[Ti] need root help

[Kynan Shook]

Well, it's certainly never a good idea to use the root user for 
anything, unless you have to.  However, simply having it *enabled* is 
not a security risk; the security risk comes from using it when you 
shouldn't be.

And no, it's almost certainly not a backdoor; this is on a computer 
that is used only an hour or two per day, is always behind at *least* 
one firewall (and one or two levels of NAT as well), has no E-mail 
access set up, and is only used for browsing a very small selection of 
websites, of which I trust all of them.  Furthermore, it contains no 
sensitive data (not even my passwords), so I'm not too worried about 
it.  It worked as expected the first time I was working with it, so I 
expect there's probably a corrupt preference file somewhere, or perhaps 
NetInfo got screwed up...


"Tom R. no spam" <tr5374 at csc.albany.edu> writes:
> Various attacks activate at the privilege level of the active
> legitimate user or the active process.  Avoiding root as much
> as possible is a standard security measure.  Cf the current
> Secunia 11622 security problem with OSX (which I think has been
> brought up on this tiBook list).  Note one of the interim "Best
> practices recommendations" is "Do not surf the Internet as a
> privileged user."  Some suggest creating a separate non-admin
> user and web browse only as that non-admin user.
>
> http://secunia.com/advisories/11622/
> http://www.euronet.nl/~tekelenb/playground/security/URLschemes/
>
> Actually, FWIW, Kynan's description of the root user pecularity
> he ran into (while testing about the Dvorak issue) sounded to me,
> from the incomplete info given, not inconsistent with a possibility
> of a root-level-access backdoor being present.