Root as Primary Login: Why Not?

A user writes, "I help moderate a forum dealing with Mac OS X, and I'm having an awful time convincing a fair portion of our readers that logging in as root all the time is a Really Bad Idea. Worse, though, are the ones who try to convince others to log in as root all the time, claiming it's 'more Mac-OS-9-like,' or saying 'it's not really more insecure,' or even that 'a firewall should deter hackers pretty well.' I know all the standard arguments, but they're not working out. Does anyone here have some real-world anecdotes that I can point to?"

Comments

Why i have to log in as root.

[m_evanchik]

I'm a newbie and I always initially log in as root because that's the only way I can get adsl-connect going. I guess maybe I installed it as root, because it doesn't show up or run when I log-in as a regular user. Not a big deal but it is annoying to have to log in as root to get online and then to log out and log back in.

Re:Why i have to log in as root.

[brunson]

If it needs root access to devices, which it almost certainly does to ifconfig an interface up, it should be installed suid root (if safe). Also, sudo is a great utility for doing things as root, does it come installed by default?

Re:Why i have to log in as root.

[lexarius]

Well, you could have a script run at boot time to connect the adsl, or one that is set to run as root no matter who runs it.

As for the original poster, I don't know what to say. In OS X root still has to give his password for authentication screens. The only convenience I can really see it having is to mess around with system libraries and configuration files unchecked. Oh yeah, thats right. Most unices aren't very vulnerable to virii because the user isn't root, so the virus can't get at the important things. The most a trojan could do is take out your home directory. Your system would still run.

Of course, logging in as root makes the system slightly more vulnerable to local attacks, but that isn't saying much.

Cmd-S during boot-up.
fsck -y
mount /
SystemStarter
passwd root

System compromised.
But thats a feature. I think it can be disabled, possibly by supplying an OpenFirmware password... auto-logging in as root sort of ruins that, though.
If people want security similar to Windows, tell them to run as root. OS9 is somewhat more "secure" than OSX because it was meant to be stupid-proof. Running as root in OSX is like telling the computer you really know what you're doing. If you don't, you shouldn't.

Re:Why i have to log in as root.

[foobar104]

Also, sudo is a great utility for doing things as root, does it come installed by default?

Yup, sure does. As far as I know, it's been there since forever. At least since 10.0.3, which was the earliest version that I used regularly.

Re:Why i have to log in as root.

[foobar104]

I'm on a crusade. I intend to post a comment like this one whenever I see anybody use "virii." Please don't interpret this comment as either endorsement of or disagreement with the parent post. Moderators: with your help, we can wipe out "virii" in our lifetime!

The plural of "virus" isn't "virii." There is no such word. The plural of "virus" is "viruses."

Here's a good explanation from cdknow.com, quoted here in its entirety because the people who most need to read this won't click on a link.

The correct English plural of virus is viruses. Please consult any good dictionary before making up words.

For the purists, in Latin, there is a rarely-used plural form:

virus, viri (neuter)

(Forms: almost always restricted to nominative and accusative singular; generally singular in Lucretius, ablative singular in Lucretius)

The point of this is that even in Latin the form "viri" is rarely used. The singular form is used in most every instance. (This is from the Oxford Latin Dictionary.)

So, when considering the Latin: "virii" is incorrect and "viri" was almost never used.

Despite the fact there was little use for the plural form, there is another reason why "viri" was rarely used. The most common Latin word for "man" is "vir" with "viri" being its plural in the form used as the subject of a sentence. Thus, since "men" as the subject of a sentence would be used far more often than "venoms" (virus means venom) the "viri" word was most commonly seen as the plural of "man."

Bottom line: Don't try to make up words using a false Latin plural form. Since the word virus in its English form is now used then the English plural (viruses) should be used.

More plural-of-virus resources:

perl.com, the canonical and exhaustive source
The alt.comp.virus FAQ
Jonathan de Boyne Pollard's Frequently Given Answer
Merriam-Webster's "Word for the Wise," January 20, 2000.

Re:Why i have to log in as root.

[reverius]

Yeah, well, it's 'net speak. You don't see anyone trying to eradicate the usage of "boxen" (even though "boxes" is the proper plural of "box").

I say let it go.

-- The Great and Powerful Reverius has Spoken

Re:Why i have to log in as root.

[BtAFMB]

You wouldn't think someone with a name like foobar104 would get so hot and bothered about the creative use of language.

Re:Why i have to log in as root.

[Permission Denied]

Well, you could have a script run at boot time to connect the adsl, or one that is set to run as root no matter who runs it.

OS X, like most unices, doesn't honor the set-uid bit for scripts.

I would just write a trivial C program and make that set-uid:

#include <unistd.h>

#define ADSL "/path/to/adsl-connect"

int main()
{
execl(ADSL, ADSL, NULL);
return 1;
}

On OS X, install dev tools, compile as "cc file.c -o my-script" and then "chmod 4755 my-script". You can then run it from a normal user shell and the script is run as root (make sure the file is owned by root).

NB: I'm not replying directly to you, but rather to the original poster who wanted to know how to do this.

Re:Why i have to log in as root.

[Permission Denied]

because it doesn't show up

Nobody has yet replied to this point (subtle, this is easy to miss unless you've worked with people).

This is because adsl-connect is probably not in your PATH (I'm guessing it's in /sbin or /usr/sbin). You can do a 'man bash', hit the '/' key, type in PATH and keep typing 'n' until you find the entry in the manual page explaining how PATH works.

Short story: type in the following:

su -
which adsl-connect

Make sure to type in the dash in the 'su' command. The second command should tell you exactly where adsl-connect is, and you can go from there.

Re:Why i have to log in as root.

[Anonymous Coward]

I have seen several people trying to get rid of boxen.

Yo sur is smart der missa reverius.

I don't think we should let the language run rampant. I don't mind slang, expressions, etc. but the farther you get from some kind of a base-line the harder it becomes to communicate clearly. There is enough confusion when everyone is speaking properly let alone adding to it. Yes I am against legitimizing Ebonics too.

Re:Why i have to log in as root.

[foobar104]

You don't see anyone trying to eradicate the usage of "boxen" (even though "boxes" is the proper plural of "box").

There are two big differences between "boxen" and "virii."

First of all, "boxen" is almost always tongue-in-cheek. It's an old joke, but it's just a joke.

Secondly, "boxen" would be correct, if it weren't for the simple fact that it isn't. It's just one of those quirks of the language: one box plus one box is boxes, and one fox plus one fox is foxes, but one ox plus one ox is oxen. Like a friend of mine said, about fifteen years ago, in my high school English class. "Drive, drove, have driven. Dive, dove, have diven?" "Boxen" is funny because its use points out the arbitrary and inconsistent nature of English pluralization.

As I said, though, "virii" isn't just technically wrong, it's completely wrong. Latin had either no plural at all for "virus," or only a very rarely used and easily confused plural, depending on whose interpretation you accept. "Virii" has zero basis in any kind of fact.

If the correct Latin plural of "virus" had been "virii," and if the use were intended to be sarcastic or humorous, I wouldn't mind so much. But the fact is, people often use "virii" in utter seriousness, as if it were correct and acceptable.

It isn't. It's wrong, wrong, wrong.

Re:Why i have to log in as root.

[Anonymous Coward]

You don't have to, and must not login as root in OS X. I did that a couple of times (in the graphical environment) before getting used to the CLI and sudo. Now, after I had to reinstal the system, [...] I never reactivated the root account.

The neat trick to avoid working as root if you are not familiar with the CLI is to boot in OS 9 and do your "modifications" there. You can override all the permissions there. You have to know what you do, but if you mess up, you can always undelete!

Re:Why i have to log in as root.

[Anonymous Coward]

if you installed it as root, login as root, cd to the dir that holds the adsl-connect dir:

chown -R michel.michel adsl-connect/

chown = change ownership
-R = recursive (all sub-directories)
michel.michel = whatever your user name and group is (if you dont know, "ll" will tell you, best to do in your "home" dir [/home/michel])

or am i missing something more obvious?

or, edit the file that starts adsl-connect, and have it login as you first, start adsl-connect, and than logout of you.

try linuxbewbie.org or linuxdocs.org

Re:Why i have to log in as root.

[Anonymous Coward]

I have read, and fully understood, your argument. However, I'd like to note that language is ever-changing (especially the english language), and I've defintely heard enough technies use the word "virii" that I think it's become an accepted word. Therefore I will continue using it as such.

And there's nothing you can do to stop me!

Ahahahahaha!

Re:Why i have to log in as root.

[Anonymous Coward]

OS X, like most unices, doesn't honor the set-uid bit for scripts.

The boot-scripts run as root; init (which runs as root) spawns them. You only have to set something suid if the program requires root privelages and the parent-process is a normal user.

Re:Why i have to log in as root.

[Anonymous Coward]

Well to an English person, 'dove' as a past tense of 'to dive' is also completely wrong. You have already shown the reason why; 'diven' is also incorrect...the word simply doesn't come from that sort of root. So where did 'dove' come from? It must be an 'incorrect' American adaptation of the original English....er...just like er...virii and boxen (the en ending has an interesting Germanic resonance I always feel).

The success of English is its adaptability (look out for the nonsense word 'infos' coming your way courtesy of the Scandanavians), however annoying that may be to the pedantic.

Re:Why i have to log in as root.

[Anonymous Coward]

Sudo has always come with OS X. I think it may have even come with OpenStep or NeXTSTEP. That's so the operating system can implement the user hierarchy: root, admins, and users, instead of just root and normal users.

Not yet…

[DarkVein]

Does anyone here have some real-world anecdotes that I can point to?

But I can make some what did you say their addresses were?

Re:Not yet…

[marktwain]

Read down a few threads to the MacNN link. That foobar posted his domain URL is appears. :rolleyes:

I read the thread for a few minutes and smiled. Then I remembered there was a real world and had some work to finish up.

Fools rush in where wise men fear.........

Re:Not yet…

[SirRichardPumpaloaf]

Why would logging in as root on the console make you more vulnerable to remote compromise? To trojans, sure, but that's not what you seem to be implying. Last time I checked a root login doesn't expose any bugs in sendmail, bind, etc. so what are you talking about?

