[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Debian package manager privilege escalation attack



On Thu, Aug 12, 2021 at 01:12:37AM -0500, Brian Thompson wrote:
> Would you agree that there is an issue with sudo access that is enabled
> by default on most Debian and Debian-based distributions? The bug may
> not be in apt, but it definitely lives somewhere.

if those users are not trustworthy than the bug is giving them sudo,
nothing else. (Debian does not give sudo to users by default. The default
is to set a root password.)

if you give someone a gun for hunting (animals) and that person uses
the gun for hunting people, the problem is not in the configuration of
that gun, but that someone.


-- 
cheers,
	Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

Change is coming whether you like it or not.

Attachment: signature.asc
Description: PGP signature


Reply to: