Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

🥺: the best sudo replacement

xeiaso.net

Post reply on HN
Print view View original

461–470 of 559 posts

Re: 🥺: the best sudo replacement

#461

Post by franga2000 »

remram wrote: post #272
pxc wrote: post #218

Earlier quoted context omitted.

When do any of those programs ask you for your password? I've never had any of them ask for my Unix password, ever. Is that just a macOS thing with self-updaters?

I'm using Ubuntu/KDE/Plasma. "Discover" is the GUI app that prompts you to install system updates, and will ask for your password when you do (to run apt/dpkg as root). Discord doesn't directly ask for my password, it downloads a .deb from somewhere and opens it, and I get prompted for my password then. Not much different IMHO.

Those are poklit popups, similar to UAC on Windows. The program doesn't get your password, but depending on what kind of access it requested, it could give it root access. If implemented correctly, the popup should say "wants to install a package" or "wants to mount drive X", which runs a predefined action on behalf of the app and doesn't actually give it any elevated permissions.

Of course, like UAC, an app could just make its own prompt that looks like the real deal and steal the password, but that seems to be an unsolved problem on every platform.

Re: 🥺: the best sudo replacement

#462

Post by dmitriid »

mr_toad wrote: post #365
mcculley wrote: post #107

The first time I saw perfectly valid Unicode take down an RSS reader (in ~2003), it was an ü that did it. I have taken to calling that the kaboomlaut in unit tests.

Umlauts are in Latin1, so it’s pretty shoddy software that couldn’t deal with that.

As late as 2020 I encountered a European shop that couldn't handle my Swedish address that had an å in it.

That is, it accepted the address on the website, but then it got screwed in the delivery.

I'm still in awe.

Re: 🥺: the best sudo replacement

#465

Post by karatinversion »

varajelle wrote: post #445
yjftsjthsd-h wrote: post #409

Earlier quoted context omitted.

Sarcasm/humor; the program in question does no authentication, so it's not an alternative in any meaningful sense.

I was thinking the same. But then I thought about it more and wondered why you need to enter your own password if you're already logged on. If an attacker is already in the system, it can install key logger and whatnot without the root password. And the xn--ts9h program can have the Unix permission so that only the user can run it.

You need to enter your password so that software you run can’t give itself root privileges without permission

Re: 🥺: the best sudo replacement

#466

Post by cerved »

dmitriid wrote: post #462
mr_toad wrote: post #365

Earlier quoted context omitted.

Umlauts are in Latin1, so it’s pretty shoddy software that couldn’t deal with that.

As late as 2020 I encountered a European shop that couldn't handle my Swedish address that had an å in it. That is, it accepted the address on the website, but then it got screwed in the delivery. I'm still in awe.

UPS sent me a parcel and replaced ä with ae

Re: 🥺: the best sudo replacement

#467

Post by chungy »

avgcorrection wrote: post #444
chungy wrote: post #219

Earlier quoted context omitted.

Depending on font. Inside my web browser, it appears to be looking up. On my web browser's title bar (so rendered by my window manager...), it appears to be looking down, or maybe straight forward. Fonts make a big difference on interpretation too. I remember a few years back, there was a problem where Apple implemented "GRINNING FACE" in such a way that Apple users interpreted it as a sarcasm indicator, but most oth…

Huh. That’s weird. A looking down variant sounds misleading.

If you think that's weird, compare it between common fonts: https://unicode.org/emoji/charts-11.0/full-emoji-list.html#1...

Disregarding the "browser" column (could be anything, it's what your browser renders the text as), only the Twitter font has the "looking up" variant that you think is normal. I'd rather say the straight-ahead look is the norm for most font designers when interpreting the "FACE WITH PLEADING EYES" description of the character.

Re: 🥺: the best sudo replacement

#468

Post by 0ld »

dmitriid wrote: post #462
mr_toad wrote: post #365

Earlier quoted context omitted.

Umlauts are in Latin1, so it’s pretty shoddy software that couldn’t deal with that.

As late as 2020 I encountered a European shop that couldn't handle my Swedish address that had an å in it. That is, it accepted the address on the website, but then it got screwed in the delivery. I'm still in awe.

you'd be even more impressed to find out how often polish characters (ąęłćśżźńó) get totally screwed in... poland itself

Re: 🥺: the best sudo replacement

#469

Post by camel-cdr »

CGamesPlay wrote: post #406

What was the point of this post? No, this program isn't a replacement for sudo; it's closer to a reimplementation of su. The post links to 3 CVEs and talks about Rust, but only one of the CVEs was a memory safety bug, the others are a logic error and a race condition, neither of which are protected by Rust (sadly).

Btw, there is a logical bug in the code, although it isn't exploitable. env::args().size() can be zero.

Re: 🥺: the best sudo replacement

#470

Post by 314 »

xena wrote: post #81
tristor wrote: post #69

Earlier quoted context omitted.

Honestly, I don't think you should take anything the author of this wrote seriously, the most charitable interpretation is that most of their work is a form of satire.

Speaking as the author of the work, most of _this post_ is satire meant to make you think about the existing security boundaries involved in privilege escalation. It is a false problem. The part about being annoyed that sudo is still written in C is coming from a sense of exasperation that there's still more predictable memory safety bugs involved with sudo because it's still written in C. The comment about python-cr…

The satire came through loud and strong. Perhaps consider that feedback from hn is somewhat biased on the spectrum? I thought the style was a refreshing change.
Post reply on HN