Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sudo for Windows

devblogs.microsoft.com

Post reply on HN
Print view View original

411–420 of 439 posts

Re: Sudo for Windows

#411

Post by progmetaldev »

dagw wrote: post #364
emmelaich wrote: post #339

Earlier quoted context omitted.

A link in the article explains ... https://learn.microsoft.com/en-us/windows/sudo/#how-is-sudo-...

It only explains what is different between sudo and runas. It doesn't really explain why they couldn't just improve runas and add those missing features instead of creating a new command. As it stands now you seem to need both sudo and runas to cover all reasonable use cases.

Backwards compatibility and changing the security dynamic of existing scripts. I'm sure it is probably possible to achieve using runas, but my guess is that it would greatly delay adding this functionality, as they would have to cover all concerns for which runas is used.

Re: Sudo for Windows

#412

Post by FirmwareBurner »

Sakos wrote: post #397
FirmwareBurner wrote: post #355

Earlier quoted context omitted.

Did I stutter?

Apparently, because you can't seriously be asking that question. You've clearly never worked in any kind of customer support position, because businesses and individuals need all kinds of help with a transition like that.

>Apparently, because you can't seriously be asking that question.

YEs I was asking seriously. You still haven't explained what those challenges could be. All you do is mock people for their genuine questions without providing any actual answers/information to back up your vage statements.

>You've clearly never worked in any kind of customer support position

Then if that's clear for you I haven't never done that, why would you not understand I was being serious? Why are you being disingenuous here? Or you just enjoy being a troll?

> because businesses and individuals need all kinds of help with a transition like that.

Mate, 12 year-olds in my developing country can run Windows 11 updates/installs for you, including installing pirated licenses and cracks for you if you pay them 5 bucks.

What could be so complicated that the internal IT of a company can't figure out the transition from Windows 10 to 11 that they need to pay outside help for that? Especially that backwards compatibility is one of Microsoft's fortes to make life easier for admins and convince companies to stay in their ecosystem.

Re: Sudo for Windows

#413

Post by efreak »

zadjii wrote: post #196
jraph wrote: post #149

Earlier quoted context omitted.

Look, I'm genuinely curious and we happen to have a MS dev here who could provide interesting first hand insight. I'm not critical. I don't have enough knowledge on the situation to share criticism on the topic yet. I could have added "Could you expand on this?" to clarify my intent.

To answer the original question: I've been at MSFT like, 8 years now? And this is probably the third serious attempt my team has made at Sudo for Windows. (I think I heard of a couple other attempts in my tenure as well). After the last attempt, my mantra had always been "this is impossible to actually ship". It's a tricky feature to ship, cause it is ultimately something that can be used as an escalation of privileg…

If you can get the suggestion passed on, a simple way to run a process while _dropping_ elevation would be appreciated. Basically the _opposite_ of sudo. There should be a way to _easily_ drop permissions back to the standard desktop user (or lower?), like Linux's setuidgid. There's runas, but apparently that's not sufficient[0]; instead all I'm aware of is scheduled tasks and proxying through explorer, or leaving an unelevated process open and using IPC or other methods to tell if to run something else (none of this is easy in a simple batch file).

The biggest visibility into this issue is software installers, which regularly offer to launch the freshly installed program for the user's convenience...with the same elevated permissions the installer itself uses.

[0]: according to this SO answer, runas still runs the process with high integrity: https://stackoverflow.com/questions/20218076/batch-file-drop...

Re: Sudo for Windows

#415

Post by blangk »

23jhiu23hui wrote: post #259
FergusArgyll wrote: post #166

Considering the way PowerShell commands go, I assume this will be: RunWithAllTheElevatedPermissionsPossible --YesEvenThose .\inthisfolder.folder\. grep : The term 'grep' is not recognized....

It's evident that you haven't used PowerShell. Almost all commands in PowerShell have short aliases. For instance, instead of typing 'Get-ChildItem', you can simply use 'gci', which stands for the first letters of each word. Unlike Bash and other shells, where you must learn various Domain-Specific Languages (DSLs) to handle XML, JSON, YAML, etc., PowerShell allows you to use its native language to work with any data…

Yeah I tend to use both. For some more involved scripting sometimes the verbose command proper names are nice as it reads better, but the short names are nice when hacking

Re: Sudo for Windows

#416

Post by bogantech »

Repulsion9513 wrote: post #178
remus wrote: post #36

Earlier quoted context omitted.

> Just that you can run a single command as admin? I mean, that's sudo's whole thing! [1] You can live your day to day terminal life without the risk of borking things too badly, then when you occasionally need to elevate to higher privileges you can do it easily for that specific command. [1] Technically not the whole thing obviously, but it's a very common use case.

That has nothing to do with sudo; you could do the same with su -c long before sudo existed...

If you know the root password

Re: Sudo for Windows

#417

Post by bogantech »

righthand wrote: post #221
a_vanderbilt wrote: post #37

Earlier quoted context omitted.

In what business segment is Libre Office superseding MS Office? Furthermore, NT supports "personalities". Why bother with a full Linux kernel when they could adopt the personality a la SUA?

Superseding in compatibility. I’m not talking about business segments. They don’t have to adopt it, they will probably fork it.

> Superseding in compatibility.

It's going to be more compatible with Word than Word is?

Re: Sudo for Windows

#418

Post by jodrellblank »

michaelcampbell wrote: post #375
neurostimulant wrote: post #78

Earlier quoted context omitted.

I think they should've named it something else to avoid confusion, especially if it doesn't have the same behavior as unix sudo. If it has different arguments and features, imagine the confusion of unsuspecting users searching how to use sudo in the future.

I just hope it's not in the PowerShell zeitgeist of `--Super_Long_Option_Names_that_Use_a_Mix_Of_Caps_And_things`

PowerShell options are all single dash, tab completable, case insensitive, will match on the shortest unique prefix, and can be aliased with shorter ones like `-EA` is `-ErrorAction, and are consistent because the shell parses them not the cmdlet.

Re: Sudo for Windows

#419

Post by jodrellblank »

westurner wrote: post #242
debugnik wrote: post #179

Earlier quoted context omitted.

Also 'start -Verb runas' in Powershell.

Is there anything shorter than `powershell.exe -executionpolicy unrestricted -file`? powershell.exe -executionpolicy unrestricted -file ./setup_windows.ps1 -InstallPSWindowsUpdate -UpdateWindows -UpdateChocoPackages setup_windows.ps1: https://github.com/westurner/dotfiles/blob/develop/scripts/s...

    powershell.exe -executionpolicy unrestricted -file ./setup_windows.ps1 -InstallPSWindowsUpdate -UpdateWindows -UpdateChocoPackages
    powershell -ex bypass -f ./setup_windows.ps1 -I -UpdateW -UpdateC
(or whatever are short enough to uniquely identify parameter names for your script)

Re: Sudo for Windows

#420

Post by jodrellblank »

ptx wrote: post #319
wvenable wrote: post #195

Earlier quoted context omitted.

Oh it is, just in all the worst ways. I mean look at this: $value = 10 if ($value -eq 10) { Write-Host "Value is exactly 10." }

At least it doesn't let you do this (as far as I can tell) so it seems slightly better in that aspect: value="1 -o 1" if [ $value -eq 10 ]; then echo "Value is exactly 10." fi The syntax is terrible, though – if these operators are not actually options for a command, which is the context where the leading dash makes some kind of sense, why make them look like that? Also, why does the documentation[0] talk about state…

What else would the operators be? They can't use `>` because that does IO redirection, they can't use `|` for OR because that's piping.

They could use `==` for equality but then what symbols would -ceq and -ieq be?

What symbols or what else would work for `-match` and `-in` and `-cmatch`?

If they were just `eq` or did use `==` how would that work for when they are actually options to a cmdlet such as `| where-object -eq $x` ?

Post reply on HN