Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

🥺: the best sudo replacement

xeiaso.net

Post reply on HN
Print view View original

541–550 of 559 posts

Re: 🥺: the best sudo replacement

#541

Post by bee_rider »

xena wrote: post #332
xena wrote: post #81

Earlier quoted context omitted.

Speaking as the author of the work, most of _this post_ is satire meant to make you think about the existing security boundaries involved in privilege escalation. It is a false problem. The part about being annoyed that sudo is still written in C is coming from a sense of exasperation that there's still more predictable memory safety bugs involved with sudo because it's still written in C. The comment about python-cr…

Update: after some feedback from a trusted advisor I have rephrased this conversation snippet: https://xeiaso.net/blog/%F0%9F%A5%BA#:~:text=A%20prior%20ver... . Here is the new version (same links): > I don't know about the code quality standards of the sudo project, but overall I don't see them doing any concerted effort to try to migrate away from C and there are frequent security vulnerabilities that result in att…

FWIW as one of the original complainers this seems like a perfectly good edit to me.

Also the overall article was quite interesting and I think the template is really accessible and fun to read. If I knew there would be a bunch of ancillary complaining this thread, I probably would have kept quiet!

Re: 🥺: the best sudo replacement

#542

Post by bee_rider »

Dylan16807 wrote: post #531
goodpoint wrote: post #484

Earlier quoted context omitted.

Here we go, I'm at -3 and you are faint grey.

Hint: If you make a comment that is confrontational but makes no other points, many (if not all) of the people downvoting you are not your opponent, they're someone unrelated who thinks you made an annoying comment. Those downvotes prove absolutely nothing about your opponent.

The number one rule of all sites with voting is that we downvote discussions of voting itself!

Re: 🥺: the best sudo replacement

#543

Post by bouke »

lelanthran wrote: post #454
cmeacham98 wrote: post #250

Earlier quoted context omitted.

This has nothing to do with Unicode (assuming that by "Unicode" you mean "UTF-8"). The null byte has the exact same meaning in UTF-8 as ASCII: https://stackoverflow.com/questions/6907297/can-utf-8-contai...

> The null byte has the exact same meaning in UTF-8 as ASCII: https://stackoverflow.com/questions/6907297/can-utf-8-contai ... And what meaning is that? That link doesn't refer to an authority on the meaning of the nul byte.

In C, strings are nul terminated. Thus when at some point your password is passed along a tool written in C (or any language with the same behaviour) it’ll be truncated at that position.

Re: 🥺: the best sudo replacement

#544

Post by j0057 »

lrvick wrote: post #400

I feel it relevant to point out that any application running as a user that can run sudo, can just steal your sudo password. https://gist.github.com/lrvick/b0f4b744ab277582b1f9c50e0eb87... Having a password or a key or any other nonsense to run sudo is security theater. If you do not want all applications to have real root access, use Qubes to isolate applications into VMs, or at the very least have your daily driver…

Yes, it took me some thinking but it's the conclusion I arrived at as well; the password is useless because as soon as somebody or something can run a bad process it's game over, first of all because all the files I really care about are owned by and writeable by me, and secondly because the bad process can just mess with .bashrc and get root access later. About the only benefit I could think of is slowing down an opportunistic attacker that finds my device unlocked, but even that could be game over with a quick `curl ... | bash` if the attacker is prepared enough. 'Security theater' was my conclusion as well, and I was surprised by it, why is everybody doing this?

Re: 🥺: the best sudo replacement

#546

Post by pxc »

xena wrote: post #526
xena wrote: post #229

Earlier quoted context omitted.

I'm gonna work on the CSS on stream this weekend. It's something that usually comes up in bad faith so I haven't really prioritized acting on it. However I think I finally understand enough CSS to do it properly.

Fixed on stream. The CSS looks a bit better now.

It looks good to me! It's easier for me to tell that the main body is totally separate from the dialogue now. (Before, I wasn't totally sure if the main body was just one of the people in the dialogue monologuing sometimes, although I usually assumed it wasn't.)

