OSNews

Everytime someone makes a comment like this, a puppy dies!

That's a bit of an odd design decision, to say the least.



While always logging in as root is indeed not a good idea it has little to do with compromising your personal data. Your personal data is just as vulnerable when you surf the net as an unprivileged user.

I know this is a stretch, but if you have a secondary user account for more important, confidential things like online banking and use the UNIX user/group/permissions system properly, then your banking stuff is pretty damn safe while browsing the web for porn or something on your standard everyday account. Just be sure to be safe and wear a NoScript condom and keep your vaccinations (system updates) up to date. Heh.

Yeah, I know that's completely not funny, but I just had to twist it in that direction. Hey, it still gets the point across.

Use 'chmod 600 filename' (for owner rw) or 'chmod 400 filename' (for owner ro) on files that you intend to keep private. Do 'chmod 700 dirname' on directories whose entire contents you want to keep private.

Hell, you can even just put your "confidential" user account in its own group; if you run Debian and don't change the defaults, this is automatically done for you... instead of, for example, user 'uz64' being in group 'users' he will be in a group of the same name, 'uz64'. Completely segregates users and all of their data. Might still be good practice to properly set permissions though, and if you're really extreme about security you'll want to consider encrypting your files.

Has there ever... ever... ever... been an actual documented case of a Puppy system being compromised due to this issue? Ever?

Running as root on Unix systems is anathema for any real use. It subverts the entire model of security and goes well beyond the browser itself. It's what made Windows ridiculously insecure to begin with, and that platform still hasn't entirely shaken the consequences.

Puppy: something to run off of a flash drive occasionally. Look elsewhere for a general-purpose system.

clearly it's anathema, that's obvious from pretty much every post on the issue. But I wasn't asking about emotions. My question was: is there any actual data?

No idea, but anyone knows it's insane to always run as root for real work where security is even a slight concern, and for that reason Puppy is nothing more than a toy to them. If you asked a security person to do real-world tests on Puppy to get this data and they'll probably laugh and think you're joking. They'd probably think it's retarded to even do such a test targeting Puppy specifically when there is plenty real-world data to go through on the act of just running as root/admin alone. It's well documented; it's bad no matter what, just because it's Puppy and its users seem to be crazy rabid fanboys doesn't make it better.

Edited 2011-12-19 15:14 UTC

Most likely not as usually Puppy is used just as a temporary solution and usually not run as a server. However, something not being documented does not equal that it has never happened.

Edited 2011-12-18 03:11 UTC

yes, yes I know absence of evidence is not evidence of absence.

But some actual *data* to base opinions on would be nice, wouldn't it?

Well I'd guess, at the least, it breeds people who think running as root is fine ...that alone is a bad thing, a bad idea to propagate.

(also: another reason for the more sensible all around Kitten Linux)

I do mostly agree with but this is something I don't understand: why would doing online banking or credit card purchases as root be any less secure than as a regular user? Your local user account bears no significance to the security of the data that leaves the machine, it doesn't carry over.

Running as root is bad because of LOCAL privileges, ie. a root user can modify system files, access other operating systems' disks and/or partitions etc. whereas a non-privileged user can't. But a non-privileged user can still access his or her own files, and a keylogger won't need root privileges to log what you're typing.

My point being that running as non-root is not some damn magic bullet after which you can just blindly trust anything anywhere.

Good answer.(actually the best answer i read so far). Even though the % of fraud is lower from computing, i tell my anyone when the subject comes up to not do "Online Banking". So, lets say you cannot get to "your bank" when you want/need.You can run Puppy from a CD-R quickly. Puppy was meant as a personal O/S. An alternative. You could spend your money, or someone elses, but, suit yourself.
*Sent from this old clunker P550 Intel 810 chipset with 192mb RAM.

If someone is interested here is the official security statement off the Puppy Wiki:

In Puppy Linux your user account is called root, but is not root. In puppy root is user.

