"Give them Linux boxes and they'll all be running as root"

That is actually what I thought, and exactly what is true. I have installed Linuxes and BSDs for many people, setup another account for them and explained exactly what root is for - you go back a few days later, they are logged in as root for the convenience of it all. You might argue that sudo can be set up in such a way that they can run any process as root through it, and thus a process they just directly execute (for example an email attachment) would not run as root - but this is a level of complication some people are not willing to go to for their web-and-email use of a computer (most were unwilling to listen to me about the su mechanism). I agree wholeheartedly with the post above - the problem is not the systems, it is the users.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/188/22784#22784