Baslinux mailing list

[sindi keesan <keesan AT sdf.lonestar.org>]

On Sun, 28 Jan 2007, Samual Acorn wrote:

> > Should I worry about running anything offline as root?
>
> the rule of thumb is; only run as root when you absolutely have to...
> 'root' is for system administration/maintenance... not for regular
> use...

Steven says it is okay with BL offline.

> > If you try http://www.securityfocus.com/vulnerabilities instead and
> > enter "Opera Software" and then "Opera Web Browser" in the search form
> > you get a long list of (known) bugs along with their security
> > implications and possible fixes or upgrades. A Google search for '"opera
> > 8.52" security bugs' has http://security.nnov.ru/soft/8550.html as first
> > search result. This page says:
> >
> > "Integer overflow on long stylsheet sttribute. Can potentially be
> > used for hidden malware installation."

I checked this site and found only something about DoS and Opera 8.52, one 
bug in links2 that was fixed in later versions, and no vulnerabilities for 
lynx.  I am probably using the site wrong.

A search on lynx 2.8.5 and security bug found something to do with CGI 
that redirects you to a URL which can execute things as the user.  So this 
is a reason to use lynx as user not root.  I think.  They fixed this bug. 
David Moberg compiled a lynx 2.8.6 but that version was particularly buggy 
and could not access a lot of websites.  Maybe it is time to compile the 
latest stable version against uClibc again.

su user lynx

I think I could only save files to /home/user but I can move them later.

sshd also had a bug fixed.  I can't understand if this would affect me 
because it has to do with running scp.

Maybe someone more knowledgeable wants to check this all out.

Sindi