Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

🥺: the best sudo replacement

xeiaso.net

Post reply on HN
Print view View original

471–480 of 559 posts

Re: 🥺: the best sudo replacement

#471

Post by msla »

schroeding wrote: post #443
msla wrote: post #424

Earlier quoted context omitted.

I just have to say: May you one day end up on a system nobody uses, and watch as your environment dies so other people can have "nice things".

Why shouldn't people try different, novel approaches on their personal websites, though? Where else should one try out "weird" (non-mainstream) concepts and see what sticks? I don't understand your harsh dismissal of the author based on the design of a personal website, to be honest.

I'm responding to this:

> I don't know about the code quality standards of the sudo project, but overall I don't see them doing any concerted effort to try to migrate away from C (or to reduce the complexity of sudo) and there are frequent security vulnerabilities that result in attackers getting root access anyways. I really wish the industry as a whole would take languages like Rust a bit more seriously and start actually moving towards programs being safer to use because security vulnerabilities in core infrastructure result in emergency patches. It was disappointing to see an attempt at using Rust in an important Python library torpedoed by users of obscure architectures not supporting Rust. Maybe the solution there is to use WebAssembly as a compile target instead of making everything be native code. I wouldn't wish hppa's reverse stack growth on anyone trying to write a compiler though.

Which was edited from this:

> God I wish they did. They wrote the program in C, (as far as I can tell) have no intention of rewriting it in Rust, and it's had many viable attacks over the years that allowed attackers to gain root privileges and worse. It's also debatable if the entire concept of privilege separation as implemented in Linux and UNIX was a bad idea to begin with but we're stuck with it because of an endless ball of legacy programs controlled by egotistical open source people that refuse to change because then obscure targets that nobody uses won't be able to leech off of the rest of the ecosystem by holding back any chance to let us have a modicum of nice things.

I don't care about their website design (it's better than a number of "serious" websites I've visited) and I don't care about their characters, especially since it's a literally ancient way to explore philosophical issues and being a furry is morally better than being a pederast, as the Ancient Greeks were.

Re: 🥺: the best sudo replacement

#472

Post by wkat4242 »

account-5 wrote: post #451
wkat4242 wrote: post #387

Earlier quoted context omitted.

In the enterprise key management can become a bitch really quickly. Good luck updating 10.000 servers every time an admin leaves. For them ssh certificates are much better because you can simply revoke them, and new certs don't have to be added to each server. At home I still use keys though, but as an enterprise admin I see the issues. Even at home it's kinda annoying having to add a new yubikey to 20 servers.

You have 20 servers at home? What's you electrical bill like?

Last month's electricity bill was about 75€ including electric heating, VAT and fixed charges. I do get 2 hours free per day during which I run the heading full blast at the moment, and other high energy stuff.

Most of my servers are not always on, some are in the cloud and some are virtual.

The ones that run 24/7 are NUCs which have excellent idle energy usage. The bigger ones are HP microservers but like I said those just run when I need them (there's about 100 TB of archive storage in them).

And then I have some raspberries to run my home Assistant and some other stuff. All in All I have about 10 real 'servers', 5 running 24/7, the rest are remote or virtual (one of the NUCs is an ESXi). Plenty of resources for a decent home lab.

With the recent increase in electricity prices I did move one of the microservers from 24/7 to on-demand.

Re: 🥺: the best sudo replacement

#473

Post by still_grokking »

nxpnsv wrote: post #441
still_grokking wrote: post #430

Earlier quoted context omitted.

I'm using Debian(Testing)/KDE/Plasma. (What was the point here?) I don't have any "Discover" installed as it's not needed for anything. There's aptitude… Regarding Discord: Discord is a virus. I try to avoid it. (And since you can't register without getting naked and showing the virus your telephone number it's not difficult to avoid ;-)).

I don't think I ever gave discord a phone number...

That just means you're fully transparent to them. (Likely they have linked other accounts / IIP data behind the scenes; using it form a phone will have that effect obviously).