Real world example.......

[jsimon12]

My main reason for why you don't use root entirely is eventually no matter how careful you are you WILL make a mistake. Be it rm, chmod, mv, it will happen. If you use another account and try to do as much as you can as a none root user and only su up you will be less likely to simply careless do something.

But that is my 2 cents, my advice would be to present your argument, if they don't want to listen and want to put their boxes at risk, let them. When they accidentally make a mistake bring their system down they will learn. If they don't learn from that and keep recommending bad admin practices to others, well they are morons. But that is another issue.

Re:Real world example.......

[irony nazi]

You miss a very important point.

People who don't understand why you would/wouldn't log in as root are *extremely* unlikely to be playing around with 'rm', 'chmod', and 'mv'.

You would have a better argument saying something to the effect of "dragging an important system file into the trash" or moving/renaming an important file/folder.

I find it amazing how many people don't want to *login* to their computers.

They tell me, "I know that it's safer to log into my computer, but it's such a pain." --to which my usual reply is "You don't know that it's safer to log in."

Re:Real world example.......

[vample]

> I find it amazing how many people don't
> want to *login* to their computers.

Yes, because most of these people just want to use the computer to get something done, and its the job of the computer to make that easier, rather than toss more obstacles to getting things done.

Because they didnt have to login, or didnt have to su to get things done in the past, they see this extra work as a waste and thus want to avoid it.

Computers should be smart enough to handle these things. Like auto updating patches to the OS or virus signatures, or compressing big files, or other 'routine' stuff.

Maybe extend the analogy to 'have the computer auto-empty the trash for you'. Most people can see that this might be a bad idea, because sometimes you mistakenly delete the wrong file. Then tell them that having to sudo for things rather than always being root is the same - it keeps you from making they types of mistakes that are difficult to recover from.

Re:Real world example.......

[linzeal]

If typing a few characters to login is seen as work than apple has done a piss poor job of educating their customers on security issues. I remember having the same discussion with a graphic artist the company I worked for hired for a project about logging into a vpn from home, these sort of notions are dangerous from a network admin point of view. Apple needs to put biometrics in every keyboard and laptop they sell if they don't want this from becoming more of a problem than it already is.

Sometimes

[Anonymous Coward]

...you just have to let the rat get caught in the trap to learn.

Relax and get out of the way. You can't take responsibility for protecting them from themselves. Let them screw things up a few times, and once they learn from heir mistake(s), they will be your best promoters.

It sounds more like you're hurt they don't respect your input. Big deal...if they want to trash their system, make it clear you aren't responsible for the time lost when you have to come fix it later. Have them sign a waiver and go on with your life.

Live and learn

[Dirty Pickle]

I hate to say it, but they're going to have to get burned before they understand why they shouldn't log in as root all the time. Everyone I know has rm -rf'ed something important once, but just once.

Re:Live and learn

[Anonymous Coward]

you must know a lot of dumbasses

Re:Live and learn

[bdesham]

Everyone I know has rm -rf'ed something important once, but just once.

Yep - sudo rm -rf ~. Taught me, all right :-)

Re:Live and learn

[SiMac]

I don't log in as root. However, once I still made a fatal mistake:

Rather than typing "sudo rm -rf /Applications\ \(Mac\ OS\ 9\)", I typed it "sudo rm -rf /Applications". Oops.

Good thing I caught it in time....

Um, its the other way around...

[crisco]

Nice Troll though...

Those pretty bar graphs indicated the time spent getting the job done. That means that the taller one labeled Mac on each of them means the Mac took longer. Generally that means the Mac loses to the Athlon.

besides, its all offtopic anyway :)

Re:Um, its the other way around...

[localerrata]

One offtopic post deserves another... I wonder though if running AfterEffects on a machine that supports it natively versus one that only emulates OS 9 is a fair comparison.

Re:Um, its the other way around...

[crisco]

Hmm, I think I see the point, and to a certain extent agree...

:)

Root is like crack

[Anonymous Coward]

Don't smoke it. I did once and got hooked. I ran Mac OS Updates as root. Fuck, I even had sex with my girlfriend as root. Man, that caused some permissions problems. When I started the road to recovery (logging in as Zacks) my girlfriend was all like: "Fuck no! You can't get any cause you don't own me an I don't go groups. You don't have the power to read, write OR execute so get out of my FACE" So I was all HELL NO bitch. And she wuz like you do not have root (superuser) privlages so get out of my TruBlueEnvironment! So then I went chown and chmodded her ass to me. Dat be-otch be up in my hizzouse. What what. Holla!

Re:Root is like crack

[Hard_Code]

Nice try Seth Green.

OS 9 like? Nope.

[jasonwileymac.com]

"...claiming it's 'more Mac-OS-9-like,' "
Nope. Not at all. OS 9 has the same level of protection for itself that OS X does, it just works a bit differently. Tell your friends to try this... In OS 9, drag your System Folder to the trash. Go on, do it. Whupps - you can't. Why? Because you don't have 'permission' to. You can only do it if you boot from a different source, like a CD or another volume. Unix does this far better than OS 9 could, but it's basically the same idea. Logging in as ROOT lets you do anything you want. Toss your kernel? SURE!!! No problem! BAD idea. I feel that if someone doesn't know why they shouldn't be root, that alone is reason enough for them NOT to be.

Original Thread

[owenc]

There are a lot of threads at various mac forums with this topic, but a current one is here at MacNN forums.

MacNN forums seems to have a well deserved reputation for being full of idiots. Especially in the OS X threads.

Say hello to "Bobby" from Ventura California, who started this thread :)

Re:Original Thread

[owenc]

The idea of this guy logging in as root all the time makes me cackle with glee.

Here's one.

[Eagle7]

Let's say that you want to change the permissions of all the files in your home directory to go-rwx (which make sense). So, you type:

chmod go-rwx ~/*

But by mistake, you hit the space bar, and get:

chmod go-rwx ~ /*

By the time you realize the hard disk has churned too long, you'd just gone and wiped the permissions on /bin, /sbin, /var, etc. You're system is now screwed up to the point where it's probably faster to reinstall than change all the permissions. If you weren't root, you'd see something like this (from a Linux-PPC box):

[pts/2@tardis:/home/dmorriso @00:45] chmod go-rwx ~ /*
chmod: /bin: Operation not permitted
chmod: /boot: Operation not permitted
chmod: /dev: Operation not permitted
chmod: /etc: Operation not permitted
chmod: /home: Operation not permitted
chmod: /lib: Operation not permitted
chmod: /lost+found: Operation not permitted
chmod: /mnt: Operation not permitted
chmod: /opt: Operation not permitted
chmod: /proc: Operation not permitted
chmod: /root: Operation not permitted
chmod: /sbin: Operation not permitted
chmod: /tmp: Operation not permitted
chmod: /usr: Operation not permitted
chmod: /var: Operation not permitted
[pts/2@tardis:/home/dmorriso @00:46]

And yes, back in the day, I did make this oops and had to reinstall, because I had used su rather than sudo, and had forgotten to un-su. I started using sudo right afterwards. :)

Re:Here's one.

[foobar104]

chmod go-rwx ~ /*

I just want to second this. I did the same thing once, but on an SGI O2 rather than a Mac. My variation: chown -R foo / when I meant to type chown -R foo .. The dot and the slash are just too damn close together for comfort.

That was when I learned that you can't boot an SGI if files like /bin/sh and /sbin/init aren't owned by root.

And yeah, it was easier and faster to just reinstall the OS than it was to try to fix the ownerships.

Re:Here's one.

[Eagle7]

D'oh - I forgot the -R in that example, which is the real kicker.

Re:Here's one.

[trollbot]

Nice story, but people whologin as root to be more "OS 9-like" DON'T USE CHMOD. They probably DON'T USE TERMINAL.

But yeah, I live in perpetual fear of :

rm -f * ~

Re:Here's one.

[Anonymous Coward]

You better not have been that SGI customer in Denver that called me after doing this. It took about two hours to figure out that this was, in fact, what had happened....users these days....

Re:Here's one.

[Permission Denied]

How about this:

You want to change all your .emacs, .exrc, .whatever to be world-readable so everyone can see just how clever you are:

chmod -R go+r .*

Well, not so clever after all. '.*' expands to include '..' and '.' and the -R flag combines with this in a Very Bad Way. I got burned by this once (different circumstances, however, I su'ed into root to change some stuff in /tmp). This also depends on what shell you use: with bash, you're screwed, with zsh, you're OK.

Re:Here's one.

[qeL3-i]

How about:
rm ugly-pron. *
ARRRRRR! MY PRON! MY Beautiful PRON!

Re:Here's one.

[Permission Denied]

rm ugly-pron. *

Dude, you're using the wrong shell:

% ls
good-pr0n1.jpg good-pr0n3.jpg good-pr0n6.jpg good-pr0n9.jpg
good-pr0n10.jpg good-pr0n4.jpg good-pr0n7.jpg ugly-pr0n1.jpg
good-pr0n2.jpg good-pr0n5.jpg good-pr0n8.jpg ugly-pr0n2.jpg
% rm ugly-pr0n *
zsh: sure you want to delete all the files in /home/pd/.pr0n [yn]? n
rm: ugly-pr0n: No such file or directory
% ls
good-pr0n1.jpg good-pr0n3.jpg good-pr0n6.jpg good-pr0n9.jpg
good-pr0n10.jpg good-pr0n4.jpg good-pr0n7.jpg ugly-pr0n1.jpg
good-pr0n2.jpg good-pr0n5.jpg good-pr0n8.jpg ugly-pr0n2.jpg

NB: this is zsh figuring out my typo, not 'rm' being annoying.

Re:Here's one.

[tunah]

Mine was worse.

I don't have rpm installed, but I found a program that was only available as rpm. So I ran rpm2targz on it and then tar xvzf. It then extracted a whole bunch of files into a new usr folder in my current working directory, as I had forgotten to cd /. I was still root. So now to get rid of the directory I tried to type:

rm -r usr/

What I actually typed was this:

rm -r /usr

Oops!

