Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Use Touch ID for Sudo on Mac

davidwalsh.name

Post reply on HN
Print view View original

111–120 of 221 posts

Re: Use Touch ID for Sudo on Mac

#111

Post by samstave »

derefr wrote: post #106
jeffbee wrote: post #98

Earlier quoted context omitted.

This is a very macOS problem. Why does it reset every preference on updates? The one that kills me is wake-on-lan, that gets turned back on regardless. Hate!

Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…

Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration?

The richest company in the world can't think different?

Re: Use Touch ID for Sudo on Mac

#112

Post by toyg »

exikyut wrote: post #51
asidiali wrote: post #39

Earlier quoted context omitted.

Debatable and depends on length of time shortcut has been in use. I can type :wq like a madman. My finger can slide straight from w to q, whereas with double-z, I have to pick my finger up and put it back down. So much movement! What next, you want me to run a marathon?

I guess it's a learned dexterity thing. :wq = ZZ = As someone with mildly poor dexterity (and I don't touch-type with all my fingers, I mostly use my index fingers), the second approach looks somewhat more interesting to test.

That's all over the place from a touchtype perspective. 2nd finger? That's a pinkie. And you're supposed to use modifier keys from the opposite hand when available.

So it should be .

I honestly didn't know about ZZ, seems very convenient. :wq! on a qwerty forces the pinkie to travel all the way up to the top row, which is hell. On my home keyboard I use a layer for special characters, which helps, but still I guess I'll stick to ZZ from now on.

Re: Use Touch ID for Sudo on Mac

#113

Post by derefr »

samstave wrote: post #111
derefr wrote: post #106

Earlier quoted context omitted.

Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…

Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration? The richest company in the world can't think different?

They know exactly what files were customized in the previous OS-base-image. There’s a reason the whitelist is a whitelist, rather than a blacklist. Just guessing here, but it’s probably something to do with “iteration speed” vs. QA SLAs made to large enterprise customers like IBM.

In my hypothetical, there’s a set of preferences overrides Apple have been forced by contract to guarantee they’ll validate during their QA process, and then allow the OS to retain between updates. For any other file not forced by contract, they don’t bother with that QA process (“takes too long!”), and so default-distrust the ABI-stability of the file, and so don’t let the OS retain it between updates.

Re: Use Touch ID for Sudo on Mac

#114

Post by [deleted] »

samstave wrote: post #111
derefr wrote: post #106

Earlier quoted context omitted.

Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…

Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration? The richest company in the world can't think different?

[deleted]

Re: Use Touch ID for Sudo on Mac

#115

Post by Demigod33 »

samstave wrote: post #111
derefr wrote: post #106

Earlier quoted context omitted.

Because, like ChromeOS/CoreOS, modern macOS now does image-based updates. A macOS update isn’t “whatever was previously on your OS volume, plus arbitrary patch X”; rather it’s “a new, fresh OS disk image, written to a separate APFS volume, with a fixed SHA, with update transfer-size optimized by composing said image partially from files in your current OS, but only in such a way that the volume will still hash the sa…

Why cant Apple use their TimeMachine tech to take a snapshot of the prefs on the existing, then do their image based update, then have it automatically apply the prefs from the timemachine mod-integration? The richest company in the world can't think different?

What if one file was written by a malicious program?

Re: Use Touch ID for Sudo on Mac

#118

Post by jmarcher »

beyondcompute wrote: post #63
cprecioso wrote: post #56

This is amazing -- but every. single. update. disables it again Why does the sudo file not persist between updates? This case is quite minor for personal computers, but what about companies that log in with yubikeys or smart cards? Do they have to reconfigure after every update too?

I’ve just added this to my .bash_profile: enable-sudo-touchid() { sudo sed -i -e '1s;^;auth sufficient pam_tid.so\n;' /etc/pam.d/sudo } But probably automating the check (if the automated checker has the correct permission) would not be that hard.

A step further so you don't have to think about enabling it:

  sudo() {
    unset -f sudo
    if [[ "$(uname)" == 'Darwin' ]] && ! grep 'pam_tid.so' /etc/pam.d/sudo --silent; then
      sudo sed -i -e '1s;^;auth       sufficient     pam_tid.so\n;' /etc/pam.d/sudo
    fi
    sudo "$@"
  }

Re: Use Touch ID for Sudo on Mac

#119

Post by ivrrimum »

bitlevel wrote: post #8

The article will not allow sudo changes on Big Sur - at least, not without changing permissions of the sudo file first: 1. sudo -Si 2. chmod 644 /etc/pam.d/sudo 3. vi /etc/pam.d/sudo 4. Add the 'Auth sufficient pam_tid.so' line 5. chmod 444 /etc/pam.d/sudo 6. ... 7. Profit! Very handy tip though, thanks!

Still didn't work for me

Re: Use Touch ID for Sudo on Mac

#120

Post by anaerobicover »

chadlavi wrote: post #66
bombcar wrote: post #29

Earlier quoted context omitted.

I want a mouse with Touch ID in the button. Or on the side.

It would be cool if they built it into the touchpad in a future generation. I'm guessing once they can figure out fingerprint through the glass on iPhone they'll do it in the touchpad, too.

I'd have some concerns with this being trigger-able without positive intent to do so if it were in my mouse or trackpad. Having a small interruption can be beneficial for safety.
Post reply on HN