Hacker News new | ask | show | jobs
by zufallsheld 2523 days ago
Comparing the shortcomings of rootless podman (https://github.com/containers/libpod/blob/master/rootless.md) and rootless docker, they seem almost the same. So this argument may not count, the daemon argument however applies.
1 comments

I wonder if we will ever get rid of the ludicrous limitation of the privileged ports. It's a mechanism that only provided some sense of security in the 80s.

The W3C[1] says "if you connect to a service on one of these ports you can be fairly sure that you have the real thing, and not a fake which some hacker has put up for you." Well, in 2019 computers aren't mainframes run by institutions and hackers can be root of their own system and run whatever they want on port 22.

It's such an incovenience that I'm sure it caused countless services to be unnecessarily run as root.

[1]: https://www.w3.org/Daemon/User/Installation/PrivilegedPorts....

Looks like starting with Linux 4.11 you can:

sysctl net.ipv4.ip_unprivileged_port_start=443

( https://stackoverflow.com/questions/413807/is-there-a-way-fo... )