Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

That is the same mindset as users who say they have nothing to hide so they don’t need to use a strong password.

Unless your computer is air-gapped you can’t trust it to run only the code you expect.



The decision on how much effort you expend to secure your particular system(s) often comes down your perception of risk and reward (and it's worth emphasising that word perception too).

There's usually a cost associated with greater security[0], and generally a balance that is struck. You can argue whether a particular system should lean further towards security, or further towards lower-cost, but ultimately there'll be a judgement call.

I'd suggest there isn't a single correct answer for this.

[0]whether in actual dollars, ease-of-use for users, time-to-market or possible reduction in feature set


Indeed, many people make wrong decisions based on incorrect assumptions.


At present time using separated user account gets very little from a security point of view judging by number of local privilege escalation bugs that are constantly found for common Linux setups.

In our case if the malicious code will run on those shared boxes, it implies either a bug in ssh or an Ubuntu software update bringing malicious code or an attack through a hacked computer of one of the users. In either case protecting other users from the effect of malicious code on those boxes will be the least of our worries. Yet the separated accounts do have substantial usability overhead.




Consider applying for YC's Fall 2026 batch! Applications are open till July 27.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: