Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I've seen schools do this. My old high school had macbook airs available for checkout at the library, as well as the desktops used for printing. Obviously the student user did not have admin access, and a student could trivially gain it using this method, opening up the systems to all sorts of nasty stuff.


The key here is the user needs to possess admin credentials; the prompt itself is just a prompt, think sudo/su. I fail to see why random students would have admin credentials.


Oh, ok I didn't read the original article thoroughly. The user still needs to give it the admin password, but the installer can be modified to also execute arbitrary code as the root user.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: