Hi Janra,

>From a security standpoint, obfuscation or hiding in plain sight is not
necessarily a security measure (My day job is a Security SE for a very large
network equipment company).  And you're quite correct about many software
packages advertising who is admin and who isn't (everyone else ;) ... I
would agree that changing the name is a prudent measure, but in addition, if
the search results left out any account with the UID of 1 that would hide it
altogether, thus adding another layer on the onion so to speak. :)

Just my thoughts.

Regards,
Steve


On Thu, Feb 21, 2008 at 12:25 AM, <janra at write-on.org> wrote:

> Well, there's nothing that says a) the admin account has to keep the
> same name, in fact I recommend changing the username just on general
> principle; b) the admin account has to be UID 1; c) there is only one
> admin account; d) some random yahoo couldn't make a user account called
> "site admin" anytime he wanted.
>
> If you wanted you could demote UID 1 to a regular user and promote a
> different user to admin. (But in the other order... always make sure at
> least one account is superuser unless you like mucking about in mysql
> directly!)
>
> There is no prevention in terms of searching for the entire list of
> users. Just as there is no prevention of searching and returning every
> comment or every story - in fact those are rather handy features to
> quickly find the most recently posted comments, for example.
>
> Given that a lot of software not only doesn't hide which accounts are
> the admin accounts but advertise it beside their username on every
> comment they make, I'm curious to know what benefit hiding the name of
> the admin account would provide.
>
> -janra
>
> On Wed, 20 Feb 2008 23:03:12 -0500, Steve Baetz wrote:
> > I noted a method in the list archives about using the Search function
> and
> > using a Find: Users with a blank string.
> >
> > Problem I see here is that this could reveal the admin account to
> someone
> > who may be looking for it.  Question is how do you prevent users from
> > searching for the entire list of users on the site?
> >
> > Though the admin account could be obfuscated by a different name, this
> is by
> > no means an effective security measure.
> >
> > Thanks.
> > Steve
> > _______________________________________________
> > Scoop-help mailing list
> > Scoop-help at lists.kuro5hin.org
> > http://lists.kuro5hin.org/mailman/listinfo/scoop-help
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kuro5hin.org/pipermail/scoop-help/attachments/20080222/77cff839/attachment.html