Re:Here's one.

[Eagle7]

NB: this is zsh figuring out my typo, not 'rm' being annoying.

You mean, that's zsh being annoying. :)

Re:Here's one.

[Merlin42]

I pulled something like that when I was still a linux newbie (and logging in as root regularly). I was having some trouble with a program and decided it must be a problem with one of those 'dot files' , so I figured I would be slick and delete all of them:

rm -rf .*

that should do it ...

...

why is the disk still churning ...

/me slaps forehead

.* matches ..

I have never logged in as root since, and I'm very carefull with su

Re:Here's one.

[Eimi Metamorphoumai]

Ahhh, yes. Been there, done that. Of course, mine looked so innocent. Messing around in /proc, tried to make everything readable (to see how the proc virtual filesystem interacts with permissions). "chmod -R a+rwx *" Even made sure I was in the right place first. What I quickly (but not nearly quickly enough) learnt was that chmod -R follows symlinks, and that symlink to / made that command much less fun than it should have been. To this day, I loath commands that follow symlinks recursively (cp -r, chmod -R, I'm sure there are others), but I have gotten much better at "find -print0 | xargs -0".

Re:Here's one.

[nivedita]

Um, in most recent systems, rm doesn't let you delete .. .

Re:Here's one.

[Merlin42]

I guess I didn't explain the situation very well.
This was RH 4.x or 5.x (not sure) and I was in root's home directory (ie /root/ ) so recursively deleting all the files in .. effectively eviscerated the entire system.

Re:Here's one.

[Anonymous Coward]

well, i think when I got 'burnt', I think I would've preferred to go 'su' rather than 'sudo'

I wanted to change the permissions in my home directory... put I had forgotten that I had don 'cd /' and not 'cd'. Then I typed 'sudo chmod 700 ./*' (or something similar). By the time I realized what I had done, it was too late.. I wanted to amend the damage but 'su' already gave me 'permission denied' ... and so I re-installed, vowing to myself to watch out with 'sudo' or anything that gives me root access...

Re:Here's one.

[Etrigan_696]

/proc can be a dangerous place to poke around. Multiply that by a zillion if you are a boob with root...

Sitting at my friends linux box, I went to /proc and poked at some stuff to check out his hardware without opening the case, switched terminals and untarred a tarball with the current project we were working on, switched back to look at his amount of RAM, switched back to get the one file out of the tarball I needed and put it in ~/project, switched back to look at some more stuff in /proc...then I wanted to delete the rest of the crap from the tarball, so I typed:
rm -rf *
And quickly realized I was in /proc and not ~
Needless to say, the computer grabbed its throat and choked to death right before my eyes.

My friend came in - sees the thing just sitting there, with the hard drive grinding away and sees what I had typed in. He asked "So, if you delete the cpu in /proc, is it still on the motherboard?"
I almost opened the case to see.

Had I been joeuser instead of ROOT things would have been okay, and I would have gotten a nasty-gram telling me what a boob I was.

You don't log in as root in macosx

[Bart van der Ouderaa]

For the old unix hacker it looks like you're logging in as root, but that's not really the case. At install time the system creates two users, both have the same name and the same password!

One is just a user, the other is root. In previous versions ( i haven't tested it lately) you could change the password of one but it wouldn't result in a password change of the other (which gave alot of headaches).

Now if you log in you're the normal user, and you can't do anything really dangerous. You need su (which needs to be activated, it isn't possible by default) or sudo to do something as root. Also when you're doing an install that requires root the installer will ask for a super user.

In both cases you use your own username and password (if your user is created at startup). So If somebody sneaks behind my computer when I'm gone to do something else, they can't really do anything dangerous. They would still need a password!

You can make more users if you want without any rights (that's easy), but the system works better than it looks because you don't log in as root!

You can if you want to btw. The password of root is the same as the password of the user.
It does nail down the importance of good passwords which is something that alot of macusers are new to.

Re:You don't log in as root in macosx

[owenc]

At install there is no root user created. So by default you cannot log in as root from the gui or via su. sudo is available however to users who are set as "admin".
You can enable root through the netinfo config utility. It asks for a new root password.

Re:You don't log in as root in macosx

[Drakino]

At install there is no root user created. So by default you cannot log in as root from the gui or via su. sudo is available however to users who are set as "admin".

You can enable root through the netinfo config utility. It asks for a new root password.

Partially correct. root is created on install just like any other Unix, and is the owner of most files on the system initially. Just who knows what the password is. Netinfo lets you set a different password, but all it is is a pretty GUI for "sudo su; passwd root".

Re:You don't log in as root in macosx

[Phroggy]

For the old unix hacker it looks like you're logging in as root, but that's not really the case. At install time the system creates two users, both have the same name and the same password!

Um, no. This may have been true in pre-release versions, but in 10.0 and later, only your regular non-root account shows up in System Preferences. The root account doesn't have your name on it, and the encrypted password is set to "*" meaning logins are disabled altogether.

One is just a user, the other is root. In previous versions ( i haven't tested it lately) you could change the password of one but it wouldn't result in a password change of the other (which gave alot of headaches).

They are not the same account, so changing a user password will not change the root password, and vice-versa.

Now if you log in you're the normal user, and you can't do anything really dangerous. You need su (which needs to be activated, it isn't possible by default) or sudo to do something as root. Also when you're doing an install that requires root the installer will ask for a super user.

If you're an Administrator, you do have write access to the contents of /Applications and /Library, just not /System. The reason su doesn't work by default is, root doesn't have a password by default. However, any Administrator can run any command as root with sudo - for example, "sudo tcsh" will get you a root prompt.

In both cases you use your own username and password (if your user is created at startup). So If somebody sneaks behind my computer when I'm gone to do something else, they can't really do anything dangerous. They would still need a password!

If you're doing something that actually requires root privaleges, such as changing system settings or installing software, you must authenticate as an Administrator, even if you're already logged in as an Administrator. If you type "sudo tcsh", sudo will prompt you for your password. It's an excellent system.

You can make more users if you want without any rights (that's easy), but the system works better than it looks because you don't log in as root!

What?

You can if you want to btw. The password of root is the same as the password of the user.

As I said before, this is wrong. As I recall, the Public Beta set the root password to the same as the user password at install time; the final version didn't do this.

If you do want to enable root logins, there are three ways to do it:

A) open NetInfo Manager, click the padlock icon, authenticate, then go to select the Domain/Security/Enable Root User menu item

B) open NetInfo Manager, click the padlock icon, authenticate, browse to /users/root, and change the value of the passwd item to an encrypted password

C) open Terminal, type "sudo passwd", authenticate, and set a root password.

It does nail down the importance of good passwords which is something that alot of macusers are new to.

I set my system to automatically log me in at boot time, so it doesn't nail down anything.

My stupid story

[mfos.org]

Mix root with a nice, easy to use GUI and you've got trouble. Having a CLI provides a level of protection (But still, the difference between rm -rf /tmp/somedirectory and / tmp/somedirectory may only be a space, but I hope you've got backups).

Anyways I was using the Gnome filemanager at the time and was logged in as root, and moved the /lib directory into the /usr directory. As libc couldn't be found, I was unable to run any commands, and this resulted in a reinstall, as I didn't have the skills to restore the problem.

Re:My stupid story

[tps12]

All you had to do was boot from a floppy or CD, mount your disk, and move the directory back. I have had to do this after toasting libc before.

Re:My stupid story

[mfos.org]

Now I'm a linux ninja, but as I said, I lacked the skills. But for people who aren't, Linux Care and the Linux Bootable Toolkit are iso's that will fit on business card size cdrs and are excellent tools for recovery.

Necessary for GUI users?

[dh003i]

As a command-line user, I understand the value of not logging in as root all the time.

However, most Mac users couldn't use a command line if their life depended on it and probably don't even know that MacOSX has a command line.

The MacOSX user who's a classic mac user will probably never use the command line; if they have to rename a thousand files to add an extension or a prefix or whatever, they'll do it by hand, not by using a tcsh script.

So, the question is, how much damage can one do from the MacOSX GUI at root? I don't know. I have accounts on other ppl's MacOSX computer (namely, at my University) but have never been logged in as root.

Of course, not logging in as root doesn't only protect you from yourself. It also protects you from "trogan" install programs, which say they'll do one thing, and in fact delete the entire hard drive or something else like that.

Re:Necessary for GUI users?

[Anonymous Coward]

Joe Mac User sees the kernel in the Finder and says, "gee, what's this? Probably some scrap file." Then he deletes it. He's root, so he can do that.

Re:Necessary for GUI users?

[chigaze]

Actually, I'd use an applescript or a utility such as A Better Finder Rename. The lack of a command line does not mean the lack of scripting tools for repetitive tasks.

Re:Necessary for GUI users?

[Phroggy]

So, the question is, how much damage can one do from the MacOSX GUI at root?

Muck around in /System and you can render the OS unbootable.

Strike fear into their hearts! :D

[The Evil Beaver]

Make them use Windoze for a week or two, all the while passing all relevant details of their machines to every cracker you know. They'll be begging you to never let them use root again. :)

Seriously though, a lot of the time when I'm running Linux, I'm in both using my normal account and my root account (though root is on a console and just running top). If there's danger even in that (other than killing the wrong processes), I'd love to hear about them -- better safe than sorry!

Re:Strike fear into their hearts! :D

[Anonymous Coward]

If there's danger even in that (other than killing the wrong processes), I'd love to hear about them -- better safe than sorry!

You could unwittingly be running trojans.

Let's say you install some software. But little do you know that that software checks to see if you're root, and if it finds that you are, replaces programs like ls and echo with boobie trapped ones.

Mod this up

[Spunkee]

Mod this up. It's supposed to be funny. I don't see how it's a troll.

Same Q for Administrator with Windows XP Pro...?

[FransUNC]

Are there any problems or security issues doing everything as administrator with Windows XP Professional? I'm just a personal user, and other than using client software for many internet uses, I don't server anything. And problems other than "the fact that Windows sucks" would be nice. ;)

The Mac OS X security story direct from Apple

[plsuh]

First, my credentials: I'm a Curriculum Developer with Apple's WorldWide Training and Communications group. I am the author of the Network Security chapter in Apple's Network Administration course. I gave a talk at the last MacWorld on Mac OS X firewalling, and I must have done something right since they asked me to do it again in July in New York. In this post, unlike most of my other postings, I am speaking in my Apple voice.

That said, Mac OS X has a root user, but root does not have a valid password on installation. The first user that is created via the setup assistant is what is known as an admin user. These are users who are members of the group "admin", a predefined group. Apple provides an API whereby a GUI application can ask for an admin user's password, and thus gain sudo-style privileges for actions such as installing software (which might need to put things in places that can only be touched by root). Also, the /Applications directory also is writable by admin users, so apps where the install is just drag and drop (such as OmniWeb or MSOffice) can also be installed by an admin user and do not require root privileges.

In addition, admin users have access to the /Library directory, which is where resources specific to a particular machine should be stored. There are four Library locations that Mac OS X searches for resources such as fonts and frameworks:

• ~/Library - for user-specific items
• /Network/Library - for resources made available to an entire NetInfo network
• /Library - for resources specific to a particular machine
• /System/Library - the base system installation; this area is in general reserved for Apple use, and most people have no need to change anything inside here.

Note that the /Library tree in general has ownership root:admin with privileges 775. This means that any admin user can add or remove resources from his or her own machine without resorting to using root directly. In fact, if you wanted to add a set of resources that would affect only a particular user (say, give only the graphic artist access to the full set of 300 fonts, and leave everyone else with just the usual system set of fonts), you could install them under the user's ~/Library directory. Because of the default search order, resources in ~/Library and /Library take precedence over those in /System/Library, so you can simply install a framework in /Library and override the OS's default behavior.

If a user were to log in as root, he or she would immediately gain write access to the /System/Library area, which contains the really sensitive bits of the operating system. As it were on the warning labels, "No user serviceable parts inside!" Logging in as root is the equivalent of unscrewing the cover of a piece of equipment with that warning label. If you know what you're doing and you're careful, you may be able to do something in there, but if you're not careful or don't know what you're doing, you are likely to get hurt. I know of several users who had the bad habit of looking at a bunch of files in their System Folders and thinking, "I don't know what this does, I can just throw it out to gain more disk space," in older versions of the Mac OS. Turning one of these guys loose as root on Mac OS X is likely to cause major headaches.

From the command line side of the house, admin users are allowed to do anything via the sudo command, which is preinstalled on Mac OS X. If you need root access, you can use sudo to do just about anything from the command line. If you really, really need a root shell, you can always do "sudo -s" and get one.

In summary: Mac OS X has the tools that you need to perform system administration tasks form either the GUI side or the command line side without needing to log in as root. Logging in as root is the equivalent of opening up a piece of machinery with the warning label, "No user serviceable parts inside", and you should not be surprised if you get hurt when you do this.

Paul Suh
psuh@apple.dontbotherspammingmeigetwaytoomuch alrea dy.com

Note: on Mac OS X Server, root is enabled by default. This is considered less of an issue since it is expected that servers will be run by people who have a better understanding of the issues involved and are more likely to be doing things that need root access, even from the GUI level.

Re:The Mac OS X security story direct from Apple

[Alex Thorpe]

A very nice post, thank you.

I've never enabled root on my system, as I've heard a few warnings a while back, and I've never needed it. The only time I may have been tempted was when StuffIt Expander(the main archive decompressor for the Mac) was updated, and I didn't have permission to delete the old version that came with OS X. I ended up deleting it from 9.22. I do use my Admin account all the time. I tried a personal user account once to see if things would run faster, but there was no change, and a new account felt like a whole new machine to configure to my preferences.

Re:The Mac OS X security story direct from Apple

[rjrjr]

You could probably have handled this without being root, and w/o rebooting. In Terminal in an Admin account, do:

sudo rm -rf HideousStuffitDirectory

And as for moving your personal environment to a new account, you would get 99% of it by something like:

sudo ditto ~oldUser/Library ~newUser/Library
shudo chown -r newUser.newGroup ~newUser/Library

Really I can't see any reason not to do that for the entire home directory. Just lop off the "/Library" parts.

Re:The Mac OS X security story direct from Apple

[Minupla]

Logging in as root is the equivalent of opening up a piece of machinery with the warning label, "No user serviceable parts inside",
...and pouring in a bag of marbles
...and putting the machinery in a paint shaker :)

Thanks for a lucid an enlightening post. It's going into my "I might need this to show a user someday" file.

Re:The Mac OS X security story direct from Apple

[Alex Thorpe]

I suppose that I could have, if I knew any UNIX command line commands. There's no good help system, and while I remember and could probably teach a class on DOS, UNIX is a bit more complex. There's a library nearby, perhaps I should renew my library card and see what they have. Judging from the past, though, I'm not getting my hopes up for anything newer than books on the Commodore 64.

Re:The Mac OS X security story direct from Apple

[stux]

You should order "Mac OS X Unleashed"

tis a good book :)

covers everything, going from this is the finder, and this is itunes, through to this is BSD and this is how to install Lynx and sendmail

All it takes is....

[phagstrom]

What if you want to clear up all the tmp files you made and you make a small typo

rm -rf / tmp

After doing something like that, you know why NOT to use root. ;-)

Re:All it takes is....

[Erik K. Veland]

Been there, done that.

That's all the frickin' real world example you ever need. Thank god it was on a partition. But I lost my entire MP3-collection.

Bad karma will do that to you.

Re:All it takes is....

[__past__]

Do you want to say that "sudo rm -rf / tmp" is any better, or that one shouldn't try to clean /tmp? After all, you have to get root somehow to do such stuff.

The problem is, IMHO, the mere existence of root, as opposed to a more fine-grained approach - things would be much nicer if "may bind to a port <1024" wouldn't automatically imply "may rf -rf /". It's nice to see that some unixes seem to move in this direction, but, well, HURRY THE F*CK UP, developers! ;)

Re:All it takes is....

[coolfrood]

Something that can happen more often:

rm -fr .*

Trying to delete hidden files from a directory. You're going to lose everything above it!

Re:Same Q for Administrator with Windows XP Pro...

[the_greywolf]

Administrator on Win2k and WinXP are very different from root on a *nix. Win2k and WinXP both treat Administrator as a normal user, but this normal user has certain permissions that allow them to install/remove any software, read/write any file, or even delete a system file (which Windoze quickly replaces with a fresh copy). AFAIK, Administrator doesn't pose any serious security problems unless your computer is one accessed by more than one user - like a spouse or children. create an account for each and stay logged out when away from the computer.

my only recommendation is MAKE SURE IIS IS NOT INSTALLED. script kiddies and horny teens can gain Administrator access without a password. (unless you're insane and actually want to USE it.)

Something I was told.

[abdulla]

While doing work experience at SGI, I was told of their awards that they give out every month (in the form of two movie tickets), you get one if you do something great (help the community, fix a mass bug, etc) or if you do something really stupid. Well they had a main Origin 2000 server (snort), and a couple of months prior, one of the engineers (the one looking after me, I believe he was working on XFS at the time) has accidentally done rm -rf / while logged in as root on snort, there went everyone's stuff, snort was like the workhorse and the big storage yard. This is the result of their liberal policies (once your within the building you have all access to everything inside). I still love SGI! :)

Re:Same Q for Administrator with Windows XP Pro...

[Anonymous Coward]

If a nasty IE or Outlook(or whatever) exploit ever appears, you can end up with much more damage done to your system if running as admin. If you're logged in under a normal account, only files that you have permission to can be deleted/modified (mp3s, docs .. presumably stuff you've backed up). As Admin, if the trojan/worm is nasty enough, you may need to completely reinstall OS and all your software. Think of permissions as low level, last resort anti-[virus|worm|trojan] protection.

Not a new problem

[Permission Denied]

I knew this physics guy that bought a Linux box so he could do his Fortran numerical analysis on his own, without relying on the insanely big, fast and reliable physics servers (go figure). Smart physics guy, complete unix newbie.

I'll only tell you the anectdote salient to this article. He would, of course, only log in as root as the KDE rpm front-end wouldn't work when you're logged in as a regular user and he didn't want to figure out how to use the the command-line rpm (I don't know if currently KDE does a sudo/su-type thing using the GUI, but it didn't back then - if you ran kfm as non-root, you couldn't use the RPM front-end).

At one point he could no longer log in. Problem? / was full. He was downloading all his stuff into /root (a one gig partition) and /home (20 gig partition) was completely empty. You could log in from console, but not from XDM since XDM creates files in /tmp upon login. He had no idea how to get from XDM to another virtual console, so he was effectively locked out of his machine.

My point? Give up. Don't worry about it. They will not learn why logging in as root is bad until they get burned. Especially since you're just a forum moderator - if you were getting paid to do this and your job depended on these machines staying up, you would have every responsibility to ensure people were properly following your policies; but, as a mere guru to these people, allow them to learn in the most effective fashion: trial by error.

Re:Not a new problem

[JabberWokky]

(I don't know if currently KDE does a sudo/su-type thing using the GUI, but it didn't back then - if you ran kfm as non-root, you couldn't use the RPM front-end).

Yes it does, and to give you an idea of how old your ancedote is, kfm was dropped in favor of Konqueror two major versions ago (since 2.x).

--
Evan

Re:Not a new problem

[Permission Denied]

I am aware of Konqueror; the anecdote is still relevant. Even if you are now using GDM or KDM instead of XDM, those still create those authorization files and will not work if the file system is full.

Please, actually work with these people before trying to tell me how it would be so easy to convert them to unix. It's completely different in a corporate environment than the home environment (and I don't see OS X being targetted at corporate environments, so we're talking about mom and pop and their home computer here). In a corporate environment, they have you to get the machine working and install new software, etc. You try to put unix in a mom-and-pop home environment, and you'll be inundated with phone calls. You'll fix something for them (which will require root privs) and then you'll get another phone call 20 minutes later.

