Secure Coding mailing list archives

how far we still need to go


From: band at acm.org (William L. Anderson)
Date: Wed, 25 Jul 2007 08:36:45 -0500

I was trying out a new web service that permits sharing files from the desktop
to others online. It does seem a bit dodgy, but I was curious about how it worked.

Well after a few attempts to install it on a Mac OS X system I finally dope out
that it only seems to install and run as admin. That is, I not only need to
install it as admin (that's OK, ordinary users can't write to the /Applications
area), but I need to run it as admin.

After a few e-mails to the developers I get the following response:

"the only other thing that I can suggest is to install it (and run it) in an
admin account. Starting from scratch. I'll have to log it as an issue that
non-admin users can't install it (I've honestly never created a non-admin
account on OS X and I guess no one else here has either because we didn't think
of it!)"

I am flabbergasted. When I first encountered Unix in 1983 I was taught that you
always run as an ordinary user, and only use admin (root) privileges when
needed. If OS X developers are running as admin, and building and testing their
products as admin, well ... I'm still in shock. And I weep for the species.

-Bill Anderson
http://praxis101.com/blog/
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 4546 bytes
Desc: S/MIME Cryptographic Signature
Url : http://krvw.com/pipermail/sc-l/attachments/20070725/962769b3/attachment.bin 


Current thread: