Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

🥺: the best sudo replacement

xeiaso.net

Post reply on HN
Print view View original

381–390 of 559 posts

Re: 🥺: the best sudo replacement

#381

Post by bee_rider »

eyelidlessness wrote: post #366
recuter wrote: post #239

Earlier quoted context omitted.

The damage is done, they are alas, already triggered.

I’m going to give you the benefit of the doubt that you mean this in good faith, even though I don’t think you do. What is the damage, and how doesn’t the site owner explaining how to consume their site without furries address it?

I think it isn’t necessary to give them the benefit of the doubt, they’ve brought up the language of triggering despite the original post just being sort of annoyed. In fact the original post explicitly says they don’t care about “furry shit” as they put it.

Re: 🥺: the best sudo replacement

#382

Post by nequo »

steveklabnik wrote: post #132
madeofpalk wrote: post #129

Earlier quoted context omitted.

as in gay bottom? first i've heard of that (as a gay internet person)

Think “sexually submissive,” who you’re attracted to is an orthogonal thing.

I thought it was bottom as in "⊥". But that is orthogonal too.

Re: 🥺: the best sudo replacement

#383

Post by [deleted] »

xena wrote: post #133
brundolf wrote: post #121

Some people probably hate it, but I really enjoy the conversational format of these posts. Very novel and interesting way to bounce around a topic

Thanks! That's exactly the point of it! I'm going to be working on the CSS this weekend on stream (the images being so big for longer conversations take up too much screen real estate), but in general the idea is to have a combination of the Socratic method of dialogue based teaching combined with a few consistently written characters; not to mention it helps move out parentheticals to break up giant walls of text. I…

[deleted]

Re: 🥺: the best sudo replacement

#384

Post by recuter »

bee_rider wrote: post #381
eyelidlessness wrote: post #366

Earlier quoted context omitted.

I’m going to give you the benefit of the doubt that you mean this in good faith, even though I don’t think you do. What is the damage, and how doesn’t the site owner explaining how to consume their site without furries address it?

I think it isn’t necessary to give them the benefit of the doubt, they’ve brought up the language of triggering despite the original post just being sort of annoyed. In fact the original post explicitly says they don’t care about “furry shit” as they put it.

How does one discern "sort of annoying" and "triggering"? Sounds like they are coping with severe trauma to me personally. It isn't cool to minimize others peoples pain like this.

Re: 🥺: the best sudo replacement

#386

Post by xahrepap »

doublepg23 wrote: post #298
azalemeth wrote: post #168

Earlier quoted context omitted.

The are quite a lot of "gotchas" with passwords being Unicode though. One of my favourite tricks is to include a null byte in passwords and see what happens. Sudo treats it as the end of the string. Passwd gives "token manipulation error" and nopes out. Many websites seem to fail in interesting ways...

I've run into a service where having a password longer than 15 characters _truncates_ it but the password change dialog does not so it's stuck in limbo.

The PayPal forgot password form had this bug just a couple years ago. I changed my password to a generated one. And it was too long. But it didn’t tell me. Just silently truncated.

I used the password reset to change it. This time I used a pretty short password I could type (to rule out a weird copy-paste bug or something). Logged in, went to the change password option and THAT page informed me there was a character limit.

Re: 🥺: the best sudo replacement

#387

Post by wkat4242 »

AtlasBarfed wrote: post #61
CameronNemo wrote: post #35

For some more serious alternatives, I have heard of many people finding doas to be a drop in replacement. Furthermore, I've heard some people suggest neither doas nor sudo, but instead using an SSH server to gain root access to your local machine. It could listen on localhost and use key-based auth to allow root logins...

Except the enterprise security industry is waging war on ssh keys and ssh/sshd.

In the enterprise key management can become a bitch really quickly. Good luck updating 10.000 servers every time an admin leaves.

For them ssh certificates are much better because you can simply revoke them, and new certs don't have to be added to each server.

At home I still use keys though, but as an enterprise admin I see the issues. Even at home it's kinda annoying having to add a new yubikey to 20 servers.

Re: 🥺: the best sudo replacement

#388

Post by e44858 »

remram wrote: post #137
mid-kid wrote: post #88

Earlier quoted context omitted.

Using key-based auth without encrypting the key with a password sounds like a bad idea, as then any program running on the host can trivially gain root privileges.

Any program running as your user on your personal machine can trivially gain root privileges, by dropping a program called "sudo" in your personal PATH, putting a "sudo" command in your .bashrc, man-in-the-middle a shell (how do you know that last command actually completed?), or hijacking any of the graphical programs that trivially ask you for your UNIX password to do anything (Discord/Slack/... updater, Steam, ...…

I’m guessing something like `chown root ~/.bash*` would prevent that, if all the folders in your PATH are owned by root.

Re: 🥺: the best sudo replacement

#389

Post by wkat4242 »

imiric wrote: post #302
xena wrote: post #123

Earlier quoted context omitted.

The main problem with SSH keys is that they are good at small scales, but at larger scales the abstractions start to be really leaky. Distributing SSH keys across hundreds of machines is a nontrivial task. Not to mention the lack of audit logging in opensshd and the lack of session recording (these requirements suck but acronym compliance means you need them anyways). It's also kind of the wrong tool for the job anyw…

> Distributing SSH keys across hundreds of machines is a nontrivial task. SSH certificates are a thing.

Yes but the OP was referring to SSH keys being eschewed by the enterprise. I assume they didn't consider certificates part of this category.

For enterprise the certificates are a far better option. Or s full blown IDP of course.

Re: 🥺: the best sudo replacement

#390

Post by gorgoiler »

I always liked Debian’s really. The first thing it does is make one system call to see if you can open a file in /etc with write permissions. If you can’t then it crashes immediately without doing anything else. The attack surface is very small.

https://manpages.debian.org/stretch/chiark-really/really.8.e...

sudo’s notion of some people being able to do some things but not others just doesn’t seem very relevant these days, and never really sat nicely with me in my multi user Unix host days either. I was much more in favor of giving people multiple system accounts and letting the system auth (ssh) handle who can do what.

Now of course we all have umpteen complete hosts each, and the security boundaries are at the virtualisation layer. Passwordless sudo all ‘round!

Post reply on HN