macos you do

microsoft doesnt want to annoy people, but in a corporate environment this requirement is fully implemented on windows.

i was never under the impression macs belonged in a business environment. maybe apple just doesnt find that level of security important.

If it’s such a big security risk, how come the most popular and widely used operating systems in the world and their users seem to be unaffected by it?

Are they though? My corporate managed Windows machine either refuses an elevated command or asks me for my password/fingerprint. Same with macOS. Just because you don’t secure your Windows machine doesn’t mean other do the same.

I guarantee, most new users coming to Linux from Windows/macOS are going to laugh and look at you funny if you try to justify entering your password again and again and again.

the least pressing concern for any Windows/macOS user. Besides, you can install user-wide application without any password requirement, if you want to change something on system level (and lets face it, when does a regular user does that on a regular basis?) you need to have some sort of security.

On macOS you need to do that quite a couple of times. Changing settings, installing stuff to run in the background, install stuff to open open login, etc. So it is there. Furthermore a lot of programs and guides for linux are written to make it easy so they use sudo but you don’t always have to run it as root. But not doing so usually requires more steps. So linux is more restricting but to circumvent that, people use sudo a bit too much.

You can easily fine tune what requires a password in Linux by editing the /etc/sudoers file.

deleted by creator

Mac uses TouchID for the most part in the GUI, but CLI sudo still asks for your login password, although it can be configured to ask for TouchID as well. The GUI does fallback to having you enter your password if somehow you have a Mac without TouchID.

Windows uses the UAC thing which currently we don’t have a great way to do on Linux but should be possible with Wayland (on Xorg you’d just need to script clicking yes and bypass user approval because there’s no security). On Windows when the UAC popup pops up and you click yes, you’ve done the equivalent of entering your password. In enterprise settings, it’s not common for it to be configured to actually ask your password, or ask the password of an admin account. So no it’s not “good enough” even on Windows under some situations.

On Linux you can configure sudo to use the fingerprint reader or a security key if you want. PAM stands for Pluggable Authentication Module, you can do whatever you want. You can also make it no password at all and sudo just automatically gives you root no questions asked.

The security use case is to prevent software running as your user to have an easy path to getting to root without some form of user approval. That also means if you walk off your desk to refill your coffee nobody can sneak behind you and plop a USB with malware, click yes and leave.

It’s doable on Linux with some PAM and Polkit tweaks, just not how it’s shipped by default because it’s better users voluntarily reduce their security settings than defaulting to minimal security like Windows used to (in particular the XP days before UAC, and UAC did annoy a lot of people when it came in with Vista and 7).

FYI, you don’t need to either on linux. Look up sudo.

I guarantee, most new users coming to Linux from Windows/macOS are going to laugh and look at you funny if you try to justify entering your password again and again and again.

That’s nice, but this ain’t MacOS or Windows. This is Linux.

Sorry but 20 years of “but this isn’t exactly like Winders11!!!one!” starts to grate on me. It’s a different OS with a different philosophy and a different workflow. Everbody coming from Windows had to learn to deal with the nuances of that OS as well, nuances they’ve completely forgotten about because it’s second nature.

I don’t WANT Linux to be exactly like MacOS and Windows. I want it to stand on its own, with its own ideas on how to run a computer.

Windows is historically a “single user OS” whereas Linux is historically a multi-user OS. They’re both multi-user now but the philosophy of these backgrounds results in what you see today.

So under Windows you login “as an admin” and don’t need passwords for many things - similar to (but very much not the same as) running Linux as root.

Under Linux you login “as a user” and need to elevate permissions for things which can affect other users on the same system. Typically with sudo these days.

These lines are very much blurring so you can do many things under Linux without a password and some things on Windows require “running powershell as an admin”.

I have to do this on both macOS and windows…

You can turn it off but you probably shouldn’t.

You do need to authorize admin action on Windows and it causes severe security issues, because people do it without thinking all the time.

You can also configure Linux to have this behaviour, but for security reasons it works differently out of the box. Also, some programs, such as many terminal emulators, can cache you PW so you don’t have to enter it multiple times.

I use a U2F key for sudo and it’s just one touch. One touch you need to sit in front of my computer for.

It’s not true admin privileges, windows won’t let you delete system32 the normal way, Linux on the other hand will tell you good luck and bail as you delete everything

AFAIK the user account created by default on windows will be a full privilege account, so won’t need a password to gain admin through UAC. Essentially the same as Linux where you can gain root privileges through sudo by using your own password.

But if you create an account with standard user privileges it will ask your for the password to an administrator account to gain admin. I’m not sure what the linux equivalent of this would be, denying sudo access would be too restrictive so maybe there’s an in between where you need the password to an admin user to gain sudo.

“You know what’s funnier? That theatrics you call User Access Control popup.”