It's almost impossible to register an anonymous account there. Even if you find a throw-away SMS number that works to register (which is hard enough) a few hours later they will block that account again and require a fresh number to unlock. I've given up even trying to register there; but plan to fill out some GDPR complains soon. Thanks for reminding me to do so…

Re: 🥺: the best sudo replacement

#474

Post by sshine »

sshine wrote: post #442
still_grokking wrote: post #428

Earlier quoted context omitted.

If Unicode weren't broken it wouldn't need any "normalization functions". And no, I don't have anything better to propose at the moment. Unicode is a mess, but currently without realistic alternatives. Still I would like to live long enough to see that we finally manage to create some proper text format without all kinds of crazy gotchas and deficiencies.

Care to elaborate? Are you suggesting that a better version of Unicode does not allow combining characters? [1] Some languages have an explosive amount of characters if you regard each possible modifier in combination with each base character, some of which aren't practically used. By allowing the composition of modifiers and base letters, all the historically used ones are available, and all the odd ones are technic…

One solution to allow combination characters, but only in a normalised way is to only allow one of the same modifiers, and only allow modifiers in the normal order. This makes parsing Unicode quite complex. If you allow for non-normalised Unicode and write a post-processor that normalises, you get to status quo.

So either you are suggesting to disallow non-normalised Unicode with the current definition, or something different altogether. I can't imagine what that alternative looks like.

(Also, I'm a Unicode fanboy. Sorry for the intensity.)

Re: 🥺: the best sudo replacement

#475

Post by StreamBright »

MobiusHorizons wrote: post #396

I feel obliged to mention doas[1], which is a sudo alternative from openBSD. It is written in c, but tries to be smaller and easier to configure. I am not qualified to vouch for or against it, but it is interesting. 1: https://man.openbsd.org/doas

I have moved over to doas a while back and it is really amazing. Why? Because it JUST WORKS. I do not need to learn a configuration language to understand what is going on. It does very little and that is exactly what 80% of the users need. We should use more software like that. Simplicity is the best design pattern.

Re: 🥺: the best sudo replacement

#476

Post by StreamBright »

AtlasBarfed wrote: post #61
CameronNemo wrote: post #35

For some more serious alternatives, I have heard of many people finding doas to be a drop in replacement. Furthermore, I've heard some people suggest neither doas nor sudo, but instead using an SSH server to gain root access to your local machine. It could listen on localhost and use key-based auth to allow root logins...

Except the enterprise security industry is waging war on ssh keys and ssh/sshd.

It is not as much the enterprise security industry as it is better security for all. Problem with the current implementation with ssh keys is that there are non-trivial problems with it. For example how do you revoke a key? It is not possible in a central AAA service to revoke access for a user like it is possible for other kind of auth systems. Ssh and ssh keys were designed in an era where security was not really the primary concern. I think Facebook DevOps team had some detailed article how they manage ssh access to fb production with keys.

Re: 🥺: the best sudo replacement

#479

Post by schroeding »

msla wrote: post #471
schroeding wrote: post #443

Earlier quoted context omitted.

Why shouldn't people try different, novel approaches on their personal websites, though? Where else should one try out "weird" (non-mainstream) concepts and see what sticks? I don't understand your harsh dismissal of the author based on the design of a personal website, to be honest.

I'm responding to this: > I don't know about the code quality standards of the sudo project, but overall I don't see them doing any concerted effort to try to migrate away from C (or to reduce the complexity of sudo) and there are frequent security vulnerabilities that result in attackers getting root access anyways. I really wish the industry as a whole would take languages like Rust a bit more seriously and start a…

Ah, I see, misunderstanding on my side, also didn't see the old version. Sorry! :)

Re: 🥺: the best sudo replacement

#480

Post by ilyt »

hot_gril wrote: post #370
ilyt wrote: post #257

Earlier quoted context omitted.

Nope. I'm tired of people that can only yap their mouth without doing anything

[flagged]

that did 0.1% of what users use it for, and for a joke. Did you not read the article ? Maybe if you did you'd understand my reaction.
Post reply on HN