4. Privilege Separation

[@hoopssheaffer]

Great lecturer, great content. Thanks MIT

[@tetraphobie]

In case anyone else was wondering about the statement that "execute" on directories allows file lookup - see "filesystems/path-lookup.rst" in the kernel documentation mentioning it. Generally, the execute permission on a directory allows accessing its contents and changing the working directory to it, not just looking up path. Took me a while to make sense of all this.

[@enkh-uchralganbat6450]

trying to grasp the concept here but its difficult.

[@veramentegina]

fascinating lecture. and i thought i knew unix well. thanks MIT!

[@w3w3w3]

great lecture

[@IshanJain]

I think professor misunderstood something. At 1:09:46, He mentions each okcupid user won't correspond to a linux uid. The linux uid would be basically service id. So, Each of the different services(signup, forget password, etc) will be running under a different user. At 1:10:13, Some student, elaborated the advantages of aforementioned point. i.e. If one service is compromised, attacker can only get access to the service running under that user and everything else will be safe. Db proxy can have seperate instances running corresponding to each of the services that need db running under the same user as that service. At 1:10:42, He went off the tangent and said, Ok cupid probably didn't did that because there will be millions of process for each service and immediately after said, Spawning processes with appropriate user permission dynamically would be costly and perf would take a hit..

[@CarlosPerez-ql6nu]

Strongest Okay this side of the Missisipodomis river

[@egonkirchof]

The teacher looks like an actor I saw in moveis but don't remember his name

[@小六-o7o]

nice~

[@CyberTeach]

It's a good lecture, but it's almost like he didn't want to mention that peripheral devices are a necessary component to a working os.

[@GregDubela]

:D