Good habits. YES.

Running as ROOT.. 770 specific answer? When I do xterm/ whoami, I get user (when r&d mode is enabled)

When I signon as root from SSH on another machine, I am root.

When I sudo gainroot, whoami indicates root.

Here's what happens then:

"#!/bin/sh -e
trap exit SIGHUP SIGINT SIGTERM
PATH=/bin:/usr/bin:/sbin:/usr/sbin
MODE=`/usr/sbin/chroot /mnt/initfs cal-tool --get-rd-mode`
if [ x$MODE = xenabled ]
then
echo "Root shell enabled"
/bin/sh
else
echo "Enable RD mode if you want to break your device"
fi"

This looks like a check to the "flash" part of the 770 to see if we're in R & D mode.

Then "if r & D mode," we run sh

How is a port-scan attack more effective when the tablet is "running" as root?

sudo has been two things: 1. a way to limit who does what 2. a way to log who does what

I haven't seen any logs retained on my 770.