graphical desktop, programs may be run as administrator; they provide a login 
prompt before the program will execute. Programs relying on the X server 
(that's the underpinning for the graphical interface) cannot be launched from 
an administrative shell by default. At the very least, remote administrators 
are blocked from doing that.

Finer controls are available for normal users. Linux (and other Unixes, I 
assume) assigns users to groups with names like cd-rom, tape, sudo, and 
backup. Assigning a normal user to these groups allows limited extra rights. 
I understand Windows also has similar fine grained controls. My point is that 
at least some Linux distributions lock things down more by default. The major 
distributions all do. That's a good thing. That makes the OS a more hostile 
malware environment by default. That and the more diverse environment that 
Linux presents, means that Linux desktop users will probably never have to 
worry much about malware infections. 

One distribution catering to Windows users (initially called Lindows, then 
Linspire) set their distribution up the Windows way (making the administrator 
the default user). They caught hell for it. Mercifully, they are defunct.

Microsoft's defaults created an environment where software houses assumed you 
ran with full privileges. A lot of productivity and game software required 
being an administrator to run. Back in my Windows 2000 days that was a huge 
problem. I don't know if the problem remains today, but I ran across it with 
a multi-platform program called RawTherapee under Linux. It writes its 
configuration files where it's installed, not to the user's configuration 
area. That means running it as an administrator, or installing it to one's 
home directory (the Windows equivalent is "Documents and settings"). Not 
good, especially if you set the home directory to refuse all executable 
files. Clearly the author of the software used Windows first, and assumed 
that all users would run as administrator.

> Absolutely - and I learned something about other default options on other
> OS's too ;)

Now if we can only teach people that there is no fortune to be made off the 
transfer of funds of defunct African dictators. Piece of cake. ;)

-- 
Hawaiian Astronomical Society: http://www.hawastsoc.org
HAS Deepsky Atlas: http://www.hawastsoc.org/deepsky

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists