🥺: the best sudo replacement • Hacker News Board

Re: 🥺: the best sudo replacement

#431

Post by still_grokking » Sat, Jan 21, 2023, 6:40 AM UTC

remram wrote: post #416

e44858 wrote: post #388

Earlier quoted context omitted.

I’m guessing something like `chown root ~/.bash*` would prevent that, if all the folders in your PATH are owned by root.

You can close some gaps, but at the end of the day you can't expect that you'll run malicious code but it won't do this or that. For example the X server allows any client to listen for key events or hook into other windows.

> For example the X server allows any client to listen for key events or hook into other windows.

That's one of the reasons why "lock screens" are a lie under X.

But that's one of the problems Wayland solves. It has a much better security story.

Re: 🥺: the best sudo replacement

#432

Post by still_grokking » Sat, Jan 21, 2023, 6:44 AM UTC

wkat4242 wrote: post #387

AtlasBarfed wrote: post #61

Earlier quoted context omitted.

Except the enterprise security industry is waging war on ssh keys and ssh/sshd.

In the enterprise key management can become a bitch really quickly. Good luck updating 10.000 servers every time an admin leaves. For them ssh certificates are much better because you can simply revoke them, and new certs don't have to be added to each server. At home I still use keys though, but as an enterprise admin I see the issues. Even at home it's kinda annoying having to add a new yubikey to 20 servers.

> In the enterprise key management can become a bitch really quickly. Good luck updating 10.000 servers every time an admin leaves.

Can't "jump host" solve this?

(Not an admin, so please excuse if the question is stupid).

Re: 🥺: the best sudo replacement

#433

Post by scns » Sat, Jan 21, 2023, 6:45 AM UTC

epakai wrote: post #403

accrual wrote: post #401

Earlier quoted context omitted.

I noticed and enjoy that both sudo and doas use each side of a standard qwerty keyboard to type, though doas uses 3 keys on the left while sudo has two on the left and two on the right. It made the transition a little easier for my muscle memory.

On dvorak they're also mostly on the home row (except d), and the split is even 2-2 for both. (aoeu)id(htns)

The neo2 layout has both in the home row.

Re: 🥺: the best sudo replacement

#434

Post by xena » Sat, Jan 21, 2023, 6:46 AM UTC

Vecr wrote: post #429

I think there's a security problem with this command. The command does not verify it's called as [xn--ts9h], it really needs to verify args[0] equals the name of the command, otherwise you could call it though a link or mapping, etc. The article states that the name is important for security, so I'm submitting this bug as critical.

https://github.com/Xe/xn--ts9h/commit/861f8fa86ef58cdc371b0e... I will make a new set of packages tomorrow because I am tired

Re: 🥺: the best sudo replacement

#435

Post by fsckboy » Sat, Jan 21, 2023, 7:01 AM UTC

i don't like sudo, but I feel no need to replace it. I type "sudo su -" and I'm good to go.

Re: 🥺: the best sudo replacement

#436

Post by still_grokking » Sat, Jan 21, 2023, 7:08 AM UTC

I just open a root shell with `sudo -i` when I need to do some admin stuff… But that's not the point.

If the post is a joke it's not a good one. Sudo has issue, sure. But this tool is even worse! You could just start working as root user the whole time, like many people do (or did) under Windows, but we all should know where this will end.

The developer didn't do anybody a favor creating this. He will be imho directly responsible for any harm done by this tool.

People should really think upfront about the consequences of their stupid jokes.

People are dying these days form "changeless" on TikTok that are often also just stupid jokes put online by even more stupid people without any sense of responsibility. I see parallels here to be honest.

Re: 🥺: the best sudo replacement

#437

Post by sshine » Sat, Jan 21, 2023, 7:13 AM UTC

xahrepap wrote: post #386

doublepg23 wrote: post #298

Earlier quoted context omitted.

I've run into a service where having a password longer than 15 characters _truncates_ it but the password change dialog does not so it's stuck in limbo.

The PayPal forgot password form had this bug just a couple years ago. I changed my password to a generated one. And it was too long. But it didn’t tell me. Just silently truncated. I used the password reset to change it. This time I used a pretty short password I could type (to rule out a weird copy-paste bug or something). Logged in, went to the change password option and THAT page informed me there was a character…

Password character limits are important.

They reveal that the back-end service probably doesn't hash the passwords, which is a good time to GTFO.

Re: 🥺: the best sudo replacement

#438

Post by eptcyka » Sat, Jan 21, 2023, 7:14 AM UTC

CGamesPlay wrote: post #419

bobbylarrybobby wrote: post #418

Earlier quoted context omitted.

I thought safe rust did prevent race conditions by preventing simultaneous write access to data except behind a Mutex or similar guard.

That's a memory safety issue that caused by a race condition. Rust prevents memory safety issues, but not race conditions. The race condition in one of the CVEs is in the filesystem, not in sudo.

Rust does prevent memory race conditions, but of course, only within the address space of the process and only for memory read and written to exclusively by rust code.

Re: 🥺: the best sudo replacement

#439

Post by sshine » Sat, Jan 21, 2023, 7:16 AM UTC

skim_milk wrote: post #414

alisonatwork wrote: post #338

Earlier quoted context omitted.

One site I went to lowercased my password before storing it unencrypted in the DB, which I only discovered after failing to log in and asking for a password reset mail, so it helpfully emailed me my clear text lowercased password.

I worked at a place that did this, case-insensitive passwords and all. The worst part? They had unencrypted production database backups on all of their dev laptops, the majority of which left the premises after every night. I couldn't get a figure of how many laptops were lost but statistically speaking there had to have been at least 3 lost laptops with unencrypted production database backups per year using industry…

I have former employers who still didn't fix the security bugs I uncovered years after.

I don't know what makes a manager turn off snooze on open PRs for fixing blatant holes.

But if you've got that skill, it can take you far!

Re: 🥺: the best sudo replacement

#440

Post by int_19h » Sat, Jan 21, 2023, 7:23 AM UTC

thaumasiotes wrote: post #369

int_19h wrote: post #322

Earlier quoted context omitted.

If there's a 1:1 mapping from some emoji to one of the basic Chinese logograms, we should just reuse the pronunciation of the latter as the name of the emoji. This one could be "qiu", for example.

> This one could be "qiu", for example. The wechat shortcode for their similar face is 可怜. As far as I know, it is not used for begging (and therefore couldn't be called 求); the one time it was used to me, it seemed to express something more like "ouch!".

Officially, it's "pleading eyes", and it seems to be used as such in this case at least.