Try installing a mozilla build without using a command line, logged in as a regular user. Sure, you just install it to your home directory, but how many people are going to figure out that they need to change the default value in the dialog box? After you've installed it to your home directory, how do you start it up? Well, maybe it installed an icon on your KDE/GNOME desktop, maybe not. Let's assume it has. Now, what if you're in Konqueror and you want to use the "Open using Mozilla" menu option. Do you think that will work? Nope. Mozilla is not in your PATH (and that is what the latest version of Konqueror uses - it just does an execvp). Do you walk your grandmother through editing her .bashrc using emacs?

These people don't know the difference between a slash and a backslash - you'll have difficulties telling them over the telephone exactly which characters to type in, one at a time. When I say "et-see are see dot dee init dot dee" you think "/etc/rc.d/init.d" but mom-and-pop thinks "WTF?" You'll then give up, go to their physical location, enable ssh, and fix everything remotely from then on.

I have a lot of patience - I regularly deal with intelligent non-computer people (I have a real job, you see) and I've very good at explaining technical matters to non-technical people, but dealing with this audience is a completely different matter - you will become frustrated sooner or later. It's not really a matter of patience, but a matter of communication. When filesystem permissions and the simple relationship between users and groups doesn't make sense to someone, you simply don't have a common vocabulary to communicate expediently. They will log in as root no matter what you tell them. Ask yourself how many people are running Windows 2000/XP on their laptops and how many of those people bothered to create a non-Administrator account.

Re:Not a new problem

[JabberWokky]

the anecdote is still relevant

Didn't mean to imply that it wasn't relavant. I hold that *way* too many *nix apps break when they run out of disk space. Quite often in rather spectacular, data lossly ways, or in a quiet "I'll just throw this data away without ever alerting anybody" manner. Ditto for when the filesize exceeds the filesystem limit (less of a problem now, at least in Linux, but I hated that old damn 2GB limit).

--
Evan

Re:Not a new problem

[Permission Denied]

Cool, OK, I misunderstood you. I'd agree that lots of *nix apps die spectacularly when they run out of disk. Funny thing is, I've seen Windows and MacOS apps deal with this by popping up a dialog or something, whereas the *nix apps will dump core, at best.

Another thing I've noticed is that most good *nix programmers do indeed check for out-of-memory errors (eg, they always check return value of malloc), but their error handlers aren't all that great.

My usual way of dealing with out-of-memory is to propagate the error back up the call stack until someone really wants to deal with it. Most times, dealing with it just means printing an error and dumping core.

It may be that us *nix programmers are used to good virtual memory implementations where it's really hard to run out of memory, whereas the Windows/MacOS programmers have actually had to deal with these issues directly. Not sure.

Re:Not a new problem

[Mignon]

Give up. Don't worry about it. They will not learn why logging in as root is bad until they get burned. Especially since you're just a forum moderator - if you were getting paid to do this and your job depended on these machines staying up, you would have every responsibility to ensure people were properly following your policies; but, as a mere guru to these people, allow them to learn in the most effective fashion: trial by error.

I would add to this that you should reproduce for your readers some of the excellent advice already posted, but tell them to print out a hardcopy for themselves. Then, when they wreck their system, they can read what you posted and realize you were right.

mod up!

[jcsehak]

shit, that was funny

Re:OS 9 like? Nope.

[WalterSobchak]

OS 9 like, sounds like "More Mac like", and logging in as root is not.
My first Macintosh manual (for the Macintosh 512k) had the following to say about installing the "Programmer's Switch": "The Programmer's Switch is used to create an Interrupt or a Reset. If you do not know what an Interrupt or a Reset is, you do not need this switch". While people may criticize this, it has always been Apple's strategy to protect users from their own stupidity.
So really to emphasize the parent post, "If you do not know why to log in as root, don't do it." Period. Nuff said

Alex -- (And I don't even normally log into my BSD box as root)

Don't bother

[TheHans]

When you're right in the middle of typing rm -fr /usr/something/ and you hit the enter key accidentaly hit the enter key just after the /usr/ part because you had to reach for napkins to clean up the gin and tonic that you spilled in your lap you learn that when you're root you can seriously fuck things up. Don't waste your breath--or keystrokes--on people who don't want to listen. They're bound to learn why they ought not log in as root all the time.

Re:Don't bother

[Anonymous Coward]

I can't say I support logging in as root, but I don't think this argument holds much water. just add an

alias 'rm' rm -i

wherever, and you have the same protection. I think people need to hear better reasons than that to stop them logging in as root.

Re:Don't bother

[TheHans]

I think you missunderstood the point I was trying to make.
I was simply saying that people will likely learn from experience that logging in as root all the time is a bad idea and because of this there's no point in arguing with them. Let them make their mistakes and they will learn from them.
Also if you're using the gnu fileutils version of rm you might wish to read the info page on rm. Aliasing rm to rm -i won't help you one bit if you type rm -fr. I don't know about other rm versions.

Re:Don't bother

[Van Halen]

alias 'rm' rm -i

I hate it when some systems add this to the default .cshrc/bashrc/whateverc. IMO, relying on such an alias is asking for trouble. What happens if you're on another machine that doesn't have that aliased? What if the alias didn't take effect (something bad in your .cshrc caused it to stop parsing before that)? I've seen people use this alias to get into the habit of typing 'rm *' and just saying N to the files they wanted to keep. Bad idea.

The intentions are good, but I think if you're playing with fire (doing things as root), you should be forced to be absolutely careful and type everything out just as you really meant it.

Re:Same Q for Administrator with Windows XP Pro...

[Anonymous Coward]

Administrator on Win2k and WinXP are very different from root on a *nix. Win2k and WinXP both treat Administrator as a normal user, but this normal user has certain permissions that allow them to install/remove any software, read/write any file,

Sounds like root to me. In the eyes of the kernel, root isn't much different from the other users. He just happens to have a special uid of zero, and the kernel just happens to let uid 0 do anything it wants.

Why (we) do it ;-)

[Anonymous Coward]

I think this issues is mostly a holdover from the early DP and Public Beta versions of OS X. Without Unix knowledge, it was impossible getting things done without being root, and doing things as root caused so many permissions issues that many of us gave up and simply logged in as root all the time, just to be able to use the system. Things are *much* better now, but there are still issues that crop up making me wish that things worked more like OS 9. Mac users are used to having 100% control of their systems, OS X can be extremely frustrating to those of us who, for example, want to replace our System file with a backup copy because things are getting strange and you think corruption of the System files might be the cause.

Most of you posting here are Unix geeks, don't forget that there the Unix "way" is not, and never has been the Mac "way." Ted and MacFixit put it best (this quote is from memory):

"Any time you are *forced* to use the command-line to fix a problem (get something done?), it is a failure of the OS."

Re:Why (we) do it ;-)

[pudge]

"Any time you are *forced* to use the command-line to fix a problem (get something done?), it is a failure of the OS."

Bah. Any GUI that can provide everything that *I* need to get done is going to be unwieldy, at best. The GUI cannot perceive of everything that I might need to do. It's simply not possible. And if you call that a failure of the OS, then the very concept of GUIs is fundamentally flawed. The GUI should be as complete as possible/reasonable, but it cannot ever cover every need of the user.

hehe did this a long time ago:

[yod@]

while addin a new disk ( was migrating data )..

mv /usr/lib /tmp

no command worked after that cause everythign was dynamically linked.

Aqua skin for slashdot?

[Space]

I realize this is slightly offtopic and I can probably kiss some karma points goodbye but, did anyone else notice a modified image at the top of this page? This image was at the top of this story.

Re:Aqua skin for slashdot?

[Anonymous Coward]

sir, you are either a complete moron, or a troll. That 'skin' has been there since apple.slashdot.org was opened (over a month now)

No root please

[pvera]

It comes down to good practices. When I started playing with Suse I remember how I would get kick/banned on the spot for trying to get into #linux on Undernet while logged as root. I asked them and they simply explained it was to teach me to use SU instead of a real root.

I think we all agree root itself is too dangerous to leave it on for more than a few minutes, even if you really know what you are doing. Even us windows weenies are trying to enforce this: my IT folks spent a week adding garbled (read: cannot memorize) local passwords for all our servers and for administration are using an obscure account with the proper permissions. It is impossible to guess by name that this account is a local administrator for all machines in our network.

For OS X and BSD I guess you should be able to do whatever you need without logging as root, that is what SU is used for.

#1 argument aginst being root

[h0tblack]

user:
cd /
rm -rf *
"OMG! where have all my files gone"
reply:
"PEBKAC"

All people need to do is enable root and then su or sudo if they absolutely have to. If they can't fix any problem they are having not being logged in as root, then they should go and read some books. Hopefully some Mac users who are new to the *nix world will get some benefit from O'Reilly's new "Learning Unix for Mac OS X" book. Not that there aren't plenty of other books that should teach them the lie of the land, but I have a feeling this one will be popular as it's focussed on OS X.

Real-world anecdote...

[Anonymous Coward]

Windows; windows 9x.

Windows 9x is always logged in as root.
Windows 9x makes it easy to mess up your computer, due to the lack of security.
Not logging in as root increases your security.

:. always logging in as root makes it easy to mess up your computer.

Stupid /. humor

[andaru]

1. The dot and the slash are just too damn close together for comfort.

What's wrong with /.? :)

Who cares?

[gabe]

MacOS has always run with the simplicity of giving the [single] user complete access to the entire system. It wasn't until they bought NeXT and started working on OSX (parts of which, like permissions, made it into OS9 to smooth the transition) that permissions were involved in the OS at all.

What does it matter if someone can wreck the entire installation? They could do it before in OS8 and lower. Why does it matter now?

Folks from a *NIX background, like a good portion of the /. readers, obviously object to this because it's not what they're used to. So, they will create their own [admin] account and play nice accordingly. Folks who are primarily from a Mac background may give up on the idea of an admin user and just set a root password and leave that account logged in all the time.

