Re: Device browser, mounting, and other root tasks in KFM

> Pardon me for a silly question, but what is wrong with just giving
> write permission to /usr/share/wallpapers to other users?
>

The point is that we want things done on the fly.  For example, maybe
I don't normally want my USER account to have permissions to
/usr/share/wallpapers because them some mallicious program could
replace all of them with god knows what(binaries?).  However, if I try
to drag an image to /usr/share/wallpapers, it would be nice if it offered
me a password dialog so I could do it.

> And if there is some such reason, then is there any reason why one
> can't have an alternative location ~/usr/wallpapers which is writable
> by the owner?

The answer to the last question is because sometimes you want a
file available system wide.  My main interest is friends & family,
where things like wallpapers and mp3s are normally shared within
a computer.  I'm not saying it's impossible, just not very smooth.

> > But for the security conscious, I would just recommend a limit.  For
> > example, don't allow more than X incorrect attempts.  After that you
> > don't offer the password anymore, but just say "access denied" for
> > like 5 minutes or so with some instructions on how to reset the
> > clock--this is necessary as I have seen as my experience in Technical
> > Support.
>
> So lets see that I understand -- you are suggesting that since people
> are too stupid to install their own wallpapers, we should make it easy
> for them by giving them the root password anyway? Then, when they
> invariably get it wrong, we give them instructions how to bypass our
> security by resetting the timer.

First, I don't mean to offend you, but I would just like to suggest that when 
you read someone's responses, try to read them as intelligently as possible. 
If you try to read it in a stupid way you're definatelly going to see it that 
way...it's the same thing we see on Linux websites day after day.  We've
also seen the whole "you are saying because people are too stupid..." argument
more than enough.  What we are asking for is ease of use, which affects
everybody no matter how intelligent you think you are.  Okay, I know
I'm being pretty defensive.  Continuing.

So first, have you ever entered the incorrect password into a WinNT box
too many times?  And then it won't let you for a long time.  The whole
point of it is so that you can't just repeatedly try different things.  You
have to get the Administrator(if you aren't it) to let you try again(forgive
me if the details are a little off, I haven't used WinNT in like 2 years,
but I do specifically remember that you can't enter an incorrect password
too many times)  I really don't know what happens if the problem is that
you can't remember the Administrator password. But, the whole point is
that by including a delay, you are not allowing reasonable dictionary attacks.  
Even a three second delay will make dictionary attacks too expensive.  If any 
of you know about HashCash as a way of preventing Spam you'll know what I'm 
talking about(it's a way of making sure that the sender spends a few seconds
for each e-mail he sends...making huge spam attacks IMPOSSIBLE--although it's 
not very ideal)

Lastly, who said anything about giving the root password away?  On my
machine I already know it, as do most desktop linux users.  All we're
asking is a way to make our own administrative duties easier by offering
a password box.  The "Remember password" thing already exists.  By
adding a limited  number of attempts I'm suggesting INCREASED security
to that part of KDE, not less.

> That way, when Evil J. Cracker breaks into your system to install (say)
> a Britney Spears wallpaper, if he doesn't guess your root password the
> first few times, he can just reset the clock and try again.

That's correct.  That's how computers currently work.  Right now you can try 
to SSH into my machine(henryst.mit.edu) and try to guess the password.  There 
is nothing stopping you from doing that.  It'll give you three tries with a 
few seconds of delay.  When you're three tries are up, you can try again!!
I wouldn't recommend it.  If you want to break into my machine there's
many better ways than just guessing.

> > I have actually dreamed of this idea for over a year.  I am waiting
> > till I graduate to try to code this type of stuff myself because KDE
> > really sucks when it comes to handling permissions & administrative
> > stuff(except in the Control Center).  I think somebody should submit
> > a wish list.  This idea would be really awesome with the "remember
> > password" thing. However, there are two implementations I had thought
> > about.  One is, that you are in essence running "kdesu cp X X" after
> > dragging a file.  The other option is to have the whole view get root
> > access.  Something like the "Administrator Mode" used in the Control
> > Center.  This would need some obvious graphical indications that it
> > was root(perhaps a yellow bar along the side like in KMail that said
> > "Full Administrative Priviledges"  or some kind of warning logo in
> > the background of the window.
> >
> > Yes?
>
> This makes sense. There should be some sort of equivalent to su for the
> GUI which you can enter into and out of without having to open a new
> Konq instance.

I'm glad we have a consensus on something!!  Sorry for getting defensive.
I wouldn't had minded suggestions to improve the model I suggested, but you
shouldn't just brush ideas off without providing better suggestions.

See you laters,
Henry