Likewise, any good administrator would *never* give out the root password to ordinary users. Ordinary users in any organization should *never* have access to priviledged accounts.

As far as ordinary users at home, they don't have access to a professional administrator to lock down their systems. There is nothing equivalent under Linux like OE's preview pane, with HTML mail, ActiveX and Javascript, turned on by default. If we're talking the ordinary home user here, they won't know any better to shut that junk off.
Nor would they bother creating a non-priveledge user to run under.

On that note, I have a Windows 2000 box. I installed the Palm Desktop software so my wife can hot-sync her Handspring. I created her an account in the "Power Users" group, logged her in, and attempted to run Palm Desktop. I got a message stating that only the Administrator could run the application. What good is that? So now I *have* to put her account in the "Administrators" group so I can run Palm Desktop and perform hot-sync operations. I find most Windows software written from the assumption that you will be running as a super-user. Unless the software is of a systems-utility nature, Linux software is written from an assumption that the user will be non-priviledged.

So, most folks are pretty much required to run as admin under Win2K and I assume WinXP as well. Couple that with IE and OE's horrible out-of-the-box vulnerabilities, and I think the author's point is well taken.


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/188/22862#22862