Do you really care if some random mac user wants to be able to trash their system? Do you?

my 1.5 cents

[bigdog79]

i've been using OSX for just over a year now, and root scares the hell out of me. Call me unadventurous, but when something says "do not touch" i damn well won't touch it until i know what i'm doing. the only time i'll mess with it is if someone's holding my hand and pointing the way (ie. there's a nice step-by-step thing in MacAddict or something). and considering the number of typos i always make, i'd be one of those people who'd delete my entire drive or start global thermonuclear war from my iMac. :p

Re:my 1.5 cents

[stux]

I've always been the type of guy who pushes the big red "don't touch" button...

I figure if it was really *that* bad, then they wouldn't have put it there ;)

Lots of fun things happen from doing this :)

Anywho, point is, don't use root... unless you really really are prepared to have to reinstall everything... and keep backups...

mmmm chmod fun :)

Re:OS 9 like? Nope.

[Hadlock]

i don't own a mac 512, nor do i plan to own one (i'd like one though). i guess its safe to tell me,

what exactly does the programmer's switch do? :-D

typical

[Anonymous Coward]

Most Mac users are always finding something about OS X to whine about. If it's not that the Chooser is gone, it's that they can't be root all the time. Honestly, is it really that hard to type in your password anytime you wish to update or make a system altering change? They have been blessed with this beautiful OS, a perfect blend of form and function, yet all I hear from Mac users is, "I hope the next release is more like OS 9." What is wrong with you people? OS 9 is antiquated. I switched to the Mac platform because I was tired of that other major OS churning out the same garbage for a decade. Troll me down but it's true, Mac users don't know how lucky they are.

It's all about functionality and user experience.

[fluor2]

I use an account that is an administrator-member every day on my Windows.

My uptime on this workstation is 40days and I have never been hacked (i dont run any firewalls, but a small network monitor). By the way, there exist a nice freeware portblocker at http://www.analogx.com/contents/download/network.h tm if you want to use a firewall.

Now back to topic. Why can't users use root all the time? Every time I have to do changes on my Linux box I have to use a root-user, thus I use root almost every day. It sux, and I've started using root as my primary login. Ofcoz I could do a rm -R / * or similar, but guess what? I don't care!

It's all about functionality and user experience. Security people can just "stfu" coz they just disable the most used features at your computer.

In the end you have to respect users and their need to
a) learn about the computer by doing mistakes
b) trust that the general hacker do not want to hack you unless he has a good reason
c) see in the real world how things seem to work, even if you did not protect it like a child in a baby buggy

Why not root?

[sheriff_smith]

I am a UNIX geek and I have used UNIX all my computer life and as such I expect a level of security with my systems. I have always built my own firewalls and reinstalled my systems when they came preinstalled. So as a UNIX geek I would never log in as root, however most sane people just want to use their computers and not worry about logins and such. Most of them have a different level of security that they want and are used to. I think more than anything this is a personal preference issue on a SINGLE user system.

Re:It's all about functionality and user experienc

[Anonymous Coward]

Is typing su really all that difficult? I can agree on running windows as administrator (as long as your change the account name) but only for the simple reason that to do much of anything useful you have to log off and log back in. If I could just open the command prompt and switch to admin, I would never log in as admin again.

Misconception of mac users

[uglyhead69]

I agree with your position that GUIs are less dangerous while root than CLIs are because GUIs execute gestures which have zero chance of a wildcard typo error. If one examines most of the other arguments presented by slashdotters for not using root, they seem to have to do with chowns, and rms gone awry. There is certainly no risk of that in a GUI.

However, I think you have a misconception of "classic" mac users. I would argure that because in order to log in as root in the first place, the user had to go out of her way to enable root in netinfo, this implies a certain level of sophistication, or a least a desire to learn the ropes and gain a greater understanding of the system. The behavior could have been motivated by doing a lot of su commands that the user viewed as tedious and hence sought an alternative. Which implies command line use.

I think the important question is WHY on earth do these users find themselves requiring superuser privleges in the first place? Its probably because they want to tweak the system, which mac users are notorious for, so they may as well resign themselves to having to re-install the system at some point.

I think the problem lies in recommending root-running to others. The argument should be presented like this:

root is there as a layer of protection, to protect you from yourself, and to protect your system from things you might download that could do bad things to your system intentionally or not.

If you run as root, you lose that protection. Take it or leave it, but if you recommend that others also abandon the protection that root provides, please provide them with the coutesy of explaining roots purspose in protecting them from themselves.

root is ok

[mozkill]

don't forget that part of the reason that people make such a big deal about logging in as root is that Linux geeks have ego. they like to think that since they always SU and SSH, they are "cooler" than the next guy, and so this Root problem gets preached a little more than it should.

on the other hand, the dangers of logging in as root are valid. personally, i log in as root all of the time because there isn't a single thing on my system that i couldn't fix if i needed to. for me, its "cool" to be challenged to fix it, so as far as i am concerned, "bring on the hackers"...

in a production environment, its obvious that perfect paranoia is the only way to go though. :-)

It's funny...

[gamgee5273]

Those of us who would be able to responsibly handle using root as our primary login don't.

Those of us who might not be able to responsibly handle using root as our primary login want to.

For the record, I have root enabled - but I rarely log in with it.

wrong question...

[teridon]

The question should be, "Why do people who don't understand root access have it?"

Perhaps you should lobby the companies these people work for to have their root (or admin) access removed :)

Re:wrong question...

[closedpegasus]

Because they own the fscking computers. sheesh. These aren't necessarily people at the office here.

Have your grandmother try to read this thread...

[frenchgates]

...to understand why *nix is not ready for home user desktop prime time.

Go Ahead and Root

[opusuno]

The concept of permissions is too far above your average Mac user... But they'll eventually learn the hard way by getting hacked or removing something like the file system. But the common thread i see here is: "I don't really care" ... I say: With that attitude, niether should you.

Re:Go Ahead and Root

[stux]

My solution is to change the root passwd on peoples macs that I setup... and not tell them it.

Works wonders.

I also don't tell them that they can change the passwd with the install CD.

The nifty thing with OSX is, it does tend to work.

Re:It's all about functionality and user experienc

[infernalC]

First off, if you have any sort of connection to any sort of public network, especially the Internet, YOU ARE A DESIRABLE TARGET.Your machine gets bandwidth, and bandwith begets DOS attacks.

Secondly, I log in to an NT workstation as an admin a lot too. But on NT, a lot of system stuff of hard to get to and accidentally delete. If I happen to be in the wrong path on a UNIX system and type 'rm -fr *' I could be in deep shit, but if I don't go around carelessly wielding a root UID, then I protect myself. It's a bit like keeping the safety on a rifle. It's just a good idea.

rm -rf /*

[josepha48]

As a user with no privelidges and see what happens and then as root.

After they have wiped out thier system ask them if they know how to install the OS ;-)

Its sort of like NT do you give all your users admin priveledges or just the ones you trust?

CLIs are not the only way to get something done

[huginOGmunin]

Any halfway smart(lazy) mac user that needed to rename 1,000 files would use DropRename or some other util.

Run Root only when you need it Command line GUI

[jellomizer]

Not Running as root is a general safety factor in many aspects some that are stated and some that are not.

1. Running as root is not forgiving of simple typo's rm ~ /* is a desasterous command. Also sometime I acedently click and drag a folder into an other folder. Doing this as root would alow me to move stuff that needs to be in its place to an other spot.

2. Not running as root is one of the first line of defence from protecting yourself from Viruses and Trojans. If you dont have access to mess up your system good chances the file attachment you opened up will not have permission.
3. Programming as non-root is good it could prevent you from accedently messing up important files Say you open("file","w") except for a open("file","r") and say file was /etc/passwd

4. Stops you from making a mess of your file system. Say you were in /lib directory but you forgot about it and downloaded a file there. Then when you actually needed the file you cant find it so you have to run the find command. With a restriced access it allerts you that something is not right before you wast time.

5. You know when you are doing something that may cause problems. If you cant do it as your own account then do an sudo to run it this makes you concious that you may be doing something that may damage the system so you will be more alert.

6. Sometimes other people use your computer and they may not be as carefull as you.

7. On multy user systems it may make people feel unconfortable if you use root all the time because they have no sience of privacy of there home directory. (This is a weak one but its true)

8. It is a lot easier to crash the computer as root and running apps as root. You cant always trust other people code

9. Loggin in as root all the time increases the chance that someone snooping your network will find the root password and create real damage.

10. Some programs may give them selfs a lower (nice) level and eatup your system resourses.

In generally running as root needs you be on on edge when ever you do something and the potential cost outwaigh the benefits

rm -rf ..

[pruneau]

OOoops

Re:OS 9 like? Nope.

[devonbowen]

Toss your kernel? SURE!!! No problem! BAD idea.

Many years ago, as a university sys admin I remember getting a call from the music department for help. Their NeXT machine wouldn't boot at all. They had been "cleaning up" the disk space and - you guessed it - they removed that big "vmunix" file.

Devon

Kill 1

[Anonymous Coward]

Here's my root story -
I am an administrator of an OS X Server box, and I was trying to stop some job that had been screwed up. On accident I typed "Kill 1". This was a Very Bad Thing. Lesson learned.

-> c h i e f

Re:Have your grandmother try to read this thread..

[buzban]

good ppoint, but that's probably also why root is disabled by default...

Re:OS 9 like? Nope.

[Morth]

If you have MacsBug installed (the system debugger) it brings it up with a cli.

If you don't, it brings up a modal dialog box with a prompt that simple remains until you type g on a single line or you hit the hard reset button. Needless to say, not many knew what to write.

To be fair, you could also type G <address> where address is what you want to set the pc to, but how useful is that in an OS with mandatory PIC?

Practical Reasons

[boyko]

As an OSX user, I'll submit that most users aren't going to use the terminal. For me though, sudoing root makes sense, mostly because if, god forbid, my HD is wiped out, backing up my ~ directory means all my stuff is in the right place when I reinstall. Brian.

Re:OS 9 like? Nope.

[Anonymous Coward]

or you can type G FINDER which (iirc) kills your current task and kicks you back to finder (relaunching if needed).

or you can type DM XYZ where XYZ is a memory address, and display the memory at that address.

theres probably a bunch of other commands too, but I don't know them. Generally, ditching the builtin debugger for macsbug is a good plan.

I always love seeing the look on people's face when they see a legacy mac drop into the macsbug CLI. :)

I enjoy not having root on

[eet23]

It's nice to know that I can't do anything to my computer that will destroy anything other than ~/ I feel that the effort of reinstalling everything is far greater than the effort of typing "sudo"

Re:Have your grandmother try to read this thread..

[Mignon]

Have your grandmother try to read this thread... ...to understand why *nix is not ready for home user desktop prime time.

Have her read at -1 to never speak to you again...

stupid newbie question

[margaret]

I'm new to both macs and unix, and at the risk of opening myself up to some flamage here, I have a supid newbie question about this root business. Now that we've established that logging on as root is bad, how do I know if I'm logging on as root? When I got my ibook, the os x setup created an account for me, and I've always logged on with it by default. I've done some minor tweaking (like changing the system icons) that requires the terminal and commands like sudo. So am I logging on as root to be able to do this? If so, what do I need to do - create another account for myself?

Re:stupid newbie question

[DaDigz]

Nope.. You're logging in as an admin user - which is perfectly fine IMHO and much safer than running as root.

Sudo lets you run commands as root without actually running your shell or whatnot under root - when the program is finished, so is your root access and you can't foof the system by accidentally doing rm -Rf / or something.

Why people log in as root...

[poiuyt23]

People login as root because they just want the damn machine to work. Apple users are not Unix users - and they never will be. Your best bet is to tell people to keep a current copy of all software they have installed and their home directory backed up. I totally understand where people are coming from on this one. Ever used fink to install darwin software? Hope you are very familliar with the command line to get all the source packages out of the /sw directory it creates...

two ideas

[Anonymous Coward]

my first idea is let them all change to root and find out how powerful it really is. if they want to pay 2 grand for a new system let them. My second is become admin and change all the people's posts encouraging root usage to discouraging root usage. if the second way doesn't work, then the first way will i guarantee it.

Two good reasons together make .....

[Dimes]

....an even more significant reason:

1)As root you have the ability to not only do damage to your own user files...but you have the ability to damage/destroy the whole system. Being a user on a UnixOS is one of its beauties. No matter how bad you screw up as a user, its only your files...the system will still be there.

2)OSX runs a number of Microsoft Applications....i.e. the Office Suite, and Outlook...which are notoriously prone to security problems.(albeit, quite a bit less on Mac)

Mix those two reasons and you get something like Windows, where one script sent by email, clicked on by an /uneducated/ user(and sometimes not even clicked on...just received by something like Outlook) while logged in as root....and poof there goes the whole machine....lucky, at least for the rest of us cause at least that users box is gone.....or really unlucky for the net community at large if the virus/worm/et.al. keeps the machine and starts doing nasty self propagation.

So, just dont do it. There is so little a regular user needs root for...and for that Apple has provided sudo....built in from the start.

Dimes

Accuntability, least privilege, limiting impact

[Xenophon Fenderson,]

In my analysis, there are three reasons.

1. To make individual administrators accountable for their actions by creating an audit trail. If multiple individuals use the "Administrator" or "root" account, the source of errors is obscured.
2. To implement the principal of "least priviledge". Where possible, system access accounts will be assigned the least amount of priviledge possible (e.g. put a name service administrator into the "DNS Admins" group instead of "Enterprise Admins"). This may limit the degree of damage caused when a particular priviledged account is compromised, although it introduces communication complexity among system administrators and users.
3. To limit the impact of accidents. By forcing administrators to use a non-priviledged account for regular tasks, the chances of accidentally damaging the network or any shared resources are reduced.

Re:Root is like a nice crack

[jo42]

Got root?

Re:OS 9 like? Nope.

[Anonymous Coward]

If you want your Mac to run "More OS 9 Like", how about run OS 9. If these people don't have the sense to log in as a user and su to root when needed, let them learn. One day they'll f*** up and realize, "Ohhhhh!!! That's why I should log on as root."

cd /
rm -rf *
reboot

Have Fun!!

Re:Live and learn and then get Luvs

[Anonymous Coward]

Where are my Luvs to collect all of the bullshit in this thread?

Why root?

[zenasprime]

I don't get it. Why do people feel the need to be root anyway? I have been an OS X user since Beta. I host my website on OS X and recently OS X server. I have configured Apache, BIND, Sendmail (ugh) and Postfix. I compile C++ source from the command line. If for some reason need to run a command as root (which can be frequent) i use sudo. There is a program called pseudo that will run apps as if they are root by drag/drop-ing files on top of it. If the user is an admin, they can config the system and install by simply providing their passwd. I have activated root from NetInfo to access certain functions but never once needed to log in as root. What is all the fuss is about?

z(p)

It's mostly an ego thing...

[heathrow]

People log in as root because it gives them all the power they could ever need (and more!) at once. They believe that they will ne'er ever mistype something.
As others have said, let them do it. Then sit back and watch them scramble after they hose their system in a big way...

Dumb Mac User Fights Back

[Anonymous Coward]

I am a stupid and ignorant Mac user (see above). I do not wish to run a server. Others will not be using my computer. I know how to install Mac OS 9 & X System Software (duh). I used to know how to back up my whole disc including my system (in OS 9). I can think of a long password and remember it. I dislike the long steep learning curve of Darwin/CLI, notwithstanding its impressive features. I frequently boot into mac OS 9 as it is the only way to solve real problems to do with old software, peripherals, drivers, and interface irritations, not to mention MY sheer speed of work.

Since I
1) always did know how to, and had the right to trash my OS 9 system, and never once did it, even by accident
2) don't intend to use the terminal if I can possibly avoid it,
I have found that logging in as root is the simplest way of overcoming the obstruction and frustration that OS X's unnecessary (for me) permissions scheme brings.

Contrary to what most /.ers seem to believe, the average Mac user gets a lot of real work done, but is not interested in running a multi-user time-sharing network available computing resource. Not yet, anyway. I think Apple should work on a default but optional simplified interface for those who chooose not to learn a lot of complicated Unix-technique that is of no interest to them. This is meant to be a consumer OS too, don't forget. I am fed up with being told by the system that I can't copy/open/trash certain files. I am fed up with trying to work out how to perform simple tasks like backup preference files or change my long user name.

You're right - we Mac users are too stupid to use the terminal on our laptops so like idiots, we just drag any old thing around the screen and that is exactly why it doesn't really hurt to be root.

^admin^root

Another reason not to log in as root

[Anonymous Coward]

Since it's been done once, I'll chime in too. I work for Apple as part of their technical support team.
I'm not someone you would probably talk to anymore if you called in, but I have talked to many customers in the past who had done *bad* things, either by logging in as root, or by moving things around in OS 9 without thinking. If the customer had moved stuff around in 9, sometimes you could get it back in place and things would work, since 9 didn't touch (but seemed to preserve) the permissions. If it was done as root, quite often permissions would get changed and honestly, it's more trouble to fix hundreds of files than re-install.

Ok, so now you're up to re-installing. No big deal, right? Wrong. If you have a CD for 10.1.0, and you've upgraded to say, 10.1.2 - you are no longer able to just re-install. In this configuration, you would be required to erase and install. So wow, this looks bad now, huh? All this trouble because you want to mess around with stuff in /System (which should never really be necessary - unless you are a developer, or possibly a server admin who needs some custom startup scripts)

Like the other gentleman from Apple who compared this to opening a panel of a device clearly marked "Do no open" - this kind of situation reminds me of something these mac users who want to log as root would NEVER do. Ask them if they would use a soldering iron to modify their logic board to make the computer run faster. If they answer "yes" then they are hopeless. If they answer "no, because then my warranty would be void," then tell them that's like what they are doing to their OS. They are putting their OS in an "unsupported configuration" that they cannot receive technical support for. Returning the machine to a supported configuration (i.e. an OS that works) - and they will receive technical support. In most cases, doing this requires they wipe their HD, or learn UNIX real fast (this of course assumes that single-suer mode still works).

I don't want to sound like Apple tech support isn't going to help you if you use root. We absolutely will. We will, however, politely ask that you log in as a different user. As far as fixing permissions - in some cases we can quickly find the file/folder with the wrong permissions and fix it (userland stuff). However, if /System stuff is wrong, I don't think that ANYONE would expect (or want) someone to go through 10,000+ files in /System and /Private and make sure that they are a) present and b) have the correct permissions. In short, if you want to log in as root, that's fine, you can even get someone to tell you how most of the time, but once you are there, you are on your own. I don't think anyone would disagree with this at all.

why does everybody cite rm -rf?

[WebMasterJoe]

I understand that you can accidentally delete every file on your hard drive, but it's not as easy to accidentally do as so many people claim. You have to want to recursively delete all the files at a certain point in your directory tree - I personally never use rm -r and most people who don't understand the trouble with root wouldn't even know how to use the command. They're much less likely to type it in, and then even less likely to type it in when their pwd is '/'.

I think that the classic example also downplays the dangers of typing in 'rm -rf ~/' - back when I did helpdesk work I had many more reports of people erasing their personal files than system files. It's much worse in my opinion to lose all your personal files than to lose important operating system files because they can't be replaced as easily (and these people almost never make backups). These were Windows 3.1 and 95 machines usually, so there was not much stopping them from deleting crucial files except their lack of knowledge. And all they would have had to type is "deltree c:\windows" or "del /y c:\windows\*.*" from any command prompt.

So my point is that home users logging in as root is bad practice, but not likely to cause any problems that couldn't easily happen on most Windows systems (since XP creates passwordless administrator accounts by default I am including it in this category). If an OS X user (or desktop linux user for that matter) logs in as root all the time, and then one day royally screws up his/her system, he/she will probably be able to reinstall, or find somebody to reinstall, the system files that only root can destroy. The personal files, those which the user could have destroyed without root, will be deleted either way:

Geek Friend: You really hosed your system this time! This wouldn't have happened if you logged in with your unprivileged account.
User: So if I was logged in with my user account I wouldn't have been able to run 'rm -rf /*'? Odd that I typed in a command like that, which I don't even slightly understand...
GF: Yep, that would have prevented it. Lucky for you I can reinstall your operating system and applications.
U: How about all my important personal documents? Can you reinstall them?
GF: Nope, they're hosed. Too bad you logged in as root.
U: So if I logged in as myself those documents would still be safe??
GF: Well, no. You'd be just as hosed, minus me spending two hours reinstalling everything else.

So the lesson is: don't log in as root unless you know how to reinstall the OS.

Huh??

[Anonymous Coward]

"Apple users are not Unix users - and they never will be."

I have been a Mac user for 10 years. I became aquainted with the Mac in college, where I also used Windows and Sun workstations for awhile as well. I have always purchased and used Macs because of the high quality hardware and dependable operation at a reasonable price. Now I am reaquainting myself with UNIX because of OS X. Why haven't I been using UNIX before now? Because UNIX hardware was so expensive. With the Mac, I now have an affordable box to run UNIX on that's not x86 based. Moreover, Mac OS X has sparked my interest in Linux, where in recent months have began to use Red Hat Linux on x86 boxes at work (when it comes to my home machine, I'm always buying a Mac). In short, Mac OS X has drawn me to UNIX (using the command line), not discouraging me.

Re:Huh??

[poiuyt23]

Do you consider yourself to be an average Mac user?

Makes Virus infection harder

[Creepy]

Interesting that one of the main reasons I've heard for not running as root wasn't mentioned yet:

E-mail virus infection as a user other than root is MUCH less destructive than viruses as root, unless the virus compromises root.

On Windows 95/98/ME or MacOS 9 or earlier, running the virus infected e-mail compromises your entire machine and the virus can destroy everything if it wants.

On NT/2000/XP, things are a little trickier because the only user that has permissions to do everything is an admin user. Unfortunately, far too many people run as admin users on those platforms because that is the default setup. I've also heard it isn't hard to open back doors in other ways, but I haven't chased this myself.

Any UNIX variant including MacOS X - only the root user can erase everything or cause system instability. Also, only a root user can stop some processes, like your virus checker. Run as root, virus checker is down, virus is installed, Harddisk is wiped clean. Run as a user, worst case scenario, your user data is wiped out. Want a backup? have a cron job running as root copy the critical data once in a while (as non-execute).

More reasons:
You're surfing the web as root and run a java application. A malicious user exploits a java bug and uploads an exploit program that sends the contents of your entire harddrive to him and then erases the contents on your end.

You download a trojan program and run it. Running as root, you lose your harddrive. As a user, you only lose that user's data. Your system still boots and you don't need to reinstall all 25000 programs you own, only restore the data (which I hope you burned on a CD-R or backed up :)

A malicious Word macro virus can delete your hard drive as root.

You run as root. A malicious Word macro virus alters your mail server to be an open relay and sends an e-mail to spammers everywhere about it.

Notice the trend yet?

Hope that helps.

Re:OS 9 like? Nope.

[Dahan]

There wasn't anything special about "FINDER" as an address to jump to... the syntax of "G" is "G address"--FINDER was interpreted as address 0xF (I think). It's an odd address, so it'd cause an address error trap, which would kill your currently open app. I usually did a "G 1" instead... quicker to type and crashed the current app just as well :)

BTW, "SM" was another command you could use in Microbug... Set Memory.

Re:OS 9 like? Nope.

[Dahan]

FWIW, Mac Technote TN1136 has details on the ROM debugger, and an explanation of G FINDER. Turns out "FINDER" is interpreted as 0x00F27DEB

You shouldn't have to do that...

[GORDOOM]

In OS X root still has to give his password for authentication screens.

Actually, this is not the case. The whole reason why a non-root admin user has to give his password to invoke admin powers is to confirm that root powers are being invoked; it's basically like a sort of weird "sudo" command. When actually logged in as the superuser, this step is not necessary.

(The only exception is in some badly-designed apps that don't realise that they're running as root processes when you open them in root, and still ask you for the root password... arrgh! Take note of this rant, OS X developers!)

OT: what a maroon!

[Xtifr]

So is "viri"/"virii" an old joke! I know that I first encountered it in the sixties, as a little kid. My mom used it -- and she was an English major and professional editor and writer. She was well aware that it was incorrect, but it tickled her sense of humor (as did some other malformed words and phrases, such as "swell foop", which she used more-or-less consistently throughout her lifetime).

And how do you tell if people are using it "tongue-in-cheek"? When people use "boxen", they usually use it as if it were a real word, and don't draw any special attention to it. Pretty much the way they use "viri"/"virii". Unless you have previously unsuspected telepathic powers, you're using guesswork, and have no factual basis for your claim. Since I first encountered Tom C.'s humorless diatribe over a year ago, I have looked in vain for any evidence that anyone at all takes the silly misspelling seriously. I have failed to find any. It's a little more popular than "boxen", but then it seems to have spread through science fiction fandom, which was a little bigger and more widespread than hackerdom back in the sixties when all this silliness started.

As for the ridiculous "it's not proper Latin" argument, well, that's just dumb! This is English we're talking about, not Latin. Hell, the word "television" mixes Latin and Greek roots, and by the measures you're applying, is a REAL abomination. Why don't you start a crusade to stamp out the word "television" instead of wasting your time on a mild (and admittedly not-very-funny) joke.

Re:OT: what a maroon!

[foobar104]

Why don't you start a crusade to stamp out the word "television" instead of wasting your time on a mild (and admittedly not-very-funny) joke.

Because-- and I thought I made this perfectly clear-- "virii" was used in this context as a serious plural, with no sense of irony implied. That's not a joke. That's an error.

Like I pointed out in my previous post, "boxen" as the plural of "box," like "VAXen" as the plural of "VAX," derives its certain humor from the irony of the English language itself. If itself, "boxen" is a sort of joke about English. There's no good reason why one ox plus one ox is oxen but one box plus one box is boxes. It's just one of those irregularities. In other words, if a person honestly didn't know the plural of "box" and guessed "boxen," it wouldn't be a dumb mistake.

My circle of friends had a similar little joke in college: one deer plus one deer is two deer. Likewise, one beer plus one beer should be two beer. How many beer have you had tonight? I've had four beer. It was silly, but entertaining. Especially after four beer.

"Virii," on the other hand, comes apparently from nowhere. There's no rational system of pluralization-- or even a decent precedent in irregular pluralization-- that would lead someone from "virus" to "virii." If you want you can say "viri," although that's confusing ("vir" was "man" in Latin, and "viri" was "men"). Or you can say "virora," in parallel with "corpus" and "corpora," but scholars think that's probably wrong, and besides it's really hard to pronounce correctly. (The accent would be on the first syllable: "VYE-ror-uh," like "COR-por-uh.")

The bottom line is that "virii" is a made-up word. If you're going to play games with words, play by the rules. I don't care which set of rules you use, but play by some rules. There is no set of language rules-- from English, Greek, or Latin-- that would lead one to believe "virii" to be the plural of "virus."

So using "virii" in any sense, ironic or otherwise, just makes you sound ignorant. Even worse, it makes you sound like you're an ignorant person who thinks they sound like an educated person.

Re:OT: what a maroon!

[Xtifr]

Because-- and I thought I made this perfectly clear-- "virii" was used in this context as a serious plural, with no sense of irony implied.

Which is irrelevent because -- and I thought I made this perfectly clear -- "boxen" is usually used as if it were a serious plural, with no obvious sense of irony implied. When I see "boxen" used, it's usually in simple statements, like, "I need to set up a dozen boxen tomorrow". I assume (because I know these are educated, intelligent people) that the people who write this know better, and are in on the joke, but I can't prove it, any more than you or I can prove that people who use "virii" do or don't know better.

As for the fact that "virii" doesn't follow the rules of Latin, so freakin' what? That just means it's a different sort of joke! Personally, I fell off my chair laughing the first time I saw that spelling. But then, I'm not the sort of arrogant pinhead who assumes I'm smarter than everyone else (even though I usually am).

And the fact that it's a made up word is irrelevent. English is full of made up words. And it's full of words (like "television") that don't follow the rules. "Correct" English is defined as what English-speaking people say/type. If enough people use "virii", it becomes correct, whether or not the rules of some long-dead other language justify it or not.

i'm the user Pudge is talking about

[gsfprez]

and what led me to the question was the nth time i was unable, as the admin (the name put in at install time), i am often stopped at the gates when trying to read/write something to/from my wife's subdirectory /users/hotchick.

One fateful night, i was, yet again, doing some printing for her (the printer's upstairs where my machine and the printer is) from her TiBook, and so i logged in as me on her TiBook to print her stuff...

well, i couldn't get into her subdir... so i tried batchmod - and that doesn't (apparently) have a -R on it, so then i went to the CLI to

sudo chmod -R 777 /users

fine.

the GUI STILL wouldn't let me into her subdir until i rebooted the Finder... damnit.

then, later on that night, when she went to work on one of the files later, it turned out that when i had opened one up and made some changes for her, is changed the owner to adminboy - and hotchick couldn't open the files any more...

arrrrgggh!!!! Its my fscking computer, and i want me or my wife to be able to read/write either/or's files to our heart's content. This includes ~/pictures (where things _have_ to be for iPhoto) and other "predetermined" subdirectories.

i even went so far as to repartition the machine with a 18 gig primary drive, and a 2 gig hotchick_HD so that i could turn off file permissions..

of course.. that check box doesn't ACTUALLY work - because not a day later - after the fresh install and all - all her stuff is on the 2 gig part - and when i maked some changes, she wasn't able to open those files later.

so - if i have 2, and only 2, users on a machine that want to have separate logins (login-time differences, like desktops, Dock position, etc) but we want complete control of each other's files on the machine..

i don't want it when i edit a Word file for her that it makes it "read only" when she logs in later to work on the file.

so - that was, in a rage after the 100th time she came to me complaining that the computer wouldn't do what WE wanted it to do... in Pudge's conference..

:FOR THE LOVE OF GOD, I"M JUST GOING TO LOGIN AS ROOT FOR NOW ON, DAMNIT!

i didn't mean it.. but my quandry - non-system files being universally unprotected for all users to see and use - and how to get there in a very Mac OS 9-like way.... is still unresolved.

it doesn't nail down anything.

[Anonymous Coward]

asshole.