Comment Who the hell gives a coding bot access to 'root'? (Score 1) 45
Seriously, root is needed for software installation and updates (and not always even that) and that should be IT. Done. finito.
Yeah, individuals may have root access (but in corporate situations, even THAT has some limits to it - e.g., I can't see the that the 'spyware' I know is on my work machine actually exists. I know it does (because, for example, it is blocking me from screen-sharing to my AppleTV even off the firewall)).
But on a shared machine like old-school Unix minicomputers, that stuff is off-limits except to admins. This actually proves why that was the case - individual users can't be trusted with 'root'. And now we know that extends to non-sentient 'users'.
So this may prove that the bots are going to abuse their powers and therefore shouldn't be given any...but it also proves that the admins of these boxes that the bots are running on have about as much concern for real security as they ever did...which is to say, next to none until the exploitation is already out there.
This is a task that only required standard 'user' access - get the original software, get the dev tools needed for the new language, and have the tools for running the original to check parity), and that's it. They needed nothing more. They didn't need root, they didn't need email, they didn't need the ability to write commits to the others' repos. They needed the tools to do the job, nothing more.
Just like real users.