engineers want root engineers get creative in breaking things they're often sloppy sysadmins (don't care, or don't know) smbclient password in sudo / sudoers 666 / apt downgrades, conflicts getsudo / corphost / DHCP/hostfile talk root mail: send to bofh-wks-root sudo mail cron mail redirect as much as possible REQUIREMENTS: recover from: without full snapshot capability, transaction rollback, hard to do for all cases BONUSES: up to date after reboot unless install broken (auto-recover) HOW WORK: apt-get: here, RH, but obviously it works even better on debian