Very readable, still fits with the theme, and helps clarify the genre. :)

Re: 🥺: the best sudo replacement

#547

Post by yamtaddle »

avgcorrection wrote: post #74
yamtaddle wrote: post #66

Earlier quoted context omitted.

Judging just from that, I'd have taken the meaning as "verge of crying" or "my pet just unexpectedly died" Until I read that comment I was having real trouble figuring out WTF it had to do with running commands. I thought it might be some practical joke tool that automatically modifies your commands such that they'll make you sad when they run.

Google “puppy dog eyes”. Don’t get why we have to bust out all the cringe internet lingo to describe something that you see in that venerable “real world”.

Would like to note that I happened to see someone I know use this over the weekend and it was unambiguously intended as the "verge of crying" meaning I guessed previously, not "puppy dog eyes". LOL.

Re: 🥺: the best sudo replacement

#548

Post by 314 »

xena wrote: post #510
314 wrote: post #470

Earlier quoted context omitted.

The satire came through loud and strong. Perhaps consider that feedback from hn is somewhat biased on the spectrum? I thought the style was a refreshing change.

I think in my next post about this I'm going to have a giant banner for HN visitors that will block you from reading the article that says "THIS ARTICLE IS SATIRE" just to see how that changes what people say in the comments. I doubt it will have the impact I want though.

Those kids would be really upset if they could read.

Re: 🥺: the best sudo replacement

#549

Post by SLWW »

Wowfunhappy wrote: post #349
SLWW wrote: post #325

Earlier quoted context omitted.

I think the author intended it as a valid criticism, though it's hard to tell given the passé stylistic choice that calls back to early internet (I am nostalgic for those days sometimes). However I disagree with that as it's just one more, fairly silly, obstacle to overcome. If this "replacement" ever did, theoretically, been seen as suitable, all that would happen would be that attack code would suddenly see an incr…

> If this "replacement" ever did, theoretically, been seen as suitable, all that would happen would be that attack code would suddenly see an increase in quality. This is where I believe security-through-obscurity is underrated. As long as you're small enough that targeted attacks aren't part of your threat model, merely being unique affords a great deal of safety. Your wierdo jerry-rigged authentication system may n…

In the event that something is seen as suitable; i'm assuming it would see some adoption (that's the assumption I wrote the comment under).

However I do agree, at least against automated attacks; there will be a bit more security. Though if you are doing anything serious that draws attention, at that point obscurity is all but putting off the enevitable failure if you are ever targetted.

Re: 🥺: the best sudo replacement

#550

Post by SLWW »

adenozine wrote: post #343
SLWW wrote: post #336

Earlier quoted context omitted.

I do think it's funny how this is the only comment in the thread that isn't greyed out. I wonder if there would be a way to lose the 'value' of a downvote if the account in question predominantly downvotes a specific opinion too much (a form of abuse i think). The assumption being that, "ok, you downvoted three posts, that were all very incendiary; though the other 40+ you've downvoted were all that way, statically t…

I mean, I heard it put this way and it has always stuck with me: every conversation here is implicitly inclusive of @dang. He’s wholly responsible for the vibes at large, and in the past several years it has become blindingly clear that he has no issues or qualms with Rusticles overtaking any thread they choose. I could write a scathing 10k word treatise on any topic with a single pithy remark about Rust in it somewh…

Unfortunately that's often a result of administration. He does have notable ownership of how certain things are, and you do see his bias peak through in many different ways.

You mention the "chilling effect" that does exist, and you aren't the only one, I've seen a lot of comments like yours not just on this site, but on pretty much any site that sees any advocacy for the Rust they promote.

I think there might be some value in filtering through something like a GreaseMonkey extension; which I've been debating for a good while if i should just make. Simply allow to remove listings from the HN page that inlude 'blacklisted' domains and filter key words. Such as "rust" in the title would see a removal.

But yeah, I think there is a place for Rust, just not where we see it for the most part, and i am increasingly bothered by the issues it presents for the Linux community (which was disregarded by the article posted hilariously enough, they can't even show respect for the communities they cause issues for, a core inidicator of narccistic behavior).

Post reply on HN