More here: http://puppylinux.org/wikka/security

Also AFAIK some Puppy distros have (in addition to that) a special user named spot that is used when starting internet apps. (The distro I know that does that is FatDog64 - 64 bit Puppy Linux)

In addition Puppy always runs in ram not hard disk...

Edited 2011-12-19 19:52 UTC

That might be a good subject for a small article on this site. I will be curious about your results.

I will soon be migrating my system from a single OS to a VM environment with many small single-purpose VMs, so I am interested in lightweight, small footprint OSes. Even more than usual. ;^)

"Puppy is uniquely effective with slow or unreliable internet connections. It manages connections and prompts servers when problems occur. I have a friend who has poor line quality -- and few options, living in a rural area. He runs Ubuntu 10.04 LTS, Windows XP SP3, and Puppy 5. He favors Puppy because of its more reliable internet connectivity."

I was also wondering what this meant.

I've found that Puppy's package manager is more reliable for downloads. Of course all you have to do on other systems is install a free Download Manager and you've got the same thing, so no big feature IMHO.

I'm going to agree with the original author on this point - GRUB (legacy) was much better than GRUB2. I tip my hat to the Puppy developers for sticking with the old GRUB. I never understood why it was necessary to make GRUB2 so complicated to configure. Simplicity is bliss.

Edited 2011-12-17 05:43 UTC

Perhaps but there's little difference when it comes to how the gui works when selecting boot entry. Saying that it is unintelligible is nonsense because menu in grub looks and works pretty much the same way.
If it is cluttered then the same menu would be cluttered in grub.

Your point is well taken. However, the nice thing about GRUB legacy is that to reconfigure your menu entries, you simply have to edit file /boot/grub/menu.lst. GRUB2 is far messier - in fact, every time I've had to rework the menus, I needed to go back and read the documentation on how to do it. I actually find it easier to just nuke GRUB2 and install GRUB legacy, which is still available in Ubuntu and Debian (though GRUB2 is now the default).

Edited 2011-12-17 05:55 UTC

Yeah, configuring grub 2 is a horrible mess. Who's brilliant idea was it that the config directory should contain 1000's of files?
grub2 has one nice feature though, the rescue prompt. When grub1 fails to load you're left up shits creek without a paddle while in grub2 you get the rescue prompt and can actually remedy the situation and manage to boot.

That's a good point. Although GRUB is very reliable, it's possible to break it if you fool around (with root privileges). With GRUB legacy, if things get buggered, you might need a rescue disk. Well, that's actually one of the things I still use Puppy for (a rescue disk).

Edited 2011-12-17 05:58 UTC

'yeah' they did move it, so now it is harder? /boot/grub/grub.cfg is containing all the menu.lst stuff.

Good point. As per Distrowatch:

"The DistroWatch Page Hit Ranking statistics are a light-hearted way of measuring the popularity of Linux distributions and other free operating systems among the visitors of this website. They correlate neither to usage nor to quality and should not be used to measure the market share of distributions. They simply show the number of times a distribution page on DistroWatch.com was accessed each day, nothing more."

Also why would I as a happy Arch/Debian user ever visit those distros on Distrowatch?

Not to mention, Puppy has been releasing on new versions on a regular basis (monthly, from a quick glance on DistroWatch using the news filter) and recently made a release. On top of that, DistroWatch themselves ran a story/review... so duh, obviously it's going to get more page hits at their site.

Face it, the more often a distro puts out a new version, the more often DistroWatch puts it on its front page, the more often it's listed in DistroWatch Weekly, the more often that distro's page gets visited. More news means more visibility, and therefore more clicks. People like news, it interests them... simple. It's human nature.

Just right. I wish I could mod you up.

If you are used to a KDE UI, you might try a Puplet for newer H.W. . Teenpup 2010 beta has some KDE elements builtin and is better for P4 on up. And, you wont have to go out and "fetch" anything to do most of your stuff.