Re: No magic bullet
I dunno, I think that root is enough, ...
It depends on the use case though. There are situations where the fairly course grained unix permission system just isn't suitable. For example, you may have a system where root needs to administer the actual computer, but you wouldn't want the root user to have full control over the system; for example you may have sensative information on there, which the systems administrator may not be authorised to read. In these situations you do need a permission system that can allow full control of the computer but not unrestricted access to everything.
The other problem arises that the other major OS that provides a decent hierachical fine grained permission system is NT, which unfortunatly got Windows grafted onto it (and all the historical baggage that came with it), and whilst, in theory, it has a much better more fine grained system for permissions, in reality it's complex and troublesom and very very easy to misconfigure; so many people simply don't bother. (Plus I suspect it's slightly broken as I've more than once had the 'effective permissions' dialog show me I should be able to access a file....)
The question "Why did Apple feel that root, administrator of the system, needed to be locked out"? Has not been answered.
Apple don't make 'computers' in the traditional IT sense, they make computers for consumers; and sometimes, in Apple's opinion (and I must confess having done many years of 'IT support' for friends it's an opinion I can sympathise with*), sometimes consumers need protecting from themselfs; whilst still being able to install software that requires system wide accesss.
If the person responsible for the system borks their computer or company server then that is something that they must deal with.
If the person responsible is a trained IT professional then absolutly, yes. But just as we let non trained mechanics drive cars, sometimes non IT professionals need or want to use computers. Apple is trying to minimise the amount of time these people spend calling Applecare, or negative fallout from the 'I didn't click on ANYTHING, it just BROKE' crowd. Had OSX been designed from the ground up it probably wouldn't have the concept of 'root' in the traditional sense, but it's an evolution of a 26 year old OS. (with it's roots much further back than that).
*Seriously; once had a friend who on finding an issue just started randomly deleting files in C:\WINDOWS that they 'didn't like the sound of'. It didn't fix the issue. :(