Linux ease of use

> That's only a good thing when you're installing something
> system-wide that could affect the whole system. But regular
> users *should* be able to install things on their *own*
> account that only *affect* their own account. And they
> *would* be able to do that *too* if it weren't for the
> fact that so many installers are just too inflexible.

I can understand some of your points, having been in a position where I
had to request technical support to get certain applications installed on
my desktop. However, as a system administrator for over 10 years and a
computer user for close to twenty, I can't agree with most of your
reasoning.

> I mean, sometimes you just need to get something installed
> quickly in order to meet a deadline: and going through the
> hastle and red-tape of convincing the sys-admin to install
> it for you could result in kissing that deadline goodbye.

There's a reason that I am hesitant to install packages quickly. For one,
there's almost no predicting what effect a new package will have on
existing applications, on system load, disk space, bandwidth usage, and a
host of other issues. Even a relatively benign program such as a new shell
or system libraries can have multiple unintended consequences. In the
worst case a package may contain SUID executables that, though were not
intended as a backdoor, can easily allow compromise. Many, many times I've
had to tell users that just because an application works fine on their
personal Windows or Solaris or Linux desktop does not mean it will work
the same on the server. In any case, it's my job that's on the line should
these programs cause havoc, not the end users.

> It is *not* a good thing if you miss a deadline because
> you're waiting for the SysAdmin to install a given program
> in "/usr/bin" when if only the installer had been more
> flexible you'd be able to set a preference variable to
> install it in "/home/myself/bin" (assuming that
> "/home/myself" is your homedir).

The worst users I've encountered are those are constantly need something
*right away*. It's as if their projects were far more important than the
System Administrator's responsibility to keep the servers running for
dozens or hundreds of other users. If a user cannot prioritize his time
properly, which means giving the SysAdmin advanced notice to either
install the application on a test server or at least get the approval of a
senior manager who is willing to take the risks, then I do not install the
software. Now I understand deadlines, having worked on both print
publications and on software projects, but this does not mean that the
SysAdmin is suddenly at fault because I didn't plan my time properly.

> There are some programs (such as CGI Wrappers) that by
> their very nature can and should be installed by only
> one user, the SysAdmin. But what is the *point* of having
> a CGI Wrapper? It's very *point* is to allow regular
> users to have their *own* CGI scripts without the risk
> of jeopardizing each-other's security.

CGI programs are notorious for buffer overflows and bad programming
practices. Why? Many of the authors are concerned mainly about getting a
web page working than keeping a system secure.  The problem with allowing
arbitrary CGI programs (read, those installed by users) is that the CGI
will run as the httpd process. This, in most modern cases, is either the
apache or nobody user. In some older systems it is root. An overflow or
cross site script vulnerability, even in the modern case, can easily lead
to compromise or data exposure.

> Any sys-admin who does that looses my business. I have
> no patience for admins who's idea of "protecting" the
> service involves crippling it.

Give me an example. As you know, there's always a compromise between
security and convenience. To be frank, I wouldn't work for a company that
had your attitude towards security and system administration.

>
> And I also don't want to give my business to any admin
> who will think of me (let-alone treat me) as a "minion".
>
> I use Linux because I don't like it when Micro$oft
> decides for me what I can do with their system. And
> likewise, I don't like it when the SysAdmin delibarately
> limits what I can do with my own account.
>
> To follow your suggestion would involve throwing the
> Golden Rule out the window. I don't take kindly to
> SysAdmins who try to prevent me from installing stuff
> on my own account.
>
> Software that I install on my own account does not
> pose a threat to system-wide security. It threatens
> my own account and *only* my own account. On the
> other hand, an action from the admin to *prevent*
> me from installing my own software jeopardizes
> the very *usability* of the service.
>
> --
>
>
> ------------------------------
>
> _______________________________________________
> annoyances mailing list
> [email protected]
> http://michelangelo.renaissoft.com/mailman/listinfo/annoyances
>
>
> End of annoyances Digest, Vol 2, Issue 28
> *****************************************
>


-- 
The Digital Hermit      Unix and Linux Solutions
http://www.digitalhermit.com
kwan-H/XkN3sKs40TjC5v63tWQwC/[email protected]