Slashdot Mirror
Viewfinity CEO Says Many Computer Users Are Overprivileged (Video)
This isn't about your place in society, but about user privileges on your computers and computer networks. The more privileges, the more risk of getting hacked and having Bad People do Bad Things to your company's computers, right? So Leonid Shtilman's company, Viewfinity, offers SaaS that helps you grant system privileges in a more granular manner than just allowing "root" and "user" accounts with nothing in between.
Another useless slashvertisement. People don't use the granular permissions that exist already (e.g. ACLs), no one's going to bother with even finer grained control. The problem isn't granularity, it's a completely understandable dislike of spending time managing permissions.
Give me Classic Slashdot or give me death!
and it asks for the root password when adding a new wifi hotspot.
Most of what I'm seeing there we already achieve through Active Directory without any third party solutions. Any company that only implements two levels of permissions (root and user) is either stuck in the 80s or else only has one user.
This seems to be an advert for some sort of sorry Windows admin tool. WTF?
Your site.. feel free to disagree.. but I think you're making a huge mistake with these ads.
There has to be some separation between the ads and the content. No one is going to visit a site explicitly to see ads. And if the content becomes the advertising, users will leave.
I can't think of a single successful site that has advertising as the content. Nytimes, washpost, wsj, digg, ... There's always separation between the content and the ads.
With the solution being....'Buy our product!'
Too many fucking commercials on this Slashdot TV channel. Anyone got a Tivo'd version of Slashdot I can read?
First and last time watching slashtv.
There have been much more granular permissions on Linux and all other Unix-likes for decades as well.
This is very advertisement-centric, that's all.
This is the second one of these non-stories posted in as many days. I, like many people, have been reading and posting to Slashdot for years. I'm starting to wonder exactly why I continue to do so....
I was raised on the command line, bitch
"Nemo me impune lacesset"
This is very Linux-centric. There have been much more granular permissions on Windows for probably well over a decade.
Most Windows users for the last decade have run as 'root' since it's the default on XP, and there have been much more granular permissions on Unix for decades through group permissions.
Not to mention technologies like SELinux and Apparmor.
The days of UID 0 being king and everyone else being a peasant have been over for a long time. Some examples:
Solaris: Root is a role, not a user.
Linux: AppArmor and SELinux come into play.
AIX: Root can be removed and assigned to roles, where UID 0 is just another user.
BSD: Plenty of ways to limit access via ACLs and other mechanisms.
OS X: Root has to be explicitly enabled.
Pretty much, the only reason the concept of root exists these days is a "master override" when one just needs to get something done without roles/ACLs/et. al. coming into the picture, such as doing hardware configurations, or booting from recovery media. Almost all new operating systems tend to not allow the user to run as root unless it is explicitly enabled.
This "slashdottv" thing is pretty much turning out to be "yourdailyinfomercial".
Anyone got a good suggestion on how to filter this spam out?
Welcome to the Panopticon. Used to be a prison, now it's your home.
Not quite. Not even Administrator is root. LocalSystem is root.
We're supposed to pay for a product that effectively replaces sudo & user/group privelages?
That's why Bill Gates made the Windows so successful. Make things simple, who cares (except geeks) about how you make it as long as it works.
This is very Linux-centric
No, it's very UNIX Release 6 centric. It hasn't been true of most modern UNIX and UNIX-like systems for about 20 years.
I am TheRaven on Soylent News
... security to begin with. The problem was no one predicted the internet would become the thing it was and most people are not intelligent enough to be using connected PC's to begin with. It's about the cognitive level of intelligence needed to be using such machines to begin with. It's not hard to keep safe without overbearing security and permissions it's about being intelligent about what kinds of machines with certain data you hook up to the net to begin with.
Lets remind ourselves that it is usually the users themselves that get into trouble by downloading or running things they shouldn't be. And many hackers would naturally "socially hack" people rather then 'hack things the hard way'. Security is only as good as the people who use your machines anyway. The idea that it "Users are too privileged" is a farce.
Most Windows users for the last decade have run as 'root' since it's the default on XP, and there have been much more granular permissions on Unix for decades through group permissions.
Running as admin on Windows doesn't give you access to groups you're not a part of (though you can jump through some hoops to alter permissions on anything if you really want to). Proper group permissions have been in the Windows NT and NTFS codebases since very early days.
Anyhow, XP has not been the latest Windows for most of the past decade. It's been more than 5 years since the latest Windows release had you running as the administrator account by default.
Socialism: a lie told by totalitarians and believed by fools.
Sure, if he is talking about on a windows machine, but on linux/unix/bsd/osx, this already exists in sudo. If you need "root" privileges for something, you setup a sudo rule for that individual user for running that individual command.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
I notice an Ad tag on this story. Can I filter so I can't see these anymore? I come here for the content, not the adds. However, to support y'all I don't hide the "official" adds. However, if these slashvertisements keep up, I may have to rethink that.
Don't block my access to anything! Also, remove those "safety" things from my table saw!! And "protective eyewear"?? How can I cut when I can't see!? Those come off too.
It's an ongoing battle in my agency to fend of user's who want admin rights. It's even harder to remove admin rights from user's who already have it. Particularly on laptops. We have instituted various mechanisms for software installs thru a process but these users are still a pain in the ass.
No it's not. There is no direct equivalent to root in Windows. The concept of a superuser simply doesn't exist in its security model.
They way I see it, Viewfinity's CEO not-so-subtly says that people should not have control over their computers, and offers SaaS so that Viewfinity can assert that control.
I'll go sorta OT here, but I am fed up with articles, here or elsewhere, that can be summed up as "here, watch this video."
Thanks for making me ingest content at the speed of the slowest talker in the video, not at my reading speed.
If you post a video in lieu of text, you just wasted the world's time.
---------------------------------------
Rotate the pod, please, HAL....
I've also used the mac sandbox. this is pretty darn cool. [...] I don't understand why every app is not in a sandbox these days.
The last time I checked, the Mac OS X sandbox allowed access to user-specified files, but there was no entitlement allowing scanning all files in a user-specified folder. A program that backs up your files or performs batch operations on all pictures in your camera's memory would not be able to run in such a sandbox.
Running as admin on Windows doesn't give you access to groups you're not a part of
If you can add yourself to a group, you're part of that group for the purpose of any competent security analysis.
Come on slashdot... If i wanted to read stuff like this i would read my email spam folder. I refuse to get sucked into discussing security when this is just blatent pulp advertising. Booo! Hisss!
But it's different from Unix root - you can't accidentally change stuff ACLd to a group you don't belong to, which is the vast majority of problems. If you want to stretch the definition (or we're talking about malware payloads, not user error), anyone can add themselves to any group, because every OS will have some sort of priveledge escalation flaw somewhere.
Realistically, if you care about groups, you're in a domain and you're not running as the domain admin.
Socialism: a lie told by totalitarians and believed by fools.
What we have here, is a failure to communicate...
It's not the user.
Nor is in the internet
Nor is it the administrator
Nor is in the OS vendors
It's a very deep paradigm/vocabulary issue
The problem IS lack of security.... quick... how can You, in YOUR CHOICE OF ENVIRONMENT tell your OS that you want a program to enforce this set of rules on a program you want to test:
If you can even begin to fulfill this list of un-restrictions, you're probably approaching it in terms of a locked down user account, which is exactly the problem. This list of un-restrictions is otherwise known as a capabilities list, and should be assigned on the basis of the needs of the moment, not some static definition.
If you can't even express the correct answer, you'